This policy explains how the company identified at the foot of this page (“we”, “Vaarto”) handles personal data in connection with the Vaarto platform.
1. Two different roles
It matters which of these applies, because it decides who you ask about your data.
We are the Data Fiduciary (controller) for data about our customers — the people who create a Vaarto account, sign in to the console, and pay us. This policy governs that data.
We are a Data Processor for data about our customers’ customers — the people they message on WhatsApp. We hold that data on the customer’s instruction and do not decide what it is used for. If you were messaged by a business using Vaarto and want your data accessed or deleted, ask that business: they control it, and we act on their instruction. We will help them respond.
2. What we collect
Account and workspace data. Name, work email, phone number, company name, password (stored only as an Argon2 hash, never in readable form), two-factor secrets, team membership and role, API key names and scopes.
Numbers you register. The phone numbers you put on the platform and the registration status Meta reports for them.
Message data. The content of messages sent and received, recipient and sender phone
numbers, WhatsApp profile names where WhatsApp supplies them, template names and variables,
delivery and read status, failure reasons from Meta, call status events, and any metadata
you attach.
Media. Files sent or received as part of a conversation.
Technical data. IP address, browser and device information, timestamps, API request logs, and error traces.
Contact form. Name, work email, company, phone and what you wrote, when you submit the form on this website.
We do not collect special category data deliberately. Do not send it to us in free text fields.
3. Cookies
We use the minimum needed to keep you signed in. We do not run advertising or cross-site tracking cookies, and there is no third-party analytics tag on this website.
| Cookie | Purpose | Duration |
|---|---|---|
| Session and refresh cookies | Keeping you signed in to the console | Until sign-out, or the refresh window expires |
vaarto_app |
A flag that lets this website show “Open app” instead of “Log in”. It carries no identifier and no secret, and the website never sends it anywhere. | Same as the session |
4. Why we process it, and on what basis
| Purpose | Basis |
|---|---|
| Creating and running your account | Performance of our contract with you |
| Sending, receiving and recording messages on your instruction | Performance of our contract with you |
| Billing, invoicing and tax records | Contract, and our legal obligations |
| Security, abuse prevention and rate limiting | Our legitimate interests in a safe platform |
| Transactional email — invitations, password resets, alerts | Performance of our contract |
| Responding to your contact form or support request | Steps at your request before a contract |
| Meeting legal, regulatory and law enforcement obligations | Legal obligation |
We do not sell personal data, and we do not use your message content to train models.
5. Who we share it with
Meta Platforms, Inc. Every message goes through WhatsApp’s Cloud API, so message content, recipient numbers and delivery status reach Meta. Meta processes this under its own terms. Using WhatsApp as a channel necessarily means Meta sees what is sent over it.
We reach Meta’s API using access you grant us during signup, through Meta’s own dialog, against the WhatsApp Business Account you own. We use that access only to run the service for you: sending and receiving your messages, and managing your numbers, templates and profile in the console. We do not use it for advertising, do not sell or transfer it, and do not share the data we obtain through it with anyone except the sub-processors listed below. Revoke it at any time and our access ends.
Our sub-processors. The vendors that host, store and transmit on our behalf are listed at Sub-processors, with what each one receives and where it is.
Professional advisers, auditors and authorities, where we are legally required or where we must establish or defend a legal claim.
An acquirer, if the business is sold or reorganised, under equivalent protections.
6. International transfers
Some of these parties — Meta, Apple and Google among them — process data outside India. Where we transfer personal data outside India, we do so subject to the restrictions in the Digital Personal Data Protection Act, 2023 and under contractual protections with the recipient.
7. How long we keep it
| Data | Retention |
|---|---|
| Message log and conversation history | Your plan’s retention period — 30 days on Starter, 12 months on Growth, as agreed on Scale |
| Media files | The same period as the message they belong to |
| Account and workspace records | While your account is open, then up to 90 days |
| Invoices and tax records | As long as Indian tax and company law requires, currently eight years |
| Security and access logs | Up to 12 months |
| Contact form submissions | Up to 24 months |
After the period ends, data is deleted or irreversibly anonymised.
8. How we protect it
- Passwords are hashed with Argon2; we never store or can recover a readable password.
- Two-factor authentication is available on every account.
- API keys are scoped, so a key issued to poll delivery status cannot read conversations, and any key can be revoked immediately.
- Traffic is encrypted in transit with TLS. Webhook endpoints must be HTTPS or WSS; plain
HTTP,
localhostand private addresses are refused. - Every webhook we send carries an HMAC-SHA256 signature of the raw body under your endpoint’s own secret, so you can verify it came from us.
- Access to production data is limited to staff who need it.
No system is perfectly secure. If a breach affects your personal data we will notify you and the Data Protection Board of India as the law requires.
9. Your rights
Under the Digital Personal Data Protection Act, 2023 you may:
- Access a summary of the personal data we hold about you and how it is processed;
- Correct data that is inaccurate, and complete data that is incomplete;
- Erase data we no longer need for the purpose it was collected for;
- Nominate another person to exercise your rights if you die or become incapacitated;
- Complain to us, and then to the Data Protection Board of India.
Ask using the privacy address at the foot of this page. We will verify who you are before we act, and respond within the statutory period. Exercising a right is free.
If your data reached us because a business messaged you using Vaarto, see section 1 — that business is who to ask.
10. Deleting your data
To delete your account and everything in it, email the privacy address at the foot of this page from the address on the account, with the subject Delete my account. We verify who you are, and within 30 days we delete the workspace, its members, the numbers connected to it, the message log and the stored media, and confirm in writing when it is done. Ask first for an export if you want one: we will provide it before deleting.
There is no self-serve delete button in the console today. Until there is, the email above is the route, and we treat it as a request under section 9 rather than as a support ticket.
Anything we are legally required to keep — invoices and tax records — is kept for the period in section 7 and used for nothing else.
Message data deletes itself at the end of your plan’s retention period without you asking, and media is removed on the same schedule. Section 7 has the periods.
Deleting your Vaarto account does not delete your WhatsApp Business Account. That account is yours and sits with Meta. Removing Vaarto’s access, from the console or from your Meta Business settings, stops us reading or sending on it; what Meta itself holds is governed by Meta’s own privacy policy and deleted through Meta.
If a business messaged you using Vaarto, we are only the processor — see section 1. Ask that business to delete your data and we will carry out their instruction.
11. Grievances
If you are unhappy with how we have handled your personal data, write to the privacy address at the foot of this page. We acknowledge a complaint within 24 hours and aim to resolve it within 15 days.
If we have not put it right, you may complain to the Data Protection Board of India.
12. Children
The service is for businesses. It is not directed at children and we do not knowingly collect data from a child. Tell us if you believe we have.
13. Changes
We may update this policy. The “last updated” date at the top of this page changes when we do, and we will tell you by email or in the console before a material change takes effect.