Privacy Policy

Waitizzy Technologies (OPC) Private Limited (“Waitizzy”, “we”, “our”, or “us”) respects your privacy and is committed to protecting your personal information. This Privacy Policy (“Policy”) explains what personal data we collect about you, how we use it, the legal basis on which we process it, who we share it with, and the rights and choices available to you.

Waitizzy is a cloud software-as-a-service (SaaS) application used by businesses. This Policy applies to the Waitizzy IMS web application, the Waitizzy CRM web application, the Waitizzy Booking web application (including public booking pages and customer booking-management links), the Waitizzy Accounts web application, related APIs, this and other official Waitizzy websites, marketing properties, support channels, and any other services we provide that link to this Policy (collectively, the “Services”).

This Policy is published in accordance with (i) the Digital Personal Data Protection Act, 2023 (the “DPDP Act”) and any rules issued thereunder, (ii) the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (the “SPDI Rules”), and (iii) other applicable Indian laws. It is an electronic record under the Information Technology Act, 2000 and does not require a physical or digital signature.

Please read this Policy carefully together with our Terms & Conditions and Refund Policy. By using the Services, you confirm that you have read and understood this Policy.

1. Who We Are — Data Fiduciary

For the purposes of the DPDP Act, Waitizzy Technologies (OPC) Private Limited is the Data Fiduciary for personal data of (a) prospective customers and account owners who sign up directly, and (b) employees of those account owners who access the Services on their employer’s behalf only where we determine the purpose and means of processing such data.

Where you (or your organisation) upload personal data about your own customers, leads, employees, suppliers, vendors, or other contacts into the Services, you are the Data Fiduciary in respect of such data and we act as a Data Processor processing that data on your behalf and on your documented instructions, under the terms of our agreement with you.

2. Information We Collect

We collect the following categories of personal data:

• Identity & contact data: name, business name, email address, mobile or landline number, designation, address, country, time zone, profile photo (if uploaded).
• Account & credentials: username, hashed password, multi-factor authentication settings, security questions, API keys, session tokens.
• Workspace & business data: organisation details, locations, stores, team members, roles, permissions, plan, seat count, configuration choices, and similar metadata.
• Customer Data uploaded by you: any personal data of your leads, customers, employees, suppliers, or contacts that you upload into the Services, including booking records, appointment times, assigned staff or resources, and notes. We process this data only on your behalf as a Data Processor.
• Public booking data: when a customer uses a merchant’s Waitizzy Booking link, we collect the name, phone number, and any other fields the merchant has enabled (for example email or custom form fields), plus the selected service, resource, time, and payment status. The merchant is the Data Fiduciary for that customer data; we process it to create and manage the booking.
• WhatsApp messaging data: where a merchant enables WhatsApp notifications in Waitizzy, we may process recipient phone numbers, names, message and template content, and delivery, read, and failure status. See Section 5.
• Billing & payment data: GSTIN, billing address, invoices, plan, transaction history, and WhatsApp usage metering (message counts, delivery status identifiers from Meta’s WhatsApp Cloud API, and configured unit rates used to calculate overage). We do not store full card numbers, CVVs, or net-banking credentials; these are collected and handled by our payment gateway partner (Razorpay), which is a PCI-DSS compliant provider, and we receive only a transaction reference, masked card details, payment method type, and status.
• Usage & device data: IP address, device type, operating system, browser type and version, language, referring URLs, pages viewed, features used, clicks, timestamps, error logs, performance metrics, and crash reports.
• Cookies & similar technologies: session identifiers, preference cookies, security cookies, and limited analytics identifiers (see Section 8 below).
• Communications: contents of your support tickets, chat messages, emails, call recordings (where lawfully permitted and notified), and feedback.
• Sensitive personal data or information (SPDI): we do not require you to share SPDI as defined under the SPDI Rules. Please do not upload SPDI of any data principal into the Services unless absolutely necessary for your business use of the Services and you have obtained all required consents.

3. How We Collect Information

• Directly from you: when you sign up, configure your Workspace, invite users, contact support, respond to surveys, or upload data.
• Automatically: through cookies, log files, web beacons, and analytics tools as you use the Services.
• From third parties: from our payment gateway partner Razorpay (transaction status), Meta’s WhatsApp Cloud API (message delivery and delivery/read/failure status), other email/SMS providers (delivery status), authentication providers if you use single sign-on, and from publicly available sources where lawful.

4. Purposes & Legal Basis for Processing

We process personal data for the following purposes:

• Provision of the Services: to create and maintain your Account and Workspace, to authenticate you, to provide the features you have subscribed to (including inventory, CRM, Waitizzy Booking, Waitizzy Accounts, public appointment booking, and WhatsApp business notifications), and to process transactions.
• WhatsApp business communications: where enabled by a merchant, to send, receive status for, and manage Utility WhatsApp notifications (for example booking confirmations, CRM follow-ups, and transactional alerts) through Meta’s WhatsApp Cloud API, and to meter usage for billing. See Section 5.
• Customer support & communications: to respond to your queries, send transactional communications such as receipts, security alerts, plan changes, and policy updates, and to provide support.
• Billing, taxation, and fraud prevention: to process payments, generate tax-compliant invoices, prevent fraud and abuse, and comply with anti-money-laundering, know-your-customer, and similar laws.
• Service improvement & analytics: to understand how the Services are used, to fix bugs, improve performance and user experience, develop new features, and produce aggregated and de-identified analytics.
• Security: to detect, prevent, and respond to security incidents, unauthorised access, abuse, and threats to the Services or to others.
• Marketing (with consent): to send you product updates, newsletters, and promotional content, only where you have consented or where permitted by law. You may opt out at any time.
• Legal compliance: to comply with applicable laws, regulations, court orders, lawful directions of governmental authorities, and to enforce our agreements.

Under the DPDP Act, we process personal data based on your consent or on permissible “legitimate uses” recognised under the Act, including the provision of the Services that you have explicitly requested, compliance with law or court orders, response to medical emergencies (where applicable), and similar grounds.

5. WhatsApp Messaging & Meta Cloud API

Waitizzy is used by businesses (merchants) to run operations and customer communications. A merchant may enable WhatsApp notifications inside their Waitizzy workspace. When they do, Waitizzy sends those messages through Meta’s WhatsApp Cloud API under Waitizzy’s integration (not a customer-owned Meta Business app by default). Merchants do not connect their own WhatsApp Business Account to Waitizzy unless we later offer that option and say so in product documentation.

We may process the following WhatsApp-related personal data:

• recipient phone number and, where the merchant has stored it, name and other CRM contact fields used to personalise the message;
• message content and approved template content (including variables the merchant inserts, such as a booking time or business name);
• delivery, read, and failure status and related message identifiers returned by Meta;
• merchant workspace identifiers needed to send the message and to attribute usage for billing.

Why we process it. We process this data only to provide WhatsApp business communications and related CRM / booking functionality that the merchant has enabled: sending Utility notifications, showing delivery status in Waitizzy, troubleshooting failed sends, and calculating included-quota and overage charges. We do not sell this data, do not use it to advertise to recipients, and do not use WhatsApp message content to train advertising models.

How it is stored and protected. Message metadata, recipient numbers, and content needed to operate the feature are stored in Waitizzy’s account-scoped systems (hosted with our cloud and database providers) and isolated to the merchant’s workspace. Access is limited by authentication and role-based permissions. Data in transit uses TLS. Meta processes messages on Waitizzy’s instructions as a service provider under Meta’s WhatsApp Cloud API / Business terms. Meta may retain message data for a limited period to deliver and retry messages (Meta currently describes a typical Cloud API retention window of up to 30 days). Waitizzy’s own copies follow Section 9.

How long we retain it. We keep WhatsApp send logs and related CRM records for the life of the merchant’s subscription and a reasonable period after termination to allow export, then delete or anonymise them, subject to backup rotation and records we must keep for tax, billing disputes, security, or law (see Section 9). Merchants are responsible for the lawful basis and opt-in required to message their own customers.

Who we share it with. Recipient numbers, message content, and status events are shared with Meta so the WhatsApp Cloud API can deliver the message. Usage counts and invoice amounts (not full message bodies) are shared with Razorpay when we collect subscription or WhatsApp overage payments. We do not share WhatsApp customer data with other merchants. Other sub-processors (hosting, database) may store encrypted or access-controlled copies as needed to run the Services (see Section 6).

Deletion and privacy rights. Merchants may request deletion of WhatsApp-related personal data we hold by emailing hello@waitizzy.com with the subject line “WhatsApp data deletion” (or “Data Principal Request”). Describe the workspace and the data to delete. We will verify the requester and delete Waitizzy copies unless we must retain a record by law. If you are an end customer of a Waitizzy merchant (for example you received a booking message), contact that business first — they are the Data Fiduciary for your contact details. We will assist the merchant with deletion to the extent required by law. You may also use the rights in Sections 11 and 12.

6. How We Share Your Information

We do not sell personal data. We may share personal data with:

• Sub-processors and service providers who help us operate the Services, including cloud hosting, database, email (transactional), Meta WhatsApp Cloud API (message delivery and status under Waitizzy’s integration), analytics, error monitoring, payment gateways (Razorpay), and customer support tooling. Such providers are bound by contractual obligations to protect personal data and process it only for the purposes for which it is shared with them.
• Other Users within your Workspace: data you or your colleagues input may be visible to other authorised users of the same Workspace, depending on their roles and permissions configured by you.
• Professional advisors: auditors, lawyers, accountants, insurers, and similar advisors, where reasonably necessary and under confidentiality obligations.
• Legal & regulatory authorities: when required by law, court order, subpoena, or similar legal process, or to protect our rights, property, or safety, or those of our users or the public.
• Business transfers: in connection with a merger, acquisition, reorganisation, financing, sale of all or part of our business, or bankruptcy. In such cases, we will use reasonable efforts to ensure that the recipient agrees to honour this Policy or to notify you of any changes.

7. International Data Transfers

We primarily host and process personal data within India. Some of our sub-processors may host or process data outside India. Where this happens, we will only transfer personal data to jurisdictions not restricted by the Central Government under section 16 of the DPDP Act, and we will use appropriate contractual safeguards to protect your data. By using the Services, you acknowledge such transfers may occur as needed to deliver the Services to you.

8. Cookies & Similar Technologies

We use the following types of cookies and similar technologies:

• Strictly necessary: required to operate the Services, authenticate you, maintain sessions, and protect security. These cannot be disabled in our systems.
• Functional: remember your preferences (such as language or display options).
• Analytics & performance: help us understand aggregated usage patterns so we can improve the Services.

You may control or delete cookies through your browser settings. Disabling certain cookies may affect the functionality of the Services.

9. Data Retention

We retain personal data for as long as is necessary to fulfil the purposes for which it was collected, to provide the Services to you, to comply with our legal, accounting, or reporting obligations, to resolve disputes, and to enforce our agreements. Specifically:

• Active accounts: we retain your data for the duration of your Subscription.
• After termination or expiry: we may retain your data for a reasonable transition period to allow data export, after which Customer Data is deleted or anonymised, subject to backup-rotation cycles and applicable retention laws.
• Billing & tax records: retained for the period required under applicable tax and corporate laws (typically up to 8 years).
• WhatsApp send logs: retained for the life of the Subscription and the post-termination export window described above, then deleted or anonymised, except records required for billing, tax, security, or law.
• Security & audit logs: retained for the period necessary to investigate incidents and to meet our legal obligations.

10. Data Security

We implement reasonable security practices and procedures designed to protect personal data, including in line with Rule 8 of the SPDI Rules and applicable DPDP Act requirements. These measures include encryption of data in transit (TLS), encrypted password storage, access controls, role-based permissions, multi-tenant isolation, audit logging, monitoring, regular software updates, secure development practices, and use of reputable cloud hosting providers.

Despite our efforts, no method of transmission over the internet or method of electronic storage is completely secure. You are responsible for keeping your credentials and access tokens confidential. In the event of a personal data breach affecting you, we will notify you and the Data Protection Board of India, as applicable, in accordance with the DPDP Act and the CERT-In Directions.

11. Your Rights as a Data Principal

Subject to applicable law, including the DPDP Act, you have the following rights:

• Right to information: to obtain a summary of the personal data we process about you and the purposes of such processing.
• Right to correction and erasure: to request correction of inaccurate or incomplete personal data, and the erasure of personal data that is no longer necessary for the purposes for which it was collected, subject to legal retention requirements.
• Right to grievance redressal: to raise a grievance with our Grievance Officer (see Section 15) regarding any act or omission related to your personal data.
• Right to nominate: to nominate another individual to exercise your rights in case of death or incapacity, as provided under the DPDP Act.
• Right to withdraw consent: where processing is based on your consent, you may withdraw it at any time. Withdrawal will not affect the lawfulness of processing based on consent before its withdrawal. We may continue to process personal data on other lawful grounds where applicable.

If you are an employee, customer, or contact of one of our Customers and your data was uploaded into our Services by them, please contact that Customer directly to exercise your rights. We will support our Customer in responding to your request to the extent required by law.

12. How to Exercise Your Rights

You may exercise your rights by writing to our Grievance Officer at hello@waitizzy.com with the subject line “Data Principal Request”. For WhatsApp-related deletion, you may use the subject line “WhatsApp data deletion” (see Section 5). Please describe your request clearly and provide such information as is reasonably required to verify your identity. We will respond within the timelines prescribed by applicable law. If you are not satisfied with our response, you have the right to lodge a complaint with the Data Protection Board of India.

13. Children’s Privacy

The Services are intended for use by businesses and individuals who are at least eighteen (18) years of age. We do not knowingly collect personal data from children. If you believe that we have collected personal data from a child, please contact us promptly so that we can take appropriate steps to delete it. In accordance with the DPDP Act, we do not engage in tracking, behavioural monitoring, or targeted advertising directed at children, and we do not process children’s personal data in a manner that is likely to cause any detrimental effect on their well-being.

14. Marketing & Automated Decision-Making

Where we send you marketing communications, we do so based on your consent and in compliance with applicable laws, including the Telecom Commercial Communications Customer Preference Regulations. You can opt out at any time by following the unsubscribe instructions in the message or by writing to us.

We do not make decisions with significant legal or similarly material effects about you based solely on automated processing or profiling.

15. Grievance Officer

In accordance with the Information Technology Act, 2000, the SPDI Rules, the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and the DPDP Act, we have designated the following Grievance Officer:

We will acknowledge any complaint within forty-eight (48) hours of receipt and endeavour to resolve it within fifteen (15) days, or such other period as may be prescribed by law.

16. Third-Party Links

The Services may contain links to third-party websites or services. We are not responsible for the privacy practices or content of such third parties. We encourage you to review their privacy policies before providing any personal data.

17. Changes to this Policy

We may update this Policy from time to time. When we make material changes, we will notify you by email or by posting a notice in the Services, and we will update the “Last Updated” date at the top of this Policy. Your continued use of the Services after the effective date constitutes acceptance of the revised Policy.

18. Contact Us

If you have any questions, concerns, or feedback about this Policy or our privacy practices, please contact us at hello@waitizzy.com or write to Waitizzy Technologies (OPC) Private Limited, [Business Address], India.