Privacy Policy for WhatsApp CRM

Last updated: March 7, 2026

WhatsApp CRM is a customer messaging and campaign management platform that allows businesses to send and manage WhatsApp messages using Meta’s WhatsApp Cloud API. WhatsApp CRM (accessible via https://api.maza.lk) ("we", "us", "the Service") respects your privacy and is committed to protecting your personal information. This policy explains what data we collect, how we use it, with whom we share it, and your rights regarding that data. By using our desktop application, web admin panel, or backend APIs, you consent to the practices described herein.

1. Information We Collect

1.1 Account Registration

When you create an account you provide:

• Email address
• License key (for desktop activation)
• Password (hashed using bcrypt)
• Optional profile information (e.g. company name)

1.2 WhatsApp Integration Data

To send messages using your own WhatsApp number you must connect a WhatsApp Business Account via Meta’s Embedded Signup. During that process we store:

• Business name and display phone number
• Phone number ID and WABA ID
• Access token obtained from Meta

We do not access or use WhatsApp message content beyond what is necessary to provide messaging functionality and message history to the account owner.

These credentials permit us to act on your behalf when sending WhatsApp messages. They are encrypted at rest and never exposed to other users or third parties.

1.3 Contacts & Messages

The Service stores the contacts you enter and any messages you send or receive:

• Contact entries: names, phone numbers, emails
• Message logs: recipient, content, status, timestamps, and sender account
• Delivery/read statuses received via webhooks

This information facilitates message delivery, history display, and campaign analytics.

All contacts and messages stored in the system belong solely to the account owner.

1.4 Payments & Licenses

Payment metadata from the GenieBiz gateway is recorded:

• Email address
• Transaction amount and ID
• Payment status

A corresponding license key and device binding may be generated and stored alongside this record.

1.5 Usage & Diagnostics

We automatically log server requests, errors, and webhook payloads to diagnose problems and improve performance. These logs may include IP addresses and request paths.

1.6 Cookies & Local Storage

The desktop client does not use cookies. It stores JWT tokens and settings securely in local storage. The web admin panel may use cookies for session maintenance and CSRF protection.

2. How We Use Your Information

• Authenticate users and issue JWTs
• Send WhatsApp messages via Meta’s Cloud API
• Manage accounts, licenses, and payments
• Provide dashboard and admin functionality
• Log message delivery/read events and inbound messages
• Enforce rate limits and prevent abuse
• Perform analytics and service improvement

3. Data Sharing & Disclosure

We do not sell or rent your personal information. We may share data with:

• Meta (WhatsApp Cloud API) to deliver messages; governed by Meta’s own privacy policy
• Payment processor (GenieBiz) to validate transactions
• SMTP provider solely for sending notification emails
• Law enforcement, if required by court order or applicable law

Any third party receiving data is contractually obligated to use it only for the purpose of providing services to us.

4. Data Retention & Deletion

We retain personal data only as long as necessary to provide the Service, comply with legal obligations, or resolve disputes. You may request deletion of your account and all associated data by contacting us at the address below; we will act on such requests within 30 days.

5. Security Measures

• Encryption of sensitive fields (access tokens, passwords)
• HTTPS for all network communications
• Secure HTTP headers via helmet
• Environment variable management for secrets
• Periodic backups and restricted access controls

6. Your Rights

Depending on your jurisdiction, you may have rights to:

• Access the personal data we hold about you
• Request correction or deletion of your data
• Withdraw consent for processing
• Lodge a complaint with a data protection authority

To exercise these rights, contact us using the details below.

7. Children’s Privacy

Our services are not intended for individuals under 13. We do not knowingly collect data from children. If we learn that personal information has been collected from a child, we will delete it promptly.

8. Changes to This Policy

We may update this policy to reflect changes in our practices or legal requirements. The "Last updated" date at the top will indicate when revisions were made; we encourage you to review the policy periodically.

9. Contact Information

Questions, requests, or concerns about this privacy policy should be directed to:

Email: info@api.maza.lk

Address:
WhatsApp CRM Team
Maza Lk Technologies
Colombo, 01400
Sri Lanka