WhaBuzz
Start trial

Legal

Privacy Policy

Last updated: 22 October 2026

1. Introduction

This policy explains what personal data WhaBuzz collects, why, where it is stored, how long it is kept and how you can ask us to delete it.

Some terms used below:

  1. Surya Narayana Enterprises LLP ("WhaBuzz", "we", "our", or "us") runs the WhaBuzz service. Registered address: F.No.5301, Tower 5, Prestige High Field, Gachibowli, Hyderabad 500032, Telangana, India.
  2. Customer is a business that has an account with WhaBuzz.
  3. End User is a person who sends WhatsApp messages to, or receives them from, a Customer's number through WhaBuzz.
  4. Personal Data is any information about an identified or identifiable person.

2. What WhaBuzz is

WhaBuzz is a gateway to the WhatsApp Cloud API. WhaBuzz is a Meta Tech Provider. Customers connect their own WhatsApp Business numbers through Meta's Embedded Signup. They then send and receive messages through the WhaBuzz API, manage message templates, and receive delivery and inbound-message events on their own webhooks (the "Service").

For End User data, the Customer is the controller and WhaBuzz is the processor. Our Data Processing Agreement covers that relationship. For Customer account data, WhaBuzz is the controller.

3. What we collect and why

Customer account data

When you sign up we collect your name, email address, business name and, if you give it, your phone number. If you sign in with Google, we receive your name, email address and Google account identifier from Google. We use this data to run your account, verify your email and phone number, send you service and billing email, and answer support requests.

Connected WhatsApp numbers

When you connect a number through Meta's Embedded Signup, Meta gives us your WhatsApp Business Account ID, phone number ID, display phone number and a business access token. We use these only to send and receive messages for you. The access token is stored encrypted.

Messages and events

When you send or receive a message through WhaBuzz, we process the message content, the End User's phone number and WhatsApp ID (wa_id), their WhatsApp profile name if Meta provides it, and delivery status and timestamps. We store this as events so we can deliver them to your webhook, retry failed deliveries and let you replay them. We do not read message content except when you ask us to for support, or when the law requires it.

Media files (images, video, audio, documents) are streamed through WhaBuzz between you and Meta. We do not store media bytes.

Billing

WhaBuzz charges a monthly fee per connected number, deducted a day at a time from a prepaid wallet. You top up the wallet through the SNE Pay Hub (pay.sne-llp.com), which uses our payment processor, Cashfree Payments. Your card, bank account and UPI details are entered with Cashfree and governed by its privacy policy. We receive and keep tax invoice records, payment status and the payment method type, not your full card or bank details.

Service and security logs

Our servers record request metadata such as time, endpoint and response code. We use these logs to run the Service, find errors and investigate abuse. Message content and access tokens are removed from logs before they are sent to our logging and error-tracking providers.

WhaBuzz is a business service. It is meant for people aged 18 or over acting for a business. We do not knowingly collect data from children through our own sign-up.

4. Who we share data with

We share Personal Data only with the providers that run parts of the Service, and only as far as each one needs:

  • Meta Platforms, Inc. (WhatsApp Business Platform): delivers and receives the messages. Meta also bills its own WhatsApp charges to your Meta account.
  • Cloudflare, Inc. (Workers, D1, Durable Objects, R2, KV, Queues): hosts the Service and stores its data.
  • Google LLC: Google sign-in for the console.
  • Resend: sends our transactional email, such as verification and billing notices.
  • Axiom and Sentry: store our scrubbed service logs and error reports.
  • Cashfree Payments: collects wallet top-up payments.

We may also disclose data when the law requires it, to protect the rights or safety of WhaBuzz, our Customers or others, or as part of a merger or sale of the business, with notice to you.

WhaBuzz does not sell Personal Data. We do not use message content for advertising or to train models.

5. Your rights

Subject to applicable law, including India's Digital Personal Data Protection Act, 2023, you can ask us to:

  • give you access to the Personal Data we hold about you;
  • correct data that is wrong or incomplete;
  • delete your data;
  • stop using your data for a purpose you object to; and
  • withdraw any consent you have given.

Customers can export events through the API at any time. To exercise these rights, email support@whabuzz.com. If you are an End User who messaged a business that uses WhaBuzz, please contact that business first. It controls your data. See our data deletion page.

6. How we protect data

  • All traffic to and from WhaBuzz uses HTTPS (TLS).
  • Business access tokens and other secrets are stored encrypted.
  • Each Customer's message data is kept in its own isolated store, reachable only from that Customer's authenticated requests.
  • API keys are stored as hashes, not in plain text.
  • New accounts need a verified email and manual approval before they can connect a number.
  • Staff access to Customer data is limited to what is needed to run and support the Service.

7. Cookies and browser storage

The WhaBuzz marketing site does not set tracking or advertising cookies. The console at app.whabuzz.com keeps your sign-in token and selected workspace in your browser's local storage. These are removed when you sign out. Google and Meta may set their own cookies during their sign-in screens, under their own policies.

8. How long we keep data

  • Message and event bodies, including the raw payload from Meta: kept for your account's retention setting, then removed. The setting is 30, 90, 180 or 365 days. The default is 90 days.
  • Event metadata (event ID, type, timestamps, WhatsApp message ID, wa_id and your number): kept for the life of your account, so that delivery history and duplicate checks keep working. It is deleted when your account is deleted.
  • Webhook delivery records and attempts: 13 months.
  • Media files: never stored.
  • Business access tokens: kept, encrypted, until you disconnect the number.
  • Account and billing records: kept while your account is open. Invoices and payment records are kept for as long as Indian tax and accounting law requires.

Deletion requests are completed within 30 days, except for data the law requires us to keep.

9. Where data is stored

WhaBuzz runs on Cloudflare Workers in Cloudflare's Asia-Pacific region; your data is stored in Cloudflare's Asia-Pacific region (D1 and Durable Objects). Cloudflare's network may handle a request at the data centre nearest the caller. Meta processes WhatsApp messages on its own infrastructure under its own terms. Our email, logging and error-tracking providers may process limited data outside India.

10. Changes to this policy

We will post any change on this page and update the date above. If a change materially affects how we use your data, we will email account owners before it takes effect.

11. Contact us

Questions about this policy, or requests about your data:

Surya Narayana Enterprises LLP
F.No.5301, Tower 5, Prestige High Field, Gachibowli, Hyderabad 500032, Telangana, India

Email: support@whabuzz.com
Website: https://whabuzz.com | Console: https://app.whabuzz.com