01 Introduction & Scope
Welcome to MakeMyPanCard / SahiKhata WhatsApp Gateway (https://api.sahikhata.in), an enterprise WhatsApp Cloud API SaaS communication platform operated in India. We are committed to protecting your privacy and upholding the highest standards of data governance under the Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000 (and 2021 Rules), and official Meta WhatsApp Business Solution Terms.
This Privacy Policy details how we collect, process, store, encrypt, and handle personal data and messaging telemetry when you create an account, connect Meta WhatsApp Business Accounts (WABA), send transactional dispatches, manage shared team inboxes, and consume our REST APIs.
02 Information We Collect
We only collect data strictly necessary to deliver high-reliability WhatsApp automation and API connectivity:
Your name, email address, password hash (bcrypt salted), organization name, business registered phone number, and billing details.
WhatsApp Business Account ID (WABA), Phone Number ID, App ID, and Permanent Access Tokens encrypted using AES-256-GCM.
Recipient phone numbers (E.164 standard), template message parameters, delivery status codes (sent, delivered, read, failed), and webhook callback payloads.
IP addresses, request headers, API endpoints called, rate limit metrics, and session security cookies.
03 How We Use and Process Your Data
Your information is processed solely for lawful business operations:
- API Dispatch & Delivery: Forwarding programmatic REST API requests directly to Meta Platforms Graph API (
graph.facebook.com/v22.0/) for instant delivery. - Real-Time Delivery Auditing: Receiving Meta webhook updates to notify your application when a dispatch is sent, delivered, or read.
- Account Authentication & RBAC: Ensuring secure multi-tenant access control and session management.
- Spam Prevention & Meta Compliance: Detecting irregular mass spam spikes to protect your WhatsApp Business number from Meta restrictions or bans.
- Statutory Invoicing: Generating GST-compliant tax invoices for your subscription plan.
04 Strict No-Reselling Guarantee & Third-Party Disclosure
Your customer phone numbers, customer conversations, and business contact lists remain 100% your proprietary confidential property. We do not use your customer data for ad retargeting, promotional profiling, or machine learning training.
Data is only transmitted to authorized third parties under strict operational agreements:
- Meta Platforms Inc. / Meta Platforms Ireland Ltd.: For executing official WhatsApp Cloud API calls.
- Secure Indian Cloud Infrastructure: High-security ISO 27001 certified data center servers.
- Law Enforcement Agencies: Only when strictly mandated by a valid judicial court order under Indian law.
05 Data Storage, Encryption & Retention
All data in transit is protected using TLS 1.3 encryption. Sensitive credentials such as Meta System User Access Tokens, client secrets, and passwords are encrypted using AES-256-GCM cipher standards with salt rotation.
Retention Policy: Message transmission metadata and webhook logs are retained for 90 days for operational audit and reconciliation purposes, after which logs are purged automatically. You may also request on-demand immediate data purging from your account settings.
06 Your Rights under the DPDP Act 2023
As a Data Principal under the Digital Personal Data Protection Act, 2023, you hold the following rights:
07 Statutory Grievance Redressal Officer
In accordance with the Information Technology Act, 2000 and DPDP Act, 2023, the details of our designated Grievance Officer are published below: