Privacy Policy

Effective Date: 01 January 2025 Last Updated: 27 May 2026 Spread the Word ("we," "our," or "us") is committed to protecting the privacy and security of all users, businesses, and developers who interact with our platform and services. This Privacy Policy describes how we collect, use, disclose, store, and safeguard your information when you access our website (https://spreadtheword.in), use our services, or connect your business account through our WhatsApp CRM and messaging platform. By accessing or using Spread the Word, you acknowledge and agree to the practices described in this Privacy Policy. 1. About Our Role as a Tech Provider Spread the Word operates as a Technology Provider and Solution Partner on the Meta platform. We offer a WhatsApp Business CRM and messaging management platform that integrates with the WhatsApp Business API (Cloud API and On-Premise API), operated by Meta Platforms, Inc. ("Meta"). As a Tech Provider, we facilitate the Embedded Signup process, through which business clients ("Business Users") can connect their WhatsApp Business Accounts (WABA) to our platform. In this capacity: We act as a data processor on behalf of Business Users for WhatsApp messaging data. We act as a data controller for data collected through our own website and direct service interactions. We are bound by Meta's Platform Terms, WhatsApp Business API Terms of Service, and Meta's Data Processing Terms in addition to this Privacy Policy. 2. Information We Collect a. Personal Information (Direct Users) When you register for an account or interact with our platform, we may collect: Full name Email address Phone number Billing and payment details Business name and registration details b. Business Account Information (Business Users via Embedded Signup) When a Business User connects their WhatsApp Business Account through our Embedded Signup flow, we collect and process: WhatsApp Business Account (WABA) ID and associated phone number(s) Facebook Business Manager ID Business display name and category Business verification status provided by Meta Permissions granted during the Embedded Signup process API access tokens (stored securely and never shared with unauthorized parties) c. WhatsApp Messaging Data As a WhatsApp Business API Tech Provider, we may process the following data on behalf of Business Users: Message content (text, media, templates) sent and received through connected WABA numbers Contact data (customer phone numbers, names) uploaded or synced by Business Users Message metadata (timestamps, delivery status, read receipts) Template messages submitted and approved through our platform Conversation analytics (message volumes, response times, opt-in/opt-out status) Important: We do not use WhatsApp messaging data for our own advertising purposes. Message content is processed solely to deliver the services requested by Business Users, in accordance with Meta's Platform Terms. d. Non-Personal / Technical Information We also collect non-identifiable technical information, including: Browser type and version IP address Device type and operating system Website usage data (pages visited, session duration, click interactions) API call logs and error logs e. Cookies and Tracking Technologies We use cookies, pixels, and similar tracking technologies to: Maintain user sessions and authentication Analyze platform usage and performance Improve the user experience Deliver relevant notifications You may manage cookie preferences through your browser settings. Disabling cookies may impact certain platform features. 3. How We Use Your Information We use collected information for the following purposes: PurposeLegal BasisTo provide, operate, and improve our platform and servicesContract performanceTo process transactions and issue billing communicationsContract performanceTo facilitate WhatsApp Business API onboarding via Embedded SignupContract performanceTo enable messaging features on behalf of Business UsersLegitimate interest / ContractTo send service updates, security alerts, and technical noticesLegitimate interestTo send promotional communications (with consent)ConsentTo comply with legal obligationsLegal obligationTo ensure security, detect fraud, and prevent misuseLegitimate interestTo analyze platform performance and usage patternsLegitimate interest We do not use WhatsApp Business message content or contact data for advertising, profiling, or any purpose beyond delivering the contracted service. 4. How We Share Your Information We do not sell, rent, or trade your personal information. We may share data only in the following circumstances: a. Meta Platforms, Inc. As a WhatsApp Business API Tech Provider, certain business account and technical data is shared with Meta Platforms, Inc. as required to: Authenticate and authorize your WhatsApp Business Account Submit and manage message templates Maintain API connectivity and compliance Process Embedded Signup onboarding Meta's use of this data is governed by Meta's Privacy Policy and WhatsApp's Privacy Policy. b. Service Providers We engage trusted third-party vendors to support our operations, including: Cloud hosting and infrastructure providers Payment processors Email and communication service providers Analytics and monitoring tools All service providers are bound by contractual obligations to handle data only as directed by us and in compliance with applicable privacy laws. c. Legal Compliance We may disclose your information when required to: Comply with applicable laws, regulations, or court orders Respond to valid legal requests from government or regulatory authorities Enforce our Terms of Service or protect our legal rights d. Business Transfers In the event of a merger, acquisition, restructuring, or sale of assets, your data may be transferred to the successor entity. You will be notified of any such change and your rights under this policy will be preserved. e. With Your Consent We may share your information with third parties when you have explicitly consented to such sharing. 5. Meta Platform Data Usage Restrictions In accordance with Meta's Platform Terms and WhatsApp Business API Policies, we confirm the following: We do not use Meta Platform Data (including WhatsApp data) to create or augment user profiles for advertising. We do not sell, license, or transfer Meta Platform Data to data brokers or advertisers. We do not use Meta Platform Data for any purpose inconsistent with the permissions granted by the Business User or required to deliver the requested service. We comply with Meta's Sensitive Data restrictions and do not process prohibited categories of data through the WhatsApp API. Business Users retain ownership of their messaging data and may request deletion at any time. 6. Embedded Signup — Data Handling Our Embedded Signup integration allows Business Users to connect their WhatsApp Business Accounts to our platform directly within our interface. During this process: We collect only the minimum permissions necessary to operate the platform on your behalf. Access tokens obtained during Embedded Signup are stored with AES-256 encryption and are never exposed in client-side code or logs. Business Users may revoke access at any time through Facebook Business Manager or by contacting us. Upon revocation or account termination, we will delete all associated API tokens within 30 days. 7. Data Security We implement industry-standard security measures to protect your data, including: Encryption in transit (TLS 1.2/1.3) for all data transmitted between your browser and our servers Encryption at rest (AES-256) for sensitive stored data Role-based access controls (RBAC) to limit internal data access Regular security audits and vulnerability assessments Firewall protection and intrusion detection systems Despite these measures, no method of transmission over the internet is 100% secure. We encourage users to maintain strong passwords and report any suspected security incidents to us immediately. 8. Data Retention Data TypeRetention PeriodAccount and profile dataDuration of account + 90 days post-terminationWhatsApp messaging dataAs configured by Business User (default: 12 months)API access tokensDeleted within 30 days of revocationBilling records7 years (as required by Indian tax law)Server and access logs90 daysCookies and analytics data13 months After the applicable retention period, data is securely deleted or anonymized. 9. Your Rights Depending on your location and applicable law, you may have the following rights regarding your personal data: Right to Access — Request a copy of the personal data we hold about you Right to Correction — Request correction of inaccurate or incomplete data Right to Deletion ("Right to be Forgotten") — Request deletion of your personal data, subject to legal retention requirements Right to Portability — Request your data in a structured, machine-readable format Right to Restrict Processing — Request that we limit how we use your data Right to Object — Object to processing based on legitimate interest or for direct marketing Right to Withdraw Consent — Withdraw consent at any time for consent-based processing Right to Opt-Out — Unsubscribe from marketing communications at any time Business Users may additionally request deletion of all WhatsApp messaging data processed on their behalf. To exercise any of these rights, please contact us at support@spreadtheword.in. We will respond within 30 days of receiving your request. 10. International Data Transfers Our servers are primarily located in India. If you access our services from outside India, your data may be transferred to and processed in India or other jurisdictions where our service providers operate. We ensure that any international transfers of personal data are conducted in accordance with applicable data protection laws, including appropriate safeguards such as standard contractual clauses where required. 11. Third-Party Links Our website and platform may contain links to third-party websites or services, including Meta's platforms. We are not responsible for the privacy practices of these external sites. We strongly encourage you to review the privacy policies of any third-party services you interact with. 12. Children's Privacy Spread the Word is intended for use by businesses and individuals aged 18 and above. We do not knowingly collect personal information from individuals under the age of 18. If we become aware that a minor has provided us with personal data, we will delete it promptly. If you believe a minor has submitted data to us, please contact support@spreadtheword.in. 13. Changes to This Privacy Policy We may update this Privacy Policy from time to time to reflect changes in our services, legal obligations, or Meta's platform requirements. When we make material changes, we will: Update the "Last Updated" date at the top of this policy Notify you via email or an in-platform notification for significant changes Where required by law, obtain your renewed consent Continued use of our platform after the effective date of any update constitutes acceptance of the revised Privacy Policy. 14. Contact Us If you have questions, concerns, or requests related to this Privacy Policy, please contact us: Spread the Word 📧 Email: support@spreadtheword.in 🌐 Website: https://spreadtheword.in https://spreadtheword.in/terms-and-policies/user_terms https://spreadtheword.in/terms-and-policies/vendor_terms