Privacy Policy

1. Who we are

SmartChat is a business messaging platform operated by BIT XPLORER INFOSYSTEMS LLP, a limited liability partnership registered in India under LLPIN ACG-9492, with its office at D-67, Sector-2, Noida, Uttar Pradesh 201301, India ("SmartChat", "we", "us", "our").

SmartChat lets businesses ("Customers") send and receive messages with their own customers and contacts ("End Users") over the WhatsApp Business Platform, using a shared inbox, approved message templates and simple automation.

We are a small team. This policy is deliberately short and describes what the product actually does — nothing more.

For any privacy question, email info@bit-xplorer.com.

2. Our role

Data protection law distinguishes the party that decides why and how personal data is used (the "controller") from the party that processes it on that party's instructions (the "processor"). We act in both roles depending on the data.

3. What we collect

3.1 Account data

• Your business name and the name, work email address and phone number of the people you invite as users.
• A hashed password and session information so you can sign in.

3.2 WhatsApp connection data

You connect your WhatsApp Business Account entirely through Meta Embedded Signup. You complete that flow with Meta directly, in a Meta-hosted window. We receive only the identifiers and access token Meta returns so that the app can send and receive messages on your behalf:

• Your WhatsApp Business Account ID and phone number ID.
• Your registered display name and phone number.
• An access token, plus status information Meta reports such as quality rating and messaging limits.

3.3 Messaging data

• The End User's WhatsApp phone number and WhatsApp profile name.
• The content of messages sent and received, including any media the End User chooses to send.
• Message metadata: timestamps, direction, delivery and read status, and which of your users handled the conversation.
• Contact records, tags and notes that you add or import.
• Opt-in and opt-out records.

3.4 Technical logs

Application and server logs recording IP addresses, requests, errors and sign-in events. These are used to operate and troubleshoot the service.

4. What we do not collect

To be explicit about the things a messaging platform is often assumed to hold:

• We do not collect or store any identity or business documents. No registration certificates, no GST or PAN documents, no KYC files, no ID scans. Business verification happens between you and Meta during Embedded Signup — those documents go to Meta, never to us.
• We do not collect payment card or bank details. The app has no payment feature: it does not process payments, take card details, or handle in-chat checkout.
• We do not sell personal data, share it for advertising, or share it for cross-context behavioural advertising.
• We do not use your messages to train AI models, ours or anyone else's.
• We do not build profiles of End Users beyond the contact record you create in your own workspace.

5. Why we use it

We use personal data only for these purposes:

Where we act as processor, we process End User data only to deliver the service to the Customer, and never for our own purposes.

6. WhatsApp Business Platform and Meta

SmartChat delivers messages through the WhatsApp Business Platform (Cloud API) operated by Meta Platforms, Inc. and its affiliates ("Meta"). We do not use unofficial or reverse-engineered access to the consumer WhatsApp app.

• Onboarding is entirely through Meta Embedded Signup. You create or connect your WhatsApp Business Account inside a Meta-hosted flow, under your own Meta Business Manager. Any verification documents Meta asks for go to Meta, not to us.
• Your WhatsApp Business Account belongs to you. You can revoke SmartChat's access at any time from your Meta Business Manager, which immediately stops us sending or receiving messages on that number.
• Meta processes the messages we send and receive on your behalf — phone numbers, message content and metadata — in order to deliver them. Meta's own terms and privacy practices apply to that processing.
• Business messages are not end-to-end encrypted in the way personal chats are. Because a business platform has to display messages in your inbox, they are readable by your authorised users and are stored on our server.
• Meta's policies apply to every message you send, including the WhatsApp Business Messaging Policy and the WhatsApp Business Commerce Policy. Breaches can lead to template rejection, a lower quality rating, messaging limits, or Meta terminating your number.

7. Opt-in, opt-out and consent

WhatsApp requires a business to obtain an End User's opt-in before sending business-initiated messages, and the opt-in must make clear which business is messaging them and that messages will arrive on WhatsApp.

7.1 Your obligations as a Customer

• Obtain and record a valid opt-in before messaging any End User.
• Keep evidence of when, where and how each opt-in was given, and provide it to us or Meta on request.
• Honour opt-out requests — including "STOP" and equivalent wording — promptly and across all future messaging.
• Never use purchased, rented or scraped phone number lists.
• Give your own End Users a privacy notice describing how you use their data.

7.2 What SmartChat does

• Records the opt-in source and timestamp against each contact.
• Detects common opt-out keywords and marks the contact as opted out.
• Blocks further campaign messages to contacts marked as opted out.
• Gives you tools to export and delete contacts so you can act on End User requests.

8. Who we share data with

We share personal data with very few parties:

That is the complete list. There is no advertising network, no data broker, no analytics company receiving your message data, and no payment processor — the app has no payment feature. If we ever add a new provider that handles personal data, we will update this policy before doing so.

If the business is ever sold or reorganised, data may transfer to the buyer, subject to this policy continuing to apply.

9. Retention and deletion

Deletion on request. You can delete contacts and conversations in the app at any time. To delete your whole workspace, email info@bit-xplorer.com and we will delete it within 30 days, except where we are legally required to keep something. An End User who wants their data deleted should contact the business they were messaging; if they contact us, we will pass the request on.

10. Security

The measures we actually have in place:

• All traffic to the application is encrypted in transit using HTTPS/TLS.
• Passwords are stored hashed, never in plain text. WhatsApp access tokens are stored with restricted access.
• The server sits behind a firewall, with remote administrative access restricted.
• Operating system and application updates are applied regularly.
• Only a small number of named people can access the production server, and only when needed to run or support the service.
• Regular backups are taken.

If something goes wrong. If a breach affects your data, we will tell you without undue delay and explain what happened, what was affected and what we are doing about it.

You are responsible for keeping your own login credentials safe and for managing who in your team has access. Report a suspected security problem to info@bit-xplorer.com.

11. Your rights

11.1 Under Indian law

We are established in India and follow the Digital Personal Data Protection Act, 2023 (DPDP Act) as it comes into force. Where it applies, you may:

• Ask what personal data we hold about you and how we process it.
• Ask us to correct, complete or update it.
• Ask us to erase it, where we are not required to keep it.
• Nominate another person to exercise your rights if you die or become incapacitated.
• Raise a grievance with us, and complain to the Data Protection Board of India if we do not resolve it.

11.2 If you are elsewhere

We do not have an establishment in the European Union or the United Kingdom and do not direct our services there, so the GDPR and UK GDPR are not the basis on which we operate. If you are in another country and local law gives you rights over your personal data, contact us and we will honour equivalent requests — access, correction and deletion — wherever we reasonably can.

11.3 How to exercise your rights

Email info@bit-xplorer.com with enough detail for us to identify you and understand the request. We will respond within 30 days. We may need to verify your identity first. There is no charge.

If your request concerns messages you received from a business using SmartChat, that business is the controller and we will pass your request to them.

12. Cookies

This website is a plain marketing site. The application uses only the cookies needed to keep you signed in and to keep your session secure. We do not use advertising cookies or third-party tracking, and we do not run behavioural advertising.

You can block or delete cookies in your browser, but you will not be able to stay signed in to the application if you block the essential ones.

13. Children's data

SmartChat is a business tool for adults and is not directed at children. WhatsApp itself sets a minimum age for its users. We do not knowingly collect personal data from children. If you believe a child's data has reached us, email info@bit-xplorer.com and we will delete it.

14. Changes to this policy

We may update this policy as the service changes or the law requires. The updated version will be posted here with a new "last updated" date. If a change is significant, we will email account holders before it takes effect.

15. How to contact us

See also our Terms & Conditions. Printed on .