Privacy Policy
At HAVODDS Pvt. Ltd., we are committed to protecting your privacy and handling your data responsibly. This policy explains what data we collect, how we use it, and your rights.
1. Overview
HAVODDS ("HAVODDS Pvt. Ltd.", "we", "our", "us") operates the HAVODDS platform (the "Service") — a WhatsApp Business CRM and communication platform available at https://app.havodds.com.
This Privacy Policy applies to all users of the HAVODDS platform including businesses (Clients), their team members (Advisors), and individuals whose contact data is managed within the platform (End Contacts). By accessing or using our Service, you agree to the terms of this Privacy Policy.
With respect to personal data of End Contacts that our Clients upload, send messages to, or receive messages from through the Service, HAVODDS acts as a data processor on behalf of the Client, who is the data controller. We process such data only to provide the Service as instructed by the Client and in accordance with our agreements with the Client and these terms.
Our Service uses the Meta WhatsApp Business API to send and receive WhatsApp messages. As a Meta Technology Partner, we comply with the Meta Platform Terms, WhatsApp Business Policy, and applicable data protection laws including GDPR.
2. Data We Collect
2a. Account & Business Data
Business name, email address, and billing information when you register
Team member (Advisor) names, email addresses, phone numbers, and roles
WhatsApp Business Account (WABA) ID and associated phone number(s)
Authentication credentials (passwords stored as bcrypt hashes — never in plain text)
2b. Contact & Lead Data
Phone numbers, names, email addresses of contacts imported or added by your business
CRM data: lead stage, source, assigned advisor, tags, and notes
Conversation history including WhatsApp messages sent and received through the platform
Opt-in and opt-out status for WhatsApp communications
CTWA (Click-to-WhatsApp) ad attribution data: UTM parameters, ad ID, campaign source
2c. Usage & Technical Data
Log data: IP addresses, browser type, pages visited, timestamps
Device information used to access the platform
API usage metrics, message delivery status, read receipts, and reply events
Call recordings and transcripts (when Twilio call center feature is enabled)
Session tokens and authentication cookies
3. WhatsApp Business API & Meta Platform Data
HAVODDS is built on the Meta WhatsApp Business API. When you connect your WhatsApp Business Account to HAVODDS, the following applies:
Message content (text, media, templates) is transmitted through Meta's infrastructure.HAVODDS stores message logs in our encrypted database for your business records and CRM functionality.
WhatsApp template messages must be approved by Meta. Template content is shared with Meta/WhatsApp as part of the approval process.
Message delivery events (sent, delivered, read) and webhook payloads are received from Meta and stored to provide analytics and conversation history.
Click-to-WhatsApp (CTWA) referral data — including ctwa_clid, UTM parameters, and ad source — is captured from Meta's webhook payload when a user clicks an ad to open WhatsApp. This data is stored on the Lead record for attribution purposes.
We do not use Meta Platform Data to target advertising, build profiles for advertising purposes, or share it with third-party data brokers.
End users (contacts) must have actively opted in to receive WhatsApp messages from your business. HAVODDS provides opt-out management to honor unsubscribe requests.
For more information on how Meta handles data related to WhatsApp Business accounts, please review the WhatsApp Privacy Policy.
4. How We Use Your Data
We use collected data for the following purposes:
Service Delivery: Sending and receiving WhatsApp messages, managing conversations, leads, campaigns, and contacts on your behalf.
CRM & Analytics: Providing pipeline management, reporting, advisor performance dashboards, campaign analytics, and CSAT metrics.
Ad Attribution: Linking CTWA clicks from Meta ads to leads so your business can measure ROI on WhatsApp advertising campaigns.
Platform Security: Detecting fraud, abuse, and unauthorized access; enforcing rate limits; maintaining audit logs.
Authentication: Verifying identity via JWT access tokens and secure refresh tokens stored as HttpOnly cookies.
Communications: Sending service notifications, billing updates, and (with your consent) product updates.
Legal Compliance: Fulfilling legal obligations and responding to lawful requests from authorities.
We do not sell your data or your contacts' data to any third party. We do not use data obtained through the WhatsApp Business API to serve advertisements.
5. Sharing & Disclosure
We do not sell, rent, or trade personal data. We may share data only in these limited circumstances:
Meta / WhatsApp: Message content, templates, and account metadata are necessarily processed by Meta's infrastructure as part of the WhatsApp Business API. This is required to deliver the Service.
Twilio Inc.: If you use our cloud call center feature, call audio, phone numbers, and call metadata are processed by Twilio. Twilio's privacy policy applies: twilio.com/en-us/legal/privacy.
Cloud Infrastructure: Our platform runs on AWS. Data is stored in encrypted AWS databases within the applicable region. AWS's privacy practices apply.
Legal Obligations: We may disclose data if required by law, court order, or government authority, or to protect our rights and safety.
Business Transfer: In the event of a merger or acquisition, data may be transferred. We will notify you before your data becomes subject to a different privacy policy.
Sub-processors that access personal data in the course of service delivery are bound by data processing agreements ensuring GDPR-equivalent protections.
6. Data Retention
We retain data for as long as your account is active or as needed to provide the Service. Specific retention periods:
Message & Conversation History: Retained for the duration of your subscription plus 90 days following account closure, unless you request earlier deletion.
Contact & Lead Data: Retained while your account is active. You can delete individual contacts or request bulk deletion at any time.
Campaign & Analytics Data: Retained for 2 years for reporting purposes, then anonymized or deleted.
Call Recordings: Retained for 90 days by default; configurable per your business settings.
Access Logs & Audit Trails: Retained for 12 months for security purposes.
Account Data: Retained for 30 days following account deletion to allow recovery, then permanently purged.
You may request deletion of your data at any time by contacting privacy@havodds.com. We will process deletion requests within 30 days, subject to legal retention obligations.
7. Security Measures
We implement industry-standard technical and organizational measures to protect your data:
All data in transit is encrypted using TLS 1.2+
Databases encrypted at rest using AES-256
Passwords hashed with bcrypt (never stored in plain text)
Short-lived JWT access tokens (15-minute expiry) with secure HttpOnly refresh token cookies
Role-based access control (RBAC) — team members access only data their role permits
API rate limiting to protect against brute force and denial-of-service attacks
Webhook signature verification for all Meta and Twilio webhooks
Regular security reviews and dependency audits
No system is 100% secure. If you discover a security vulnerability, please report it responsibly to privacy@havodds.com.
8. Your Rights
Depending on your jurisdiction, you may have the following rights regarding your personal data:
Right to Access: Request a copy of the personal data we hold about you.
Right to Rectification: Request correction of inaccurate or incomplete data.
Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data, subject to legal retention requirements.
Right to Restrict Processing: Request that we limit how we process your data in certain circumstances.
Right to Data Portability: Receive your data in a structured, machine-readable format (JSON or CSV export available on request).
Right to Object: Object to processing based on legitimate interests or for direct marketing purposes.
Right to Withdraw Consent: Where processing is based on consent, withdraw it at any time without affecting prior processing.
For End Contacts (individuals whose data is managed by our business clients): Your WhatsApp opt-out is honored immediately — reply STOP to any message to opt out. To exercise other rights, contact the business that holds your data (our client), or contact us at privacy@havodds.com and we will forward your request to the appropriate data controller.
To exercise any of these rights, email privacy@havodds.com with subject line "Privacy Request". We will respond within 30 days.
9. Cookies & Tracking
The HAVODDS platform uses the following cookies and storage mechanisms:
refreshToken (HttpOnly Cookie): Secure cookie used to maintain your session and issue new access tokens. Expires in 7 days. Cannot be accessed by JavaScript (XSS protection).
sessionStorage (jwt_access_token): Short-lived access token stored in browser session storage. Automatically cleared when the browser tab is closed.
Analytics: We may use privacy-respecting analytics to understand platform usage patterns. No cross-site tracking or advertising cookies are used on the platform.
You can disable cookies in your browser settings, but this will prevent authentication and access to the platform. The STOP opt-out mechanism for WhatsApp does not rely on cookies.
10. Children's Privacy
The HAVODDS Service is intended for businesses and is not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected data from a minor, please contact us at privacy@havodds.com and we will delete it promptly.
11. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will:
Update the "Last Updated" date at the top of this page
Send an email notification to registered account holders
Display a notice within the HAVODDS platform
Continued use of the Service after changes become effective constitutes acceptance of the revised Privacy Policy. If you disagree with the changes, you may close your account by contacting us.
12. Contact Us
For privacy-related questions, requests, or complaints, please contact our Privacy Officer:
If you are located in the European Union, you have the right to lodge a complaint with your local data protection authority (DPA) if you believe we are processing your data in violation of applicable law.