Privacy Policy

TickWA is operated by CRASC Technologies Private Limited, with its registered office at Plot No. 29, Flat No. 401, 4th Floor, Cyberview Residency, Gafoor Nagar, Hyderabad, Telangana 500081, India ("we", "us"). This policy applies to https://tickwa.com, the TickWA web application and our APIs (the "Services").

This policy is published under the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the rules made under it, as they come into force.

• For our own customers and website visitors, we are the Data Fiduciary. We decide why and how we process the account, billing and usage data described below.
• For the contacts our customers message, we are a Data Processor. A business that uses TickWA uploads its own contacts and conversations ("Customer Data"). That business is the Data Fiduciary for this data. We process it only on the business's instructions.

If you received a WhatsApp message from a business that uses TickWA and want to access, correct or delete your data, or stop receiving messages, please contact that business directly. You can also reply STOP to the message. If you write to us, we will pass your request on to the business concerned.

Data you give us

• Account data: name, work email address, company name, password (stored only as a salted hash), role, and two-factor authentication settings.
• Business and billing data: billing address, GSTIN, invoices, plan and wallet transactions, and payment references. Card, net-banking and UPI credentials are collected by the payment gateway and are not stored by us.
• WhatsApp Business details: WhatsApp Business Account ID, phone number ID, display name, business verification status, and access tokens issued by Meta, which we store in encrypted form.
• Support communications: the content of emails, chats and calls with our team.

Data collected automatically

• Log and device data: IP address, browser type, device information, pages and features used, and timestamps.
• Audit records: a tamper-evident log of security-relevant actions in your workspace, such as sign-ins and configuration changes.
• Cookies: a strictly necessary session cookie and a display preference. See our Cookie Policy.

Customer Data we process for businesses

• Contact details of End Users such as name, mobile number, email, tags and custom fields.
• Message content and media exchanged over WhatsApp, delivery and read status, and consent or opt-out status.
• Form submissions, orders, link clicks from campaigns, and attribution to advertisements.

We do not knowingly ask for sensitive personal data such as health, biometric or financial account information, and customers must not upload it unless it is necessary and lawful for them to do so.

• To provide the Services: create and manage accounts, authenticate users, send and receive messages, run campaigns and automations, and provide support. We do this to perform our contract with you and on the basis of the consent you give when you register.
• To bill you: process payments, maintain the wallet, issue tax invoices and keep accounts. This is needed for the contract and to meet tax and company law obligations.
• To keep the Services secure: detect and prevent fraud, abuse and security incidents, and keep audit logs.
• To communicate with you: send service notices, security alerts, invoices and policy updates. With your consent we may send product news, and you can opt out at any time.
• To improve the Services: analyse usage in aggregated or de-identified form.
• To comply with law: respond to lawful requests from courts and government authorities, and enforce our terms.

We process personal data only for lawful purposes, with consent or for the legitimate uses permitted by the DPDP Act. We do not sell personal data, and we do not use Customer Data for our own marketing.

When a customer uses AI features, such as template drafting, reply suggestions, conversation summaries or knowledge-base answers, the relevant text is sent to the AI provider configured for the platform to generate a response. We do not use Customer Data to train our own AI models.

We share personal data only as needed to run the Services, with the following categories of recipients:

• Meta Platforms and upstream messaging providers, to deliver WhatsApp messages and manage WhatsApp Business accounts and templates.
• Amazon Web Services, which hosts our application and databases in its Mumbai, India region.
• Cloudflare, which provides network security and content delivery for our website and API.
• Payment gateways such as Razorpay or PayU, to process payments and refunds.
• AI providers such as Anthropic or OpenAI, only when AI features are used.
• Professional advisers and auditors, under confidentiality obligations.
• Government, regulatory and law-enforcement authorities, when we are legally required to disclose information.
• A successor entity, if our business is merged, acquired or reorganised, subject to this policy.

Service providers that process personal data for us are bound by contract to use it only for our instructions and to protect it.

Our primary application servers, databases and backups are located in India. Some of the providers listed above process data on servers outside India. We make such transfers only as permitted by Indian law, and not to any country or territory to which the Central Government has restricted transfers under the DPDP Act.

• Account data is kept while your account is active and for as long as needed afterwards to resolve disputes and meet legal obligations.
• Customer Data is kept while the customer's account is active. After an account is closed, we delete or anonymise Customer Data within 90 days, except backups, which expire on their normal schedule.
• Invoices and financial records are kept for at least 8 years, as required by company and tax law.
• Security and access logs are kept for at least one year, as required by law, and longer where needed to investigate an incident.

When the purpose for which data was collected is no longer served and the law does not require us to keep it, we erase it.

We apply reasonable security practices and procedures appropriate to the data we hold, including:

• encryption of data in transit using TLS, and encryption of storage volumes and backups;
• encryption of secrets such as access tokens and provider credentials at the application level;
• strict separation of each customer's workspace, role-based access control and optional two-factor authentication;
• tamper-evident audit logs, regular backups and restricted administrative access.

No system is completely secure. You are responsible for keeping your password and API keys confidential.

If we become aware of a personal data breach, we will take steps to contain it and will inform affected users, the Data Protection Board of India and other authorities, such as CERT-In, in the manner and within the time required by law. Where the breach affects Customer Data, we will inform the customer concerned without undue delay.

Subject to the DPDP Act and other applicable law, you have the right to:

• get confirmation of whether we process your personal data, a summary of that data, and the identities of those we have shared it with;
• have inaccurate or incomplete data corrected, completed or updated;
• have your data erased when it is no longer needed and the law does not require us to keep it;
• withdraw consent at any time. Withdrawal does not affect processing already done, and may mean we can no longer provide some or all of the Services;
• nominate another person to exercise your rights if you die or become incapacitated; and
• have your grievance redressed by us, and then complain to the Data Protection Board of India if you are not satisfied.

To exercise these rights, write to [email protected] from the email address linked to your account. We may need to verify your identity. Many details can also be viewed and edited directly in your account settings.

The Services are meant for businesses and are not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

The Services may link to or integrate with third-party websites and services, including Meta's sign-up flow for WhatsApp Business. Their handling of personal data is governed by their own privacy policies, which we encourage you to read.

We may update this policy from time to time. The latest version will always be on this page with its effective date. If a change is material, we will notify account holders by email or in the application before it takes effect.

If you have a question, request or complaint about how we handle personal data, contact our Grievance Officer:

• Name: Mohan Rao
• Company: CRASC Technologies Private Limited
• Address: Plot No. 29, Flat No. 401, 4th Floor, Cyberview Residency, Gafoor Nagar, Hyderabad, Telangana 500081, India
• Email: [email protected]

We acknowledge complaints within 24 hours and aim to resolve them within 15 days of receipt. See the Contact and Grievance page for details.