Privacy Policy — Svakrama

Version history

Svakrama is a workflow-automation product that lets businesses connect their WhatsApp Business Account to automated flows. It is operated by UNICUEBOX, Flat 106, Kadam Building, Veera Desai Road, Andheri West, Mumbai 400 053, Maharashtra, India (GSTIN 27HSIPS2591P1ZM). In this policy "we", "us" and "Unicuebox" mean the operator; "Svakrama" or "the Service" means the product at app.svakrama.com and s.svakrama.com and its APIs.

This policy is written to comply with the Digital Personal Data Protection Act, 2023 (India), the Information Technology Act, 2000 and rules under it, and the WhatsApp Business Platform and Meta Platform Terms. If you are outside India, local law may give you additional rights; contact us and we will honour them where they apply.

1. Who we are to you

We act in two different roles, and the role decides what we do with data.

If you are a customer of a business using Svakrama and have a question about how that business uses your data, contact that business first. We will help it respond.

2. What we collect and why

Account data (account holders). E-mail address, name, password (stored only as a bcrypt hash), workspace name, role, time-zone, the IP address and browser of each sign-in, two-factor-authentication secrets and recovery codes (stored encrypted), API keys (stored as hashes). Purpose: creating and securing your account, access control, audit of administrative actions, service notices.

WhatsApp Business Account connection data (account holders). When you connect a WhatsApp Business Account (WABA) — either through Meta's Embedded Signup ("Connect with Facebook") or manually — we receive and store your WABA ID, phone number IDs, display names, the business access token Meta issues to our app for your WABA, template names and statuses, and quality/limit signals Meta exposes. Tokens and secrets are stored encrypted at rest with AES-256-GCM. Purpose: sending and receiving messages on your behalf, syncing templates, showing connection health. We request only the whatsapp_business_management and whatsapp_business_messaging permissions, and use them only for the features described in this policy.

Message data (processed for account holders). Inbound messages from your customers (sender number, profile name, timestamp, text, media references, interactive replies), outbound messages your flows send, delivery/read/failure status events, and Meta's conversation and pricing category. Purpose: executing the flows you build, showing run history, retrying failed steps, reconciling delivery. We do not read message content for any purpose other than executing your flows and operating the Service (for example debugging a failure you report).

Flow and workspace data (account holders). Flow definitions, data-store records you create, webhook payloads received at your Svakrama webhook URLs, short links you create and the click counts on them, and execution logs. Purpose: providing the Service.

Technical data. Server logs (IP, user agent, request path, timing, status), error traces, rate-limit counters. Purpose: security, abuse prevention, performance, incident investigation. Retained 30 days unless needed for an open security incident.

Cookies. We use only strictly necessary cookies: a session cookie, an active-workspace cookie and, during two-factor sign-in, a short-lived pending-authentication cookie. No advertising or third-party analytics cookies are set.

We do not collect data from children. The Service is for businesses; account holders must be 18 or over.

3. Legal basis (DPDP Act, 2023)

For account holders we process data on the basis of your consent given at sign-up and to perform the contract (the Terms of Service) with you. For legitimate uses permitted by the Act we process data to secure the Service, prevent abuse, comply with law and respond to legal process. For customers of account holders, the business you deal with is responsible for its legal basis and for obtaining your opt-in to receive WhatsApp messages, as the WhatsApp Business Messaging Policy requires; we process on its instructions.

4. Who we share data with

We do not sell personal data. We share it only with:

Sub-processors are listed at the bottom of this page and updated before a new one starts processing data.

5. International transfers

Our servers are located in India or Singapore (stated in the Sub-processor list). Meta processes WhatsApp data globally under its own terms. Backups are stored encrypted with a key held only by Unicuebox.

6. Retention

7. Security

Transport encryption (TLS 1.2+) on every connection; secrets and tokens encrypted at rest (AES-256-GCM) with a key that is rotated on a documented procedure; passwords hashed with bcrypt; two-factor authentication for platform administrators; per-workspace rate limits; role-based access with audit logging; webhook signature verification for Meta callbacks; backups tested by restore. No system is perfectly secure; if we learn of a breach affecting your data we will notify you and the Data Protection Board of India as the DPDP Act requires.

8. Your rights

Account holders may, at any time: view and correct account data in Settings; export flows and data-store records; delete a workspace or the whole account (see the Data Deletion page at https://app.svakrama.com/data-deletion); withdraw consent by deleting the account; and nominate another person to exercise these rights as the DPDP Act allows. Customers of a business using Svakrama should direct requests to that business; if you contact us directly we will forward the request to the business and act on its instructions, or act ourselves where the law requires.

9. Grievance officer

Under the Information Technology Act and the DPDP Act, our grievance officer is:

Krsnaha Suthar, Proprietor, UNICUEBOX Flat 106, Kadam Building, Veera Desai Road, Andheri West, Mumbai 400 053 E-mail: accounts@unicuebox.com Phone: +91 70235 77624

We acknowledge grievances within 48 hours and resolve them within 30 days. You may also approach the Data Protection Board of India.

10. Changes

We will post changes on this page with a new "Last updated" date and, for material changes, e-mail account holders at least 14 days before they take effect.

Sub-processors