Legal

Privacy Policy

This policy explains what personal data Wrenbell handles, why, for how long, and what you can do about it. Wrenbell is software operated by Go Live Marcom Private Limited ("we", "us"), a company incorporated in India. It connects businesses to the WhatsApp Business Platform.

1. Two different roles

Wrenbell handles personal data in two distinct capacities, and the difference determines who is answerable to you.

Whose data	Our role	What that means
Our customers — the businesses that subscribe to Wrenbell, and their staff who sign in	Data fiduciary (controller)	We decide what we collect and why. Requests about this data come to us.
Our customers' contacts — the people they message on WhatsApp	Data processor	The customer decides who to message and why. We only store and transmit that data on their instructions. Requests about this data are normally answered by that business, and we assist them.

If you were messaged by a business using Wrenbell and want your data removed, see section 11. We will help even though the business, not us, decides what happens to its contact list.

2. What we collect

2.1 From our customers

• Account details — name, work email address, password (stored only as a cryptographic hash, never in readable form), role, and the workspace they belong to.
• Business details — company name, billing address, GSTIN and other information needed to raise a compliant tax invoice.
• Connection details — the identifiers of the WhatsApp Business Account and phone numbers you connect, and the access token that authorises us to act on your behalf. Tokens are encrypted before storage.
• Usage records — sign-in times, actions taken in the application, and an audit record of any access to your workspace by our staff.
• Support correspondence — what you write to us and what we reply.

2.2 On behalf of our customers

When a business uses Wrenbell, we store and transmit the following about the people it communicates with:

• Phone number, in international format
• Name, if the business has one
• Tags and custom fields the business chooses to keep, such as a booking reference or a preferred language
• The content of messages sent and received, including images, documents and other media
• Delivery status for each message — queued, sent, delivered, read or failed, with the failure reason
• Consent status: whether the person has opted out, when, and by what means

We do not decide what is collected here. The business does, and it is responsible for having a lawful reason to hold it.

2.3 From visitors to this website

See section 12. In short: very little.

3. Why we use it

• To provide the service — sending and receiving messages, running campaigns, showing conversations and reports.
• To enforce consent — checking opt-out status before every send, and recording opt-outs triggered by keywords.
• To keep the service secure — detecting abuse, investigating incidents, and maintaining the audit record of staff access.
• To bill customers and issue tax invoices.
• To provide support when a customer asks for it.
• To meet legal and regulatory obligations, including under tax law and the Digital Personal Data Protection Act, 2023.

We do not sell personal data. We do not share it with advertisers. We do not use the content of our customers' messages to build products, train models, or for any purpose other than delivering the service to that customer.

4. Consent and lawful basis

For our own customers, we process data to perform the contract between us and to meet legal obligations.

For the people our customers message, the lawful basis rests with the customer. Under our Acceptable Use terms, every customer must confirm that each contact has given consent to be contacted on WhatsApp for the purpose in question, and must be able to evidence it. WhatsApp's own rules require opt-in before a business initiates a conversation, and consent given for one purpose — an order update, for example — does not extend to another, such as a promotional offer.

Where a customer cannot demonstrate consent, we may suspend sending on that workspace.

5. Who we share it with

We use a small number of service providers to run Wrenbell. Each is bound to handle data only on our instructions.

Provider	Purpose	Location
Meta Platforms, Inc. and its affiliates (WhatsApp Business Platform / Cloud API)	Delivering and receiving WhatsApp messages	Global
[HOSTING PROVIDER]	Application servers and database	[REGION]
[OBJECT STORAGE PROVIDER]	Storage of media sent and received	[REGION]
[EMAIL PROVIDER]	Transactional email such as sign-in and password reset	[REGION]
[ERROR MONITORING PROVIDER]	Detecting and diagnosing faults. Configured to redact personal data.	[REGION]
[PAYMENT GATEWAY]	Collecting subscription payments. Card details are handled by the gateway and never reach us.	India

We will also disclose data where we are required to by law, by a court, or by a lawful request from a competent authority; and where necessary to establish or defend a legal claim. If Go Live Marcom is acquired or reorganised, data may transfer to the successor entity, which will remain bound by this policy or one no less protective.

This list is kept current. Material changes will be notified to customers before they take effect.

6. Meta's role

Messages sent through Wrenbell travel over the WhatsApp Business Platform, operated by Meta. Meta processes that traffic under its own terms and privacy policy, which apply in addition to this one and which we do not control.

Two points customers regularly ask about:

• Meta maintains information about the business itself, such as its business phone number and address, under the terms it provides.
• Meta's Cloud API retains message data for a limited period — a maximum of 30 days — in order to provide the service, for example to retransmit a message.

Wrenbell's own retention is described in section 8 and is separate from Meta's.

7. Where it is stored

Wrenbell's primary database is hosted in an Indian region. Backups are held in [BACKUP REGION]. Some of our service providers, including Meta, operate globally, so data may be processed outside India by those providers under their own terms and any applicable transfer safeguards.

8. How long we keep it

Data	Retained
Message history and conversations	For the life of the subscription, then [90 DAYS — CONFIRM DEFAULT] after termination
Contact records	Until deleted by the customer, or [90 DAYS] after termination
Contacts deleted by a customer	Marked deleted immediately and hidden from the application; permanently erased within 30 days
Opt-out records	Retained after other data is deleted, because we need them to avoid contacting someone who has asked not to be contacted
Suspended accounts (non-payment)	Data retained for 90 days, then deleted unless the account is reinstated
Audit records of staff access	[RETENTION PERIOD]
Invoices and tax records	As long as Indian tax and company law requires, regardless of any deletion request
Backups	30 days, after which they expire on a rolling basis

A deletion request removes data from live systems promptly. It may persist in backups until those backups expire, and we do not restore deleted data from a backup.

9. How we protect it

• Separation between customers. Every record belongs to exactly one workspace, and the database itself refuses to return another workspace's rows. This is enforced below the application, so a mistake in application code cannot expose one customer's data to another. An automated test asserting this must pass before any release.
• Encryption of credentials. WhatsApp access tokens are encrypted at rest using AES-256-GCM with a key held outside the database. They are decrypted only at the point of sending and are never logged or returned by the interface.
• Encryption in transit. All connections use TLS.
• Verified inbound traffic. Every message Meta delivers to us is signature-checked before it is processed, and rejected if it does not verify.
• Access control. Roles limit what each member of a customer's team can do. Sessions can be revoked. Access to a customer workspace by our own staff is recorded in an audit log available to that customer.
• Minimised logging. Message contents and phone numbers are not written to routine application logs, and are redacted in error reports.
• Backups. Taken daily, retained 30 days, with restores tested on a schedule.

No system is perfectly secure. If a breach occurs that is likely to affect you, we will notify you and the Data Protection Board of India as the law requires.

10. Your rights

Under the Digital Personal Data Protection Act, 2023 you may:

• Ask what personal data of yours we hold and how it is processed
• Ask us to correct data that is inaccurate, or complete data that is incomplete
• Ask us to erase your personal data, subject to any legal obligation to retain it
• Withdraw consent, where processing rests on consent
• Nominate another person to exercise these rights on your behalf in the event of your death or incapacity
• Raise a grievance with us, and escalate to the Data Protection Board of India if you are not satisfied

Write to privacy@wrenbell.com. We will acknowledge within [3] working days and respond substantively within 30 days. We may ask for enough information to confirm your identity, and we will not use that information for anything else.

If your request concerns data held by a business that uses Wrenbell, we will forward it to that business and tell you we have done so.

11. If you received a message sent through Wrenbell

You are not our customer, but you can still act.

1. To stop the messages immediately, reply STOP to that WhatsApp conversation. Our system records the opt-out against that number and blocks further campaign messages from that business. Tamil-language stop keywords work the same way.
2. To have your details removed, contact the business that messaged you — it decides what is on its contact list.
3. If that does not work, write to privacy@wrenbell.com with the sending number and approximate date. We will pass the request on and follow it up.
4. If the message should never have been sent to you, tell us at abuse@wrenbell.com. Sending without consent breaches our terms and we act on it.

12. This website

wrenbell.com is a set of static pages. It sets no advertising or analytics cookies, runs no third-party trackers, and loads no fonts or scripts from outside our own domain.

Our hosting provider records standard server access information, including IP address and browser type, for security and reliability. If you submit the contact form or write to us, we keep what you send in order to reply.

Note: if analytics or a third-party form service is added later, this section and section 5 must be updated before that change goes live.

13. Children

Wrenbell is business software and is not directed at children. We do not knowingly collect personal data of a child, and our customers must not use the service to send marketing to children. If you believe a child's data has reached us, write to privacy@wrenbell.com and we will delete it.

14. Changes to this policy

We will update this policy as the product and the law change. The effective date at the top always reflects the current version. For changes that materially affect how we handle personal data, we will notify customers by email at least [30] days before they take effect.

15. Grievance Officer

If your grievance is not resolved, you may complain to the Data Protection Board of India.