Privacy Policy

1.1 Account and Registration Data

• Business name, owner name, and contact details
• Email address and phone number
• Login credentials (passwords stored as bcrypt hashes; never in plain text)
• Billing address and payment information (processed via PCI-compliant payment gateways; we do not store full card numbers)
• Business category, GST number, and company size (optional, for onboarding)

1.2 WhatsApp and Meta Platform Data

• WhatsApp Business Account (WABA) IDs and Phone Number IDs
• Message template content and approval metadata
• Message delivery reports, read receipts, and error codes
• Customer phone numbers and conversation history (as initiated or received by the business)
• Meta Business Manager IDs and Ad Account IDs
• Click-to-WhatsApp (CTWA) ad performance data: impressions, clicks, cost, conversions
• Facebook Page IDs and Instagram Business Account IDs connected by the business
• Instagram Direct Message metadata (where applicable and authorised)

We do not collect or store personal Facebook or Instagram profile data of end users such as friends lists, personal photos, gender, birthday, or relationship status.

1.3 LinkedIn Platform Data

• Lead Gen Form submissions: name, email, phone number, company, job title, and any other fields the member explicitly consented to share
• LinkedIn Ad Account IDs and Campaign IDs
• LinkedIn campaign performance metrics: impressions, clicks, spend, leads generated
• OAuth access tokens (encrypted, used solely to make authorised API calls on behalf of the connected client)
• Basic profile data for WeNext platform users who sign in via LinkedIn OpenID Connect: name, email, profile picture

We do not collect LinkedIn member data beyond what is explicitly submitted through a LinkedIn Lead Gen Form. We do not access LinkedIn connections, messages, endorsements, or personal profile information of any LinkedIn member.

1.4 Google Platform Data

• Google Ads account IDs and campaign performance data
• Google Calendar events and availability (where client connects Google Calendar)
• Google My Business profile data (where integrated)
• OAuth tokens scoped strictly to the permissions granted by the client

1.5 Third-Party CRM and Business Tool Data

When a client connects a third-party tool to WeNext, we access only the data required to perform the integration. This includes but is not limited to:

• CRM platforms (Salesforce, HubSpot, LeadSquared, Zoho, AiTrillion): contact records, lead status, pipeline stage, notes, and tags — synced bidirectionally as configured by the client
• Ecommerce platforms (Shopify, WooCommerce): order data, product catalogue, customer records, abandoned cart data, and fulfilment status
• Payment platforms (PayTabs, KPay, Razorpay): transaction IDs, payment status, and order references — we do not store full card or bank account numbers
• Logistics platforms (Rapido, Dunzo, Shiprocket): delivery order IDs, pickup/drop addresses, rider assignment status, and delivery status updates
• Vertical-specific platforms (Pet Pooja and similar POS/ERP tools): order data, menu items, customer records, and transaction history
• Calendar tools (Google Calendar, Calendly): appointment slots, event metadata, attendee details as shared by the client
• Automation platforms (Zapier, Make, Pabbly Connect): webhook payloads and data passed through automation workflows configured by the client
• Analytics platforms (Klaviyo, MoEngage, Yotpo): contact lists, campaign performance data, and event triggers as configured

1.6 Usage and Technical Data

• IP address, browser type, operating system, and device identifiers
• Pages visited, features used, and session duration within the WeNext platform
• API request logs (retained for debugging and security purposes)
• Error logs and crash reports

We collect and process data for the following purposes:

2.1 Core Platform Services

• To provide WhatsApp Business API messaging, campaign management, and automation features
• To enable Click-to-WhatsApp (CTWA) ad creation and performance tracking via Meta Ads API
• To sync leads from LinkedIn Lead Gen Forms and trigger automated WhatsApp follow-up messages on behalf of business clients
• To display ad performance from Meta Ads, Google Ads, and LinkedIn Ads within the WeNext dashboard
• To sync customer and order data between connected CRM, ecommerce, and logistics platforms
• To enable appointment booking and calendar management via connected calendar tools
• To process and track payments and delivery orders via connected payment and logistics platforms
• To send automated WhatsApp notifications (order confirmations, delivery updates, appointment reminders, payment receipts) on behalf of business clients to their customers

2.2 Platform Improvement

• To analyse usage patterns and improve WeNext features
• To troubleshoot bugs, errors, and performance issues
• To conduct internal research and develop new integrations

2.3 Communication

• To send essential service notifications, billing alerts, and system updates
• To respond to support requests and inquiries

2.4 Legal and Compliance

• To comply with applicable laws, regulations, and platform API terms
• To detect and prevent fraud, abuse, and unauthorised access

3.1 Official Meta Business Partner

WeNext is an official Meta Business Partner and operates under Meta's Platform Terms and WhatsApp Business Policy.

3.2 Data obtained through Meta APIs is used exclusively for:

• Enabling WhatsApp Business onboarding via Meta Embedded Signup Flow
• Syncing and managing message templates via WhatsApp Cloud API
• Sending and receiving WhatsApp messages on behalf of authorised business clients
• Managing and reporting on Meta ad campaigns for business clients who have connected their Meta Ad Account
• Managing Facebook Page and Instagram Business Account integrations where connected by the client

3.3 We do not use Meta platform data to:

• Target advertising to end users on any platform outside of what the client explicitly configures
• Build personal profiles of end users beyond what is required for the client's customer management
• Sell, transfer, or license Meta platform data to any third party
• Combine Meta data with data from other platforms for any purpose not disclosed in this policy

4.1 API Partnership

WeNext integrates with LinkedIn's Lead Sync API and Marketing Developer Platform under LinkedIn's API Terms of Service and the LinkedIn Marketing Developer Platform Agreement.

4.2 Data accessed via LinkedIn APIs:

• Lead Sync API: Lead Gen Form submissions (name, email, phone, company, and any other fields the member consented to share). Used exclusively to sync leads to the client's WeNext CRM and trigger WhatsApp follow-up messages.
• Marketing API: Ad account IDs, campaign IDs, and performance metrics. Used to display LinkedIn ad performance in the WeNext dashboard.
• Share API: OAuth-scoped access to post on behalf of the authenticated platform user. Used only when the client explicitly initiates a share action.
• OpenID Connect: Name, email, and profile picture of WeNext platform users who choose to sign in with LinkedIn. Used for authentication only.

4.3 LinkedIn data restrictions — what we do not do:

• We do not sell, transfer, or share LinkedIn member data with any third party other than the business client who owns that lead
• We do not use LinkedIn data for advertising targeting on any other platform
• We do not build profiles of LinkedIn members beyond what is necessary for the lead follow-up use case
• We do not scrape or aggregate LinkedIn data beyond what is returned by authorised API calls
• We do not combine LinkedIn member data with data from other sources without explicit consent from the data subject
• We do not retain LinkedIn member data beyond the period required for the client's lead management workflow

4.4 Data Storage

LinkedIn lead data is stored encrypted in AWS infrastructure (AES-256 at rest, TLS 1.3 in transit), accessible only to the specific business client whose Lead Gen Form generated the lead, retained for a maximum of 24 months or until the client requests deletion, and deleted within 30 days upon client account termination.

4.5 Deletion Requests

LinkedIn members whose data was captured via a Lead Gen Form may request deletion by contacting support@wenext.ai. Requests are processed within 30 days.

5.1 General Principle

When a client connects a third-party tool to WeNext, they explicitly authorise WeNext to access data from that tool on their behalf. We access only the minimum data necessary to perform the requested integration.

5.2 CRM Integrations (Salesforce, HubSpot, LeadSquared, Zoho, AiTrillion)

• We sync contact records, lead data, and pipeline updates bidirectionally as configured by the client
• CRM data is used solely to power WhatsApp automation, lead follow-up, and reporting within WeNext
• We do not modify CRM data without explicit client instruction or automation rules set by the client

5.3 Ecommerce Integrations (Shopify, WooCommerce)

• We access order data, product catalogue, and customer records to power order notifications, abandoned cart recovery, and customer support automation via WhatsApp
• We do not store payment card data from ecommerce platforms

5.4 Payment Integrations (PayTabs, KPay, Razorpay)

• We access transaction IDs, payment status, and order references to trigger WhatsApp payment confirmation messages
• We do not store full card numbers, CVVs, or bank account credentials
• Payment processing is handled entirely by the payment gateway; WeNext receives only the result of the transaction

5.5 Logistics Integrations (Rapido, Dunzo, Shiprocket)

• We access delivery order IDs, pickup and drop addresses, rider assignment status, and delivery status updates to trigger WhatsApp delivery notifications on behalf of the business client
• Address data received from logistics integrations is used solely for notification purposes and is not retained beyond the delivery lifecycle

5.6 Vertical-Specific Integrations (Pet Pooja and similar POS/ERP platforms)

• We access order data, menu or product data, customer records, and transaction history as required to enable WhatsApp order notifications, confirmations, and customer communication
• Data from these integrations is used solely within the scope of the business client's WeNext account

5.7 Automation Integrations (Zapier, Make, Pabbly Connect)

• Webhook payloads sent to WeNext via automation platforms are processed and stored only as long as required to execute the configured automation
• Clients are responsible for ensuring that data passed through automation workflows complies with applicable data protection laws

5.8 Calendar Integrations (Google Calendar, Calendly)

• We access appointment slots, event metadata, and attendee details only as authorised by the client to enable WhatsApp appointment reminders and booking confirmations
• We do not access calendar data beyond what is required for the specific automation configured by the client

5.9 Analytics and Marketing Integrations (Klaviyo, MoEngage, Yotpo)

• We sync contact lists, event triggers, and campaign performance data as configured by the client to enable cross-channel marketing automation
• Data shared with these platforms is subject to those platforms' own privacy policies in addition to this policy

This section applies to the WeNext mobile app for Android and iOS. It is in addition to the rest of this policy, which continues to apply.

The mobile app is a companion to your WeNext account, so your team can work leads and conversations away from a desk. Nothing described in this section is collected for advertising, and none of it is sold or shared with third parties for their own purposes.

6.1 Device Permissions

We request a permission only when the feature that needs it is used, and we explain why at the moment we ask. Every permission can be declined; declining one disables only the feature it belongs to, and the rest of the app continues to work.

• Phone state and call log (Android): Detects when a phone call starts and ends, and reads your device's call log to determine that call's duration and outcome, so the app can offer to log a follow-up note against the matching CRM contact. Section 6.2 sets out exactly when the call log is read and what happens to it. Nothing leaves your device except what you choose to save.
• Camera: Taking a photo to send in a conversation, attach to a message template, add to a product listing, or set as a delivery-partner profile photo. Only the image you choose to send is uploaded.
• Photos and media: Selecting an existing image, video, audio file, or document to attach to a conversation or template. Only the file you choose to send is uploaded. We do not scan, index, or upload your gallery.
• Location: Sharing your current location in a conversation when you choose to, and showing delivery partners their pickup and drop points on a map while an order is active. Location is accessed only when you share it, or while you are on an active delivery as an online delivery partner.
• Notifications: Delivering new-message, assignment, and reminder alerts. No data leaves your device.
• Display over other apps (Android): Shows a small status bubble to delivery partners who are online, so they can return to an active order while using other apps. The bubble reads nothing from your screen or from other apps.
• Run in background / ignore battery optimisation (Android): Keeps the delivery-partner session alive while an order is in progress, so order updates are not lost when the device tries to suspend the app. No data leaves your device.

6.2 Call Follow-Up

On Android, with your permission, the app observes whether the phone is ringing, on a call, or idle, and uses this to notice that a call has just ended. To record that call accurately it then reads your device's call log, which is where the operating system stores the call's true duration and outcome. This is also what allows a call to be logged when your device suspends the app while the dialer is open.

The call log is read in two situations, and only these two. When a call has just ended, the app looks at calls from the previous two hours and uses the most recent one. When you choose to log a call manually against a specific contact, the app searches your call log for the most recent call to that contact's number. In both cases only the single matching call is used; every other entry is ignored, is not copied, and never leaves your device.

The app next checks whether the other party's number belongs to a contact in your business's own CRM — first against a copy of your contacts stored on the device, and only if there is no local match does it ask our servers. If the number is not one of your CRM contacts, nothing is recorded and nothing is shown, and the app takes no further action.

If the number does match one of your contacts, the app offers you a form. If you choose to save it, the following is stored against that contact in your CRM: the call's duration rounded up to the nearest minute, the time it ended, the outcome you select (for example connected, missed, or no answer), and any notes you type. If you dismiss the form, nothing is saved.

Call log entries are read on your device only. We do not upload, copy, or retain your call log or call history. The only thing that reaches our servers is the summary described above, for a call to one of your own CRM contacts, that you chose to save. The app reads the call log; it never adds to, edits, or deletes entries in it.

What we never access:

• We do not read, send, or receive SMS messages.
• We do not record, listen to, or transcribe any call.
• We do not access your device's contacts or address book.
• We do not read the call log for any purpose other than the two described above, and we do not build or keep a history of your calls.
• We do not store or transmit information about calls to or from anyone who is not already a contact in your own CRM.
• We do not use call information for advertising, profiling, or scoring, and we do not share it with third parties.

The app does not request the Android READ_SMS, SEND_SMS, or RECEIVE_SMS permissions, and does not include any library that requests them.

On iOS, the operating system does not expose call state to apps. The follow-up form appears only after you place a call from within WeNext, and only for the contact you called.

6.3 Retention and Deletion

Anything you save through the mobile app — a call activity, a note, a lead stage change, an attachment — is stored in your organisation's WeNext account and follows the same retention and deletion terms set out in Section 8 of this policy. It is your organisation's data, and deleting it in the app deletes it from the account.

Data that stays on the device, such as the offline contact cache and any queued logs waiting for connectivity, is removed when you sign out or uninstall the app.

6.4 Your Controls

• Every permission can be changed at any time in your device settings, and takes effect immediately.
• Declining the phone-state permission disables call follow-up entirely; nothing else in the app is affected.
• Uninstalling the app removes all data held on the device.

We do not sell user data or client data under any circumstances. We share data only in the following limited and necessary circumstances:

7.1 Infrastructure Providers

AWS (Amazon Web Services) processes and stores all platform data on our behalf under a Data Processing Agreement. AWS operates under strict contractual data protection obligations and may not use our data for any purpose other than providing infrastructure services.

7.2 Platform API Providers

When clients connect third-party platforms (Meta, LinkedIn, Google, Shopify, Salesforce, Rapido, Pet Pooja, and others), data is transmitted to those platforms as required to perform the integration. Each such transmission is authorised by the client when they connect the platform.

7.3 Business Clients

Clients access only their own data within the WeNext platform. One client cannot access another client's data. Client data is logically isolated at the account level.

7.4 Legal Requirements

We may disclose data if required by law, court order, government authority, or to protect the rights, property, or safety of WeNext, our clients, or others. We will notify affected clients of such disclosure to the extent permitted by law.

7.5 Business Transfers

In the event of a merger, acquisition, or sale of assets, user data may be transferred to the acquiring entity. We will provide notice before such transfer and ensure the acquiring entity is bound by equivalent data protection obligations.

• Business account data is retained for as long as the account is active or as required by applicable law
• LinkedIn lead data is retained for a maximum of 24 months or until deletion is requested by the client or the lead subject
• WhatsApp message logs are retained for 12 months by default; clients may configure shorter retention periods
• Ecommerce and order data is retained for 24 months or as required for tax and legal compliance
• Logistics and delivery data is retained for 90 days following delivery completion
• Usage and technical logs are retained for 90 days
• Upon account termination, all client data is deleted within 30 days
• Clients may request immediate deletion of specific data by contacting support@wenext.ai

We employ the following security measures:

• Encrypted data transmission: TLS 1.2 and TLS 1.3 for all data in transit
• Encrypted data storage: AES-256 for all data at rest
• API keys and secrets stored in AWS Secrets Manager; never hardcoded or logged
• SHA-256 hashing for queryable phone number lookups
• PII masking in application and CloudWatch logs
• AWS VPC network isolation and security groups
• Role-based access control with least-privilege principles
• Multi-factor authentication for internal admin access
• Periodic security audits and vulnerability assessments
• Automated alerts for unusual access patterns

In the event of a data breach that affects client or end-user data, we will notify affected parties within 72 hours of becoming aware of the breach to the extent required by applicable law.

Users and data subjects may request:

• Access: a copy of the personal data we hold
• Correction: rectification of inaccurate or incomplete data
• Deletion: erasure of personal data (subject to legal retention obligations)
• Portability: data in a structured, machine-readable format
• Restriction: limiting the processing of personal data in certain circumstances
• Objection: objecting to certain types of data processing

To exercise these rights, contact support@wenext.ai. We will respond within 30 days. For LinkedIn lead data deletion requests, please refer to Section 4.5.

WeNext uses essential cookies for authentication and session management. We also use analytics cookies to understand how visitors use our website and platform. These are loaded through Google Tag Manager, which may in turn load Google Analytics and Microsoft Clarity. You may opt out of non-essential cookies through your browser settings.

WeNext is a B2B platform intended for B2B use only. We do not knowingly collect data from individuals under the age of 18. If we become aware that we have inadvertently collected data from a minor, we will delete it promptly.

We may update this Privacy Policy from time to time. We will notify clients of material changes via email or in-platform notification at least 14 days before the changes take effect. Continued use of WeNext after the effective date of the revised policy constitutes acceptance of the updated terms.

For privacy-related inquiries, requests, or complaints, contact us at:

• Email: support@wenext.ai
• Company: WeNext AI Solutions Pvt Ltd
• Address: Hyderabad, Telangana, India