Privacy policy

Your privacy is our utmost priority. Learn how WebPing protects your information with encrypted credential storage, tenant isolation and end-to-end transport encryption.

Key Privacy Guarantees

✓Encrypted Secrets: Your WhatsApp access tokens and webhook verify tokens are encrypted at rest (AES-256-GCM) and are never readable from the browser. ✓Tenant Isolation: Every table in your workspace is protected by database row-level security scoped to your Company — no cross-tenant access. ✓No Sale or Monetization of Data: We do not sell, rent, or monetize your contact book or client phone numbers with advertising brokers.

1. Introduction

WebPing (“we”, “our”, or “us”), a product of Webpeaker, respects your privacy and is committed to protecting the personal data of our users. This Privacy Policy explains how the WebPing WhatsApp CRM platform (webping.webpeaker.com) collects, uses, discloses, and safeguards your information when you use our website, your WebPing workspace, and the WhatsApp connections you create in it. It also describes how we handle messages that your customers exchange with you through the connected WhatsApp Business numbers.

2. Information We Do NOT Collect

WebPing is built so that you stay in control of your own WhatsApp Business data. We strictly adhere to the following non-collection principles:

• We do NOT store your WhatsApp account passwords or two-factor authentication codes.
• We do NOT sell, rent, or monetize your contact book or client phone numbers with third-party advertising brokers.
• We do NOT use your conversations or contacts for advertising, profiling, or to train third-party AI models.

3. Information We Collect

To deliver the CRM service over the official WhatsApp Business Cloud API, we process:

• Account Information: Your name, work email address, and password — authentication is hashed and verified by Supabase Auth; we never store your password in plain text.
• Billing Details: Plan and subscription records, invoices and payment status. Payment card details are processed securely via Stripe (or PayPal); we never store raw credit card numbers.
• WhatsApp Business Configuration: The WhatsApp Business phone numbers your Company connects, WhatsApp Business Account (WABA) identifiers, and your permanent access tokens — tokens are encrypted at rest with AES-256-GCM to enable direct API communication with Meta.
• Conversations & Contacts: Message content, timestamps and delivery/read status of the chats exchanged through numbers connected to your workspace, plus the contact names, numbers, tags and notes your team adds.
• Media Content: Images, audio, documents and files exchanged in those conversations, stored on our servers so chats remain complete.
• CRM Content You Add: Deals, pipelines, broadcasts, message templates (submitted to Meta for approval), no-code automation definitions, quick replies and knowledge-base documents.
• Operational & Security Logs: Audit records of sign-ins, configuration changes and administrative access (including time-boxed, logged support sessions), IP address and user-agent, and API keys you issue for the WebPing REST API.

4. How We Use Information

We use collected information solely to:

• Deliver the CRM service: shared inbox, contacts, sales pipelines, broadcasts, no-code automations, analytics and the public REST API.
• Send and receive WhatsApp messages on your behalf through the official WhatsApp Business Cloud API, and route Meta webhook events to the right workspace.
• Authenticate your subscription status across browser sessions, manage plans and provide customer support.
• Prevent abusive, malicious, or automated spamming activity that violates WhatsApp terms of service, and keep audit trails for security investigations.

If your Company enables the optional AI reply assistant, message content and selected knowledge-base text are sent to the AI provider your Company configures (OpenAI or Anthropic, with your Company’s own API key) only to draft or answer replies. It can be disabled at any time.

5. Third-Party Processors

• Meta Platforms, Inc. — the WhatsApp Business Cloud API processes message delivery, phone-number registration, template review and webhook events under Meta’s own terms and privacy policy.
• Stripe / PayPal — payment processing for subscriptions; card data goes directly to the processor.
• Email delivery service — account verification, password reset and notification emails.

6. Compliance with GDPR & International Privacy Laws

If you are located in the European Economic Area (EEA), United Kingdom, or California, you possess statutory rights under the General Data Protection Regulation (GDPR) and California Consumer Privacy Act (CCPA):

• The right to access and obtain a portable copy of personal account data we hold about you.
• The right to rectify inaccurate account details or request full erasure (“Right to be Forgotten”) — deletion removes your workspace data, configurations and stored media from our platform.
• The right to withdraw consent for marketing communications at any time.

End customers of a Company using WebPing who want their conversation data removed should contact that Company directly; the Company’s administrator can delete the contact and its conversations from the workspace.

To exercise any of these statutory rights, please contact our Data Protection Officer at Webping@webpeaker.com.

7. Data Retention & Deletion

• Workspace data is retained while your account is active. On request or account closure, business data, configurations and stored media are deleted; minimal records are kept only where required for security, abuse-prevention or legal obligations.
• Password-reset tokens and verification links expire automatically.
• API keys can be revoked by you at any time and stop working immediately.
• Audit logs are kept for a limited period to investigate abuse and security incidents.

8. Security Protocols

We employ industry-standard administrative, physical, and technical safeguards. All data in transit between your browser and our servers is secured using Transport Layer Security (TLS 1.3/256-bit). WhatsApp secrets are stored encrypted (AES-256-GCM) at rest, tenant data is isolated by row-level security between Companies, and automatic server backups protect against data loss. Any administrative support session is time-boxed, visible to the Company while active, and fully audited.

9. Contact Information

If you have questions or concerns regarding our privacy policies or data protection practices, please contact us at:

WebPing Privacy & Data Protection Office
Webpeaker
Phone: +91 8696 77 8246
General Contact: Webping@webpeaker.com
Security & Vulnerability Reports: security@webpeaker.com
Headquarters: Rajasthan and Madhya Pradesh (India) ▦ Automatic server backups 🔒 TLS 256-bit encryption ▶ On-demand live demo ● Friendly 24/7 support