Privacy Policy
How Weflux collects, uses, and protects information across the platform.
Last updated · 29 September 2026 · Effective for all Weflux customers globally.
1. Introduction
This Privacy Policy describes how Weflux, a sole proprietorship owned by Prateek Prakash (GSTIN: 09GMBPP2567J1ZJ, MSME Udyam: UDYAM-UP-07-0119131) ("Weflux", "we", "our", "us"), collects, uses, discloses, and protects information when you use the Weflux platform, including the website and application at weflux.in (collectively, the "Services").
Weflux provides software built on Meta's official WhatsApp Business Cloud API. This policy applies to information about you as a customer of Weflux ("Customer") and to information about your end-customers that flows through our Services on your behalf ("End-User Data").
2. Information we collect
2.1 Customer account information
When you sign up for Weflux, we collect your name, work email address, company name, phone number, and billing information. This is information you provide to us directly.
2.2 End-User Data
When you send messages through Weflux, we process your end-customers' phone numbers, message content, message metadata (delivery and read status, timestamps), and any custom contact properties you configure. You are the data controller for End-User Data; we are a data processor acting on your instructions.
2.3 Usage and device information
We collect logs of your interactions with the Services (pages visited, requests made, IP address, browser and OS metadata, timestamps) for security, debugging and product improvement.
2.4 Cookies
We use a small number of cookies. See our Cookie Policy for details.
3. How we use information
We use the information we collect to:
- Provide, maintain, and improve the Services
- Deliver messages to and from your end-customers through Meta's WhatsApp Cloud API
- Bill you and pass through Meta's conversation charges at cost
- Detect, prevent, and respond to security incidents and policy violations
- Communicate with you about your account, security alerts, and service updates
- Comply with legal obligations under Indian and international law
We do not sell End-User Data to third parties. We do not use End-User Data to train machine-learning models. We do not share End-User Data with Meta beyond what is necessary to deliver your messages through the Cloud API.
4. When we share information
We share information only as follows:
- Service providers and sub-processors: Cloud hosting, payment processors, error monitoring and customer support tools. A current list is at
weflux.in/legal/subprocessors. - Meta Platforms: Message payloads transit Meta's WhatsApp Cloud API to reach your end-customers. Meta's processing is governed by their own privacy policy.
- Website analytics and advertising: Only if you allow it in the cookie banner on weflux.in, Google (Analytics and Tag Manager), Microsoft (Clarity) and Meta (Pixel) receive information about your visits to our website. See our Cookie Policy, where you can also change that choice.
- Legal compliance: When required by valid legal process, court order, or to protect the rights, property, or safety of Weflux, our customers, or the public.
- Business transfers: If Weflux is acquired or merged, your information may be transferred subject to this Policy.
Payment processing: We use Cashfree and PayU to process payments. Depending on the payment method and processor used, they receive information needed to complete your payment, such as your name, email address, phone number, billing details, order or subscription reference, transaction amount and currency. They may also collect payment-method information and device or transaction data to process payments, prevent fraud and comply with applicable requirements. Their handling of this information is described in the Cashfree Privacy Policy and PayU Privacy Policy.
5. Data retention
We retain Customer account information for as long as your account is active and for a period of 30 days after closure, after which it is anonymised or deleted.
End-User Data (messages, contacts) is retained for the duration of your subscription and for 30 days thereafter, unless you delete it sooner or request immediate deletion. See Data Deletion for details.
6. Security
Weflux runs a documented information security programme. We do not currently hold SOC 2 or ISO 27001 certification. Data is encrypted in transit using TLS and encrypted at rest, and sensitive credentials such as WhatsApp access tokens are additionally encrypted at the application layer (AES-256-GCM). Access to production systems is restricted to named engineers on a least-privilege basis. See our Security page for the controls we operate today.
7. Your rights
If you are an end-customer whose data is being processed by a Weflux Customer, please contact that Customer directly to exercise your rights. Where we act as the data controller (for our own Customer account information), you may:
- Access the personal data we hold about you
- Correct inaccurate or incomplete personal data
- Request deletion of your personal data
- Object to or restrict certain processing
- Port your data to another service
- Withdraw consent at any time, where processing is based on consent
Contact privacy@weflux.in to exercise any of these rights. We respond within 30 days.
8. International data transfers
Weflux hosts Customer Data with infrastructure providers under contract with us; ask privacy@weflux.in for the hosting location that applies to your contract. Limited operational data (e.g. payment processing, error logs) may be processed in other jurisdictions through our sub-processors. Where data is transferred outside India, we rely on appropriate safeguards including Standard Contractual Clauses.
9. Children
The Services are not directed to children under 18. We do not knowingly collect personal data from children. If you believe we have, please contact us and we will delete it.
10. Changes to this Policy
We may update this Policy from time to time. Material changes will be communicated by email to active Customer accounts at least 30 days before they take effect.
11. Contact us
Questions about this Policy or our data practices? Write to our Data Protection Officer at privacy@weflux.in or by post:
Weflux (Proprietor: Prateek Prakash)
Attn: Data Protection Officer
Building No. 00109, Akolhi, Azamgarh, Uttar Pradesh 276202, India
Operations: Bengaluru, Karnataka, India
GSTIN: 09GMBPP2567J1ZJ · MSME Udyam: UDYAM-UP-07-0119131