Privacy Policy

Last updated: 24 July 2026

Anekant AI ("we", "us") operates a multi-tenant WhatsApp Business Platform that lets our business clients send and receive WhatsApp messages with their own customers through our hosted API and dashboard. As a technology provider we act as a data processor on behalf of our clients (the data controllers). This policy explains what we process and why.

Information we process

• Business account data — our clients' WhatsApp Business Account IDs, business phone-number IDs, display names, message templates, and access tokens needed to operate on the WhatsApp Business Platform.
• Message content and metadata — the messages our clients send and receive through the platform, including text, media, sender/recipient WhatsApp IDs, timestamps, and delivery/read status, so we can deliver messages and show conversation history in the dashboard.
• Media — images, documents and other files exchanged in conversations, stored temporarily to relay them.
• Account & sign-in data — the WhatsApp numbers authorized to access a client's dashboard and short-lived session identifiers.

How we use it

• To transmit messages between our clients and their customers via the WhatsApp Business Platform.
• To provide the dashboard (conversation history, delivery status, templates, analytics).
• To deliver inbound events to a client's own systems via signed webhooks.
• To enforce rate limits, prevent abuse, and keep the service secure and reliable.

We do not sell personal data, and we do not use message content for advertising.

Sharing with Meta / WhatsApp

To deliver messages we send and receive data through Meta's WhatsApp Business Platform (WhatsApp Cloud API). Meta processes this data under its own terms and privacy policy. Our clients must comply with the WhatsApp Business Messaging Policy and obtain any required opt-in from their customers.

Retention

Message records are retained to provide conversation history to our clients. Media files are retained for 30 days and then automatically deleted. Access tokens are encrypted at rest and retained only while a client account is active. A client may request deletion of their data at any time (see below).

Security

• Upstream provider tokens are encrypted at rest (AES-GCM).
• API keys are stored only as hashes; the plaintext key is shown once at creation.
• Inbound webhooks are verified (HMAC signatures); outbound webhooks to clients are signed.
• The platform runs on Cloudflare's edge infrastructure over HTTPS only.

Data deletion & your rights

Individuals whose data is processed on behalf of a client should contact that business (the data controller). Our clients, and anyone with a data request, can email ketul.shah@anekantai.com to access, correct, or delete their data. We will action verified deletion requests and remove the associated records and media.

Children

The service is intended for businesses and is not directed to children under 13.

Changes

We may update this policy from time to time; the "last updated" date reflects the latest version.

Contact

Anekant AI — anekantai.com · ketul.shah@anekantai.com