Privacy Policy

Thabaal (தபால்) is a customer-messaging portal at thabaal.in, run by Thabaal, India (“Thabaal”, “we”, “us”). Businesses (“clients”) use it to send WhatsApp messages and campaigns through Meta's official WhatsApp Business Platform, answer replies and calls, take orders and request payments.

This policy covers two groups of people:

• Portal users: the business owners and staff who sign in to Thabaal.
• Customers: the people our clients message on WhatsApp, whose details our clients keep in Thabaal.

We follow India's Digital Personal Data Protection Act, 2023 (“DPDP Act”) and its Rules, and the Information Technology Act, 2000. Words like “Data Fiduciary”, “Data Processor” and “Data Principal” have the meanings those laws give them.

• For portal users' account data, Thabaal decides why and how it is used, so we are the Data Fiduciary.
• For customer data, the business you deal with decides whom to message and why. That business is the Data Fiduciary, and Thabaal is its Data Processor: we process the data only on its instructions and only to provide our service to it.

If you are a customer and want to know what a business holds about you, or want it corrected or deleted, the quickest route is to ask that business. You can also write to us and we will pass your request on and help them act on it (see Your rights).

About portal users

• Name, email address, role (owner, manager or staff) and which business you belong to.
• Your password, stored only as a one-way bcrypt hash. We never see or store it in readable form. If you choose “Continue with Google”, Google shares your name, email address and profile picture with us, and we use the email to find your account.
• What you do in the portal where it matters for the business, for example who answered a call, recorded a payment or sent a campaign.

About client businesses

• Business name, logo, colours and tagline; the business's WhatsApp Business Account, phone number IDs and display names.
• Meta access tokens needed to send messages (kept on our servers and never shown back in the portal).
• Sending rules, plan settings, wallet top-ups and WhatsApp message costs.

About customers (processed for the business that holds them)

• Name and WhatsApp phone number.
• Area or location, and purchase notes, for example as written on the business's order sheets.
• Tags and groups the business assigns, loyalty points, and simple measures such as how recently and how often you buy.
• When and how you agreed to receive messages, and whether you have opted out.
• Messages the business sends you and their delivery and read status; messages, photos, files and button taps you send to the business.
• Orders placed through WhatsApp (items, amounts and, if you give it, a delivery address).
• Payment status for an order: amount, method and the UPI transaction reference. Card numbers, bank account details and UPI PINs never reach Thabaal.
• WhatsApp calls with the business: number, name, time, duration and outcome. Call audio passes live between Meta and the person answering in their browser. It is not recorded or stored.

Collected automatically: basic technical data needed to run and secure the service, such as IP address, browser type and error logs kept by our hosting provider.

• To send the messages, campaigns, reminders and payment requests a business sets up, and to deliver their replies and calls.
• To record orders and payments, and to show the business reports (deliveries, reads, replies, sales, best times to message).
• To respect opt-outs and keep within WhatsApp's sending limits and quality rules.
• To sign you in, keep accounts secure, prevent misuse, and give support.
• To work out each business's WhatsApp messaging costs and wallet balance.
• To meet legal obligations, such as tax records or lawful requests from authorities.

We do not sell personal data, use it for advertising, or combine one business's customer list with another's. Each business sees only its own customers.

Some optional tools use artificial intelligence to save time: suggested replies, a template writer, reading an order out of a pasted chat, follow-up messages, audience filters and a business assistant that answers questions about the business's own figures.

• When a portal user uses one of these, the text needed for that task (for example a customer's recent messages, or the chat pasted in) is sent to an AI provider, Google (Gemini API) or Groq, which returns a suggestion.
• We send only what the task needs. Passwords, access tokens and payment details are never sent.
• The output is a suggestion. A person at the business reviews it and decides whether to use it; nothing is sent to a customer automatically by these tools.

• Businesses must have a customer's permission before sending them WhatsApp messages, as Meta's WhatsApp Business policies and Indian law require. Thabaal records how and when each customer agreed (for example a QR sign-up or an order form).
• Customers can stop marketing messages at any time by replying STOP. They are marked as opted out for that business straight away and its campaigns skip them.
• Portal users agree to this policy when they create an account or sign in. They can withdraw by closing their account (see below).

We share data only with the service providers that run Thabaal, each bound by their own terms and security commitments:

• Meta Platforms (WhatsApp Business Platform): every WhatsApp message, call and catalogue order passes through Meta. Meta's own privacy policy and the WhatsApp Business terms apply to that part.
• Vercel: hosts the website and stores uploaded images (Vercel Blob).
• Neon: our database provider.
• Google: “Continue with Google” sign-in, the Gemini AI features, and, where Google Sheets sync is switched on, copying customer and order details to the business's Google Sheet.
• Groq: AI features.
• If a business connects through its own WhatsApp app session instead of Meta's Cloud API, its messages pass through that session, which the business controls.

We may also disclose data when the law requires it, to protect people's safety or our rights, or to a buyer if Thabaal's business is sold. In that case this policy would still protect it.

Our servers and database are located in the United States (Vercel and Neon, US East). The DPDP Act allows this transfer unless the Government of India restricts transfers to a country. We choose established providers that encrypt data in transit and at rest.

• Portal user accounts: while the account is active. After it is closed, deleted within 30 days.
• Customer data: for as long as the business uses Thabaal and keeps it. When a business deletes a customer, or stops using Thabaal and asks us to, we delete it within 30 days.
• Opt-outs: a phone number that opted out is kept only so we keep honouring that choice.
• Logs and records the law requires: processing logs for at least one year, as the DPDP Rules require, and billing and tax records for as long as Indian tax law requires. These are then deleted.

• All connections use HTTPS; data is encrypted in transit and stored with providers that encrypt it at rest.
• Passwords are stored as bcrypt hashes. Sign-in uses a signed, HttpOnly cookie that browser scripts can't read.
• Each business can only reach its own data, and staff accounts can be limited to what their role needs.
• Messages from Meta are checked against Meta's signature before we accept them. Access tokens stay on the server.

No system is perfectly secure. If a personal data breach happens, we will inform affected businesses and users and the Data Protection Board of India within the time the law sets, and tell you what we are doing about it.

We use only the cookies the portal needs to work. There are no advertising or third-party tracking cookies.

• wp_session: keeps you signed in (up to 7 days).
• wp_client: remembers which business an administrator is viewing.
• wp_oauth_state: protects “Continue with Google” sign-in (10 minutes).
• Your browser's local storage remembers display choices such as light or dark mode and language. It stays on your device.

Under the DPDP Act you can:

• get a summary of the personal data we process about you and whom it was shared with;
• have inaccurate or incomplete data corrected, completed or updated;
• have your data erased when it is no longer needed or you withdraw consent;
• withdraw consent at any time (customers can simply reply STOP);
• nominate someone to act for you if you die or become unable to act;
• have your grievances addressed, and then complain to the Data Protection Board of India if you are not satisfied.

Email privacy@thabaal.in from the email address or WhatsApp number concerned, so we can confirm it is you. Customers: we will work with the business that holds your data. We reply within 30 days at the latest, and always within the 90 days the DPDP Rules allow.

Portal users: ask your business owner to remove your login, or email privacy@thabaal.in from your account's email address with the subject “Delete my account”. We delete your account and sign-in details within 30 days and confirm by email.

Customers of a business: reply STOP to stop marketing messages at once. To have your details deleted, ask the business, or email privacy@thabaal.in with your WhatsApp number and the business's name. We confirm once it is done, within 30 days.

If you connected through Facebook or WhatsApp sign-up: you can also remove Thabaal's access in your Facebook or Meta Business settings (Business integrations). Then email us as above and we delete the related data.

Records we must keep by law (for example tax records) are kept only for that purpose and deleted when the period ends.

Thabaal is a tool for businesses and is not meant for anyone under 18. We do not knowingly collect children's data. Businesses must not use Thabaal to message children without verifiable consent from a parent or guardian. If you believe a child's data is in Thabaal, email privacy@thabaal.in and we will delete it.

We will update this page when our service or the law changes, and change the date at the top. For important changes we will tell portal users in the portal or by email before they take effect.

For privacy questions, requests or complaints, contact our Grievance Officer:

We acknowledge complaints within 2 working days and aim to resolve them within 30 days. If you are not satisfied, you can complain to the Data Protection Board of India.