Start Chat

Legal

Privacy Policy

Operator: Codegrin Technologies · Product: WhatsApp AI Assistant · Last updated: September 8, 2026

Draft status: This Policy describes information processing visible in the current implementation. Retention periods, legal bases, privacy-request procedures, international-transfer safeguards, age requirements, and jurisdiction-specific disclosures require business and legal confirmation before this Policy is treated as final.

1. Scope

This Privacy Policy explains how Codegrin Technologies (Codegrin, we, us, or our) processes information when you use WhatsApp AI Assistant, including its website, authenticated workspace, APIs, MCP tools, and related services (the Service).

WhatsApp AI Assistant is an independent service and is not affiliated with, sponsored by, endorsed by, or operated by WhatsApp LLC or Meta Platforms, Inc.

2. Information the Service Processes

The information processed depends on the features and integrations you use.

Account & authentication information

The Service may process:

  • internal user and account identifiers;
  • email address and name for accounts provisioned with login credentials;
  • a WhatsApp-derived account identity and display name for accounts created through WhatsApp authorization;
  • account role, status, plan, subscription period, and usage allowances;
  • password hashes where password login is enabled; and
  • OAuth client information, authorization scopes, token hashes, authorization records, session cookies, and related security information.

Passwords and OAuth bearer tokens are not intentionally stored in plaintext in the application database. Authentication cookies may contain access or refresh tokens and are used to maintain an authenticated session.

WhatsApp connection & conversation information

When you connect an authorized WhatsApp account, the Service may process:

  • the connected telephone number and WhatsApp display name;
  • linked-device credentials and connection status;
  • chat, sender, participant, and WhatsApp message identifiers;
  • message text, media captions, document names, timestamps, direction, and delivery or processing status;
  • conversation activity and message counts; and
  • information needed to check whether a telephone number is registered on WhatsApp.

For inbound media, the current message listener records supported text, captions, or document names; it does not intentionally download and store the inbound media file itself as conversation history. Uploaded template or outbound media may be stored separately as described below.

Messages, templates & campaigns

The Service may process:

  • outbound message text, poll questions and options, media captions, media type, file names, and remote media URLs;
  • uploaded template media and associated file name, type, and size;
  • template names and content;
  • campaign names, templates, recipient telephone numbers, sequence position, progress, send results, and error details; and
  • messaging and feature-usage records used to apply plan limits.

Recipient lists imported in the browser are parsed for campaign creation. Selected recipient numbers are sent to and stored by the backend when the campaign is submitted.

AI auto-reply information

If an eligible user enables AI auto-reply for a conversation, the Service may process:

  • conversation-specific instructions;
  • a limited set of recent message content from that conversation;
  • the newly received message;
  • generated reply text;
  • AI provider response and model identifiers;
  • token-usage and estimated-cost information; and
  • generation or delivery errors and the last-reply time.

The instructions and selected conversation messages are transmitted to OpenAI to generate the reply. The generated reply is recorded by the Service and is automatically submitted for delivery through the connected WhatsApp account.

Payment information

Where online payments are configured, the Service and Razorpay may process:

  • selected plan and account identifiers;
  • name and email supplied to prefill checkout;
  • payment order and payment identifiers;
  • amount, currency, status, failure reason, and payment timestamps; and
  • signed payment and webhook information needed to verify the transaction.

Payment-card entry is handled through Razorpay Checkout. The application code does not intentionally store complete payment-card numbers.

Technical & device information

The Service may process request identifiers, request method and path, response status, IP address, access time, connection and session identifiers, application errors, security events, and service logs.

The website and workspace use browser storage and essential authentication cookies. Device-local storage may remember theme preference, the selected WhatsApp session, and limited recent-conversation workspace information. No advertising pixel or analytics SDK is present in the reviewed application code.

Support communications

If you contact support, we process the email address, message, attachments, and other information you choose to provide. Do not send passwords, QR codes, one-time codes, API keys, tokens, complete payment-card details, or unnecessary confidential conversation content.

3. How Information Is Used

The Service may use information to:

  • create and authenticate accounts and authorized clients;
  • establish, maintain, restore, and disconnect WhatsApp sessions;
  • display recorded conversations and message history;
  • validate recipients and send requested text, media, documents, audio, video, or polls;
  • store templates and process sequential bulk campaigns;
  • generate and send enabled per-conversation AI auto-replies;
  • enforce plan and usage allowances;
  • create and verify payment orders and show payment history;
  • provide live status updates and troubleshoot errors;
  • protect users, third parties, and the Service against abuse or unauthorized access;
  • provide customer support; and
  • comply with applicable legal obligations.

The current implementation does not provide future-date message scheduling, recurring campaigns, prospect research, general AI summaries, or general AI drafting and personalization workflows.

4. When Information Is Shared

Information may be transmitted or made available as needed to provide requested functionality:

  • WhatsApp: connection credentials and message or recipient information needed to connect an account and send or receive messages;
  • OpenAI: AI instructions and selected recent conversation content when AI auto-reply is enabled;
  • Razorpay: checkout, account-prefill, order, and payment-verification information when online payment is used;
  • Remote media hosts: a network request is made to a user-provided media URL so the Service can retrieve content for sending;
  • Hosting and infrastructure providers: information handled as necessary to operate the website, backend, database, storage, and network services; and
  • Authorities or advisers: information where disclosure is required by applicable law or reasonably necessary to establish, exercise, or defend legal rights.

Compatible AI clients authorized by a user may receive information returned by the MCP tools within the scopes granted to that client. Third-party services process information under their own terms and privacy policies. See Third-Party Services.

REQUIRES BUSINESS/LEGAL CONFIRMATION: A complete subprocessor list, provider locations, contractual roles, and international-transfer mechanisms.

5. User Responsibilities for Other People's Information

Users may submit or process information about customers, contacts, employees, prospects, or other third parties. Users are responsible for determining whether they have an appropriate lawful basis, permission, notice, or consent to collect, upload, process, or message those people and for honoring applicable opt-out requests.

The Service must not be used to unlawfully collect or process personal information.

6. Storage, Retention & Deletion

Application records are stored in the Service's database, while linked-device credentials are stored in backend file storage. Browser cookies and local storage remain on the user's device until they expire, are replaced, or are cleared.

The implementation deletes linked-device credentials when a WhatsApp session is logged out or removed and permits users to delete individual message templates. Expired temporary OAuth requests and related temporary sessions are cleaned up. The current product does not expose a complete self-service account-deletion or data-export workflow.

Signing out, disconnecting WhatsApp, removing a WhatsApp session, or deleting a template does not by itself delete all account, message, conversation, campaign, payment, usage, security, or log records. Some database relationships are designed to delete dependent records if an entire user record is removed, but no customer-facing complete-account deletion control is currently implemented.

REQUIRES BUSINESS/LEGAL CONFIRMATION: Retention periods for each data category; backup deletion; log rotation; deletion and anonymization procedures; legal-hold rules; and the verified operational process for access, correction, export, and deletion requests.

See the Data Deletion Policy, which also contains unconfirmed operational details.

7. Security

The implementation includes controls designed to reduce unauthorized access and misuse, including authenticated and scoped access, ownership checks, hashed passwords and tokens, restricted authentication cookies, request validation, rate limiting, production HTTPS requirements, security headers, and redaction of specified secrets from HTTP logs.

No online service or transmission method can be guaranteed to be completely secure. Users are responsible for securing their devices, credentials, and connected WhatsApp account. See Security; some statements and the dedicated security contact on that page still require correction or confirmation.

8. Privacy Choices & Requests

Users can sign out, unlink or remove a WhatsApp session, disable AI auto-reply, and delete individual message templates through the current product interface. Device-local preferences can be removed by clearing browser storage.

Depending on applicable law, individuals may have rights to request access, correction, deletion, restriction, objection, portability, withdrawal of consent, or review by a regulator. These rights vary by location and may be subject to exceptions and identity verification.

For privacy questions, contact support@whatsappaiassistant.com. REQUIRES BUSINESS/LEGAL CONFIRMATION: Whether this address is the designated channel for statutory privacy requests, the identity-verification process, response workflow, grievance contact, and applicable response periods.

9. International Processing

Third-party providers and infrastructure may process information in countries other than the user's country. REQUIRES BUSINESS/LEGAL CONFIRMATION: Actual processing locations and safeguards required for international transfers.

10. Children's Information

The reviewed implementation does not verify age or provide a child-specific consent flow. Users must not use the Service to unlawfully process children's personal information.

REQUIRES BUSINESS/LEGAL CONFIRMATION: Minimum user age, intended audience, parental-consent rules, and jurisdiction-specific children's privacy disclosures.

11. Changes to This Policy

We may update this Policy to reflect changes to the Service, providers, or legal requirements. Any notice method and effective-date process for material changes must be confirmed before final publication.

12. Contact

For general privacy questions, contact support@whatsappaiassistant.com.

REQUIRES BUSINESS/LEGAL CONFIRMATION: Legal entity address, dedicated privacy contact, grievance officer or data-protection contact where required, and a legal-notice address.