Privacy policy

1. Who we are

Idara Connect is a WhatsApp Business messaging portal operated by WebMS Consultancy, Surat, Gujarat, India. In this policy "we" and "us" mean WebMS Consultancy, and "the portal" means the software published at wa.idara.studio.

You can reach us about anything on this page at admin@iamsajidansari.com.

2. Two different kinds of data, two different roles

This matters, because our obligations differ between the two.

• When you contact us — through the enquiry form or on WhatsApp — we decide what happens to your details, so we are the data fiduciary for them.
• When a business uses the portal to message its own customers, that business decides who is messaged and what is said. It is the data fiduciary for its customer list; we only process that list on its instructions, to deliver the messages it asks for. We do not sell it, rent it, message it on our own behalf, or reuse it for any other client.

3. What we collect, and why

• Enquiries. Your name and phone number, and optionally your business name, email address, what you want to send, your rough monthly message volume and your message. We also record which campaign or link brought you to the page. Used only to reply to you and to work out a price.
• Portal accounts. The name, email address and a hashed password for each person we give access to.
• WhatsApp Business credentials. The WhatsApp Business Account ID, phone number ID and access token belonging to the client's own account. These are encrypted before they are stored, are never written to our logs or shown again after saving, and are used only to call Meta's API on that client's behalf.
• Contacts uploaded by a client. Phone number, name, whatever extra spreadsheet columns the client keeps for personalising messages (an order number or a travel date, for example), the tags they apply, and the record of consent: whether the contact opted in, where that opt-in came from and when.
• Message records. Which template was sent to which number, the values filled into it, the WhatsApp message ID, and the delivery status Meta reports back — sent, delivered, read or failed, together with any error code.
• Technical logs. Ordinary server logs: IP address, the page requested, and the time. We deliberately keep contact phone numbers out of our application logs and refer to contacts by internal ID instead.

4. Consent to be messaged

The portal will only send to a contact that has been marked as opted in, and it stores the source and date of that opt-in alongside the number. Clients confirm that they hold that consent for every contact they upload. We do not supply, sell or share contact lists, and purchased lists are not permitted on the service.

To stop receiving messages from a business that uses Idara Connect, reply to it on WhatsApp — or write to us at admin@iamsajidansari.com and we will pass the request on and mark the contact as opted out.

5. Who we share it with

• Meta Platforms. Recipient phone numbers, the template used and the values filled into it are sent to the WhatsApp Business Platform, because that is how a WhatsApp message is delivered. Meta's own terms and privacy policy govern what it does with them.
• Our infrastructure provider. The server and its backups are rented from a hosting company that has no independent right to use anything stored on it.

We do not sell personal data, and we do not pass it to advertising networks or data brokers. We will disclose data if the law requires it of us.

6. How long we keep it

• Raw delivery-callback payloads from Meta, kept for debugging: 30 days, then deleted automatically.
• Contacts, campaigns and delivery records: for as long as the client's account is open, and deleted within 60 days of it closing.
• Enquiries from the public page: up to 24 months.
• Anything we are asked to erase: see section 8.

7. How it is protected

The site is served over HTTPS. Access tokens and other credentials are encrypted at rest. The portal is behind a login, and every page that shows credentials or contact data requires one. Incoming delivery callbacks are rejected unless they carry a valid signature from Meta. No system is perfectly secure, and we do not claim otherwise — but we do not keep data we have no use for.

8. Your rights

Under the Digital Personal Data Protection Act, 2023 and the rules made under it, you may ask us for a copy of the personal data we hold about you, ask us to correct or complete it, ask us to erase it, and nominate someone to exercise these rights if you cannot.

Write to admin@iamsajidansari.com. We will respond within 30 days. If the data you are asking about was uploaded by a business that uses the portal, that business decides what happens to it — we will tell you who they are, forward your request, and act on their instruction.

Grievance officer: Sajid Ansari, admin@iamsajidansari.com.

Instructions specifically for deleting your data are on the data deletion page.

9. Cookies

This site sets the two cookies it needs to work: one to keep you signed in, and one to protect forms against cross-site request forgery. There are no advertising cookies and no cross-site tracking on these pages.

10. Children

Idara Connect is a tool for businesses. It is not directed at children and we do not knowingly create accounts for anyone under 18.

11. Changes to this policy

If this policy changes we will update this page and the date at the top of it. Material changes affecting existing clients will also be sent to them directly.