Privacy Policy

1. Information We Collect

1.1 From Customers

• Name and Phone Number - used as your login identifier
• Email Address - optional, used for notifications
• Profile Photo - optional, uploaded by you and stored securely in Cloudflare R2
• Booking Details - service booked, date, time, business
• Payment Records - transaction reference only (processed via Razorpay - we do not store card or bank credentials)
• Device Information - browser type, device type for app performance

1.2 From Business Owners and Staff

• Name, Phone Number and Role - for login and access control
• Business Details - name, address, category, operating hours
• Business Logo - uploaded by you and stored securely in Cloudflare R2
• Staff Information - names, roles and schedules
• Subscription Payment Records - plan selected, Razorpay subscription ID, payment reference
• Razorpay Linked Account Details - for businesses that receive payments via Whato (bank account details are stored and managed by Razorpay, not Whato)

1.3 Automatically Collected

• IP address and approximate location (city/area level only)
• Pages visited and features used within the app
• Session timestamps and error logs

2. How We Use Your Information

• To create and manage your account
• To process and confirm bookings
• To send WhatsApp notifications about your bookings (confirmations, reminders, status updates)
• To process payment transactions securely via Razorpay
• To manage business subscriptions and billing
• To improve platform performance and fix errors
• To communicate important updates about the platform

We do not use your data for advertising. We do not sell your data to any third party.

3. Payment Data

Payments on Whato are processed by Razorpay, a licensed payment aggregator in India. Whato does not store your card details or bank credentials. Only the transaction reference (order ID / payment ID) is stored to track payment status.

When you pay for a booking, the payment is split and transferred directly to the business's linked bank account via Razorpay Route. Whato does not hold or retain any portion of booking payments. A convenience fee is added to each paid booking at checkout to cover Razorpay gateway charges — this is paid by the customer and is visible before confirming payment. Whato earns only from business subscription fees.

4. File Storage

Profile photos and business logos uploaded to Whato are stored in Cloudflare R2, a secure cloud object storage service. These files are served via a private CDN and are not publicly indexed. Cloudflare R2 stores data in accordance with Cloudflare's privacy and security standards.

5. WhatsApp Notifications

By creating an account or making a booking on Whato, you consent to receive WhatsApp messages on your registered phone number for the following purposes only:

• Booking confirmation and appointment details
• Queue position updates (for clinic token system)
• Order status updates (for restaurant orders)
• Membership renewal reminders (for gym memberships)
• Day-before appointment reminders

WhatsApp notifications are sent through the Meta WhatsApp Business API. You may opt out by contacting us at hello@whato.in.

6. Data Sharing

We share your information only in the following limited cases:

• With the Business You Book - your name, phone and booking details are shared with the relevant business to fulfil your appointment
• Razorpay - for payment processing and business payout transfers
• Cloudflare R2 - for secure storage and delivery of uploaded images
• Meta (WhatsApp) - phone number and message content for delivering notifications
• Legal Requirements - if required by Indian law or a competent authority

We do not share your data with any marketing companies, data brokers or unrelated third parties.

7. Data Storage and Security

Your data is stored on a secure VPS server hosted in Europe (Hostinger KVM2). We use industry-standard security practices including encrypted connections (HTTPS), hashed passwords (bcrypt), and HTTP-only JWT cookies for authentication. PostgreSQL database access is restricted to internal services only. Uploaded files are stored in Cloudflare R2 with access controls.

While we take all reasonable measures to protect your data, no system is 100% secure. We will notify users promptly in the event of any data breach affecting their personal information.

8. Data Retention

• Active accounts - data retained as long as account exists
• Deleted accounts - personal data removed within 30 days of deletion request
• Booking records - retained for 12 months for dispute resolution
• Payment records - retained for 5 years as required by Indian financial regulations
• Uploaded files - removed from Cloudflare R2 within 30 days of account deletion

9. Your Rights

As a user of Whato, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate information
• Request deletion of your account and associated data
• Request removal of uploaded files (photos, logos)
• Opt out of WhatsApp notifications
• Raise a complaint about how we handle your data

To exercise any of these rights, email us at hello@whato.in with your registered phone number.

10. Cookies

Whato uses HTTP-only cookies to maintain your login session. These are essential cookies required for the app to function. We do not use tracking cookies, advertising cookies or third-party analytics cookies.

11. Children's Privacy

Whato is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from minors. If you believe a minor has registered on our platform, please contact us immediately.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated effective date. Continued use of Whato after changes constitutes acceptance of the updated policy.

13. Contact Us