1. Overview & Core Principles
RelayWA (“we”, “our”, or “us”) provides developer-first WhatsApp gateway infrastructure. We believe in privacy by design. We operate under strict principles of data minimization: we collect only what is strictly required to route your messages, verify payments, and maintain secure session connections.
2. Data We Collect
When you use RelayWA, we may collect and process the following categories of data:
- Account Information: Your name, work email address, hashed passwords, and two-factor authentication credentials.
- WhatsApp Connection Credentials: Cryptographic authentication keys and session state tokens generated during the QR linking process via the Baileys protocol. These keys are stored encrypted at rest and are used solely to establish the socket connection between your number and WhatsApp servers.
- Transaction & Billing Data: UPI transaction/UTR reference numbers, payment amounts in Indian Rupees (INR), payment timestamps, and internal wallet ledger balances.
- Audit & Operational Logs: Job IDs, recipient phone numbers (used solely for message dispatch), timestamp of delivery status updates (queued, sent, delivered, read), and API request headers (including client IP and user agent for rate limiting and abuse prevention).
3. Message Payloads & Signal Protocol Encryption
WhatsApp messages utilize the Signal Protocol for end-to-end encryption. RelayWA acts as an infrastructure execution client for your connected session:
- We do not permanently store message text, audio voice notes, video streams, or document attachments in unencrypted databases.
- Uploaded media files in the Media Library are stored in secure, private object storage with time-limited signed URLs accessible solely by your workspace.
- Once a message is admitted and dispatched to the WhatsApp network, transient payload buffers are cleared. Only transaction metadata (job ID, recipient phone, delivery status, price) is retained for your audit history and billing records.
4. How We Use Your Information
We process data for the following lawful operational purposes:
- Providing, operating, and maintaining our API and dashboard.
- Executing atomic wallet debits and calculating exact message rates in integer paise.
- Processing automatic 100% refunds for pre-send failed message jobs.
- Preventing fraudulent activity, denial of service, and unsolicited spam.
- Responding to customer support tickets and resolving technical integration queries.
6. Security Safeguards
RelayWA implements industry-standard technical and organizational security controls:
- TLS 1.3 encryption for all data in transit across public endpoints.
- AES-256-GCM encryption for stored WhatsApp session authentication credentials.
- Multi-tenant session isolation ensuring no cross-workspace access or data contamination.
- Continuous vulnerability scans and automated anomaly detection for API key misuse.
7. Data Retention & Account Deletion
We retain account details and ledger records for as long as your account remains active or as required by applicable Indian tax and financial reporting laws.
If you close your account or request data deletion, your WhatsApp session authentication keys and temporary media uploads are purged immediately from our servers.
8. Your Rights (DPDP Act & International Standards)
In accordance with India’s Digital Personal Data Protection Act (DPDP Act) and international data protection regulations, you have the right to:
- Access and review the personal data associated with your account.
- Request correction of inaccurate or incomplete personal information.
- Export your message transaction logs and wallet payment receipts.
- Request deletion of your account and unlinking of your WhatsApp session keys.
9. Privacy Office Contact
If you have questions regarding this Privacy Policy or wish to exercise your data rights, please contact our Data Protection Officer at: