Last updated: 25 July 2026

This Privacy Policy explains how ZupiChat, a product of Codelith Lab ("ZupiChat", "we", "us", "our"), collects, uses, shares and protects information when you use our WhatsApp Business messaging platform available at zupichat.com and related apps (the "Service"). We are committed to compliance with India's Digital Personal Data Protection Act, 2023 (DPDP Act), the EU/UK GDPR where applicable, and applicable UAE data-protection law for our international customers.

1. Who we are & our two roles

For data about you as our customer (your account, billing, usage), ZupiChat is the data controller / data fiduciary. For the end-customer data you process through the platform (your contacts, the people you message on WhatsApp, conversation content), you are the controller / data fiduciary and ZupiChat acts only as your processor / data processor, handling that data on your instructions.

2. Information we collect

• Account & identity: name, business name, email, phone number, and login credentials.
• WhatsApp Business data: we connect to the WhatsApp Business Platform through Meta's Cloud API using the WhatsApp Business Account (WABA) and access token you provide. This includes your phone number ID, business profile, message templates, and the messages exchanged between you and your customers.
• Contacts you upload: phone numbers, names, tags and attributes of the people you choose to message. You confirm you have a lawful basis and valid opt-in to contact them.
• Billing: subscription, wallet balance and transaction records. Card/UPI details are handled directly by our payment gateways and are never stored on our servers.
• Technical & usage: IP address, device/browser type, log data and cookies (see our Cookie Policy).

3. How we use information

• To provide, operate and secure the Service and route your WhatsApp messages through Meta.
• To process payments, manage your wallet and prevent fraud.
• To provide support, send service notices, and improve the product.
• To comply with legal obligations and Meta/WhatsApp platform requirements.

We do not sell your data or your end-customers' data, and we do not use the content of your conversations for advertising.

4. WhatsApp, Meta & message data

ZupiChat is not affiliated with or endorsed by Meta/WhatsApp. Your use of WhatsApp messaging is additionally governed by the WhatsApp Business Messaging Policy and Meta's terms. Message content is transmitted through Meta's Cloud API; Meta processes it under its own terms. We retain message and contact data only as long as needed to provide the Service to you or as required by law.

5. Legal bases & your rights

India (DPDP Act, 2023): we process personal data on the basis of consent or legitimate uses. You may request access, correction, updating, or erasure of your personal data, and may nominate another person to exercise your rights.

EEA/UK (GDPR): where applicable, our legal bases are contract, consent, legal obligation and legitimate interests. You have rights of access, rectification, erasure, restriction, portability and objection.

UAE: for customers in the UAE, we handle personal data consistent with the applicable Personal Data Protection Law.

To exercise any right, contact our Grievance Officer (section 10).

6. Sharing & subprocessors

We share data only with: (a) Meta/WhatsApp, to deliver messages; (b) payment gateways, to process payments; (c) infrastructure and hosting providers that run the Service; and (d) authorities where legally required. All subprocessors are bound by confidentiality and data-protection obligations.

7. Data retention

We keep account and billing records for as long as your account is active and for the period required by tax and legal rules thereafter. Conversation and contact data are retained while your account is active; on account closure we delete or anonymise them within a reasonable period, subject to legal retention duties.

8. Security

We use encryption in transit (TLS), access controls, and reasonable technical and organisational measures to protect data. No method of transmission or storage is completely secure; we cannot guarantee absolute security.

9. International transfers

Your data may be processed in India and other countries where our providers operate. Where required, we put appropriate safeguards in place for such transfers.

10. Grievance Officer & contact

For any privacy question, request, or complaint, contact our Grievance Officer:

Codelith Lab — Grievance Officer
Email: business.codelithlab@gmail.com
WhatsApp: +91 86691 17894
We aim to acknowledge complaints within 48 hours and resolve them within the timelines prescribed under applicable law.

11. Children

The Service is intended for businesses and is not directed to children under 18. We do not knowingly collect their data.

12. Changes

We may update this policy from time to time. Material changes will be posted on this page with a new "last updated" date.