Privacy Policy

This Privacy Policy explains how BulkWapp (operated under bulkwapp.com, hereafter "we", "us", or "our") collects, uses, stores and protects information when you use our WhatsApp Business CRM platform.

1. Information we collect

• Account information: name, email, password (hashed), organisation name, team size, sector, and personal phone number you provide at signup.
• WhatsApp Business credentials: Phone Number ID, WhatsApp Business Account ID, encrypted Access Token, and webhook Verify Token. Access tokens are encrypted at rest using AES-256-GCM.
• Contacts and conversations: WhatsApp phone numbers, display names, message text and media you broadcast to or receive from your customers via the Meta WhatsApp Cloud API.
• Property and CRM data: property listings, prices, locations, lead status, site-visit reminders and any notes you create.
• Usage data: session timestamps, IP address (hashed for QR scan attribution), and user-agent strings — used for security, fraud prevention and analytics.

2. How we use your information

• To provide and operate the CRM (broadcasts, inbox, leads, automations).
• To proxy messages between you and your customers via the official Meta WhatsApp Cloud API.
• To attribute QR-code scans on property posters to incoming WhatsApp leads.
• To send service notifications about your account and provide customer support.
• To enforce our Terms of Service and comply with applicable law.

3. Data sharing

We do not sell your personal data. We share data only with:

• Meta Platforms, Inc. — to deliver and receive WhatsApp messages on your behalf via the official Cloud API.
• Supabase Inc. — our infrastructure provider for authentication, database and encrypted file storage.
• Law enforcement — only when required by a valid legal request.

4. Data security

We use industry-standard practices: TLS in transit, encrypted tokens at rest, row-level security on every database table, and webhook signature verification (HMAC-SHA256) for all inbound Meta traffic. No security system is perfect — please report any vulnerability to privacy@bulkwapp.com.

5. Data retention

We retain account, contact and message data for as long as your account is active. You can request deletion at any time — see our Data Deletion Instructions.

6. Your rights

Subject to applicable law (GDPR, India DPDP Act, CCPA), you may: access, correct, export or delete your personal data; withdraw consent; or object to processing. Submit a request to privacy@bulkwapp.com and we will respond within 30 days.

7. Cookies

We use strictly necessary cookies for authentication (Supabase session) and CSRF protection. We do not use third-party advertising cookies.

8. Changes to this policy

We may update this policy from time to time. Material changes will be communicated via email to your registered address.

9. Contact us

BulkWapp
Email: privacy@bulkwapp.com

See also our Terms of Service and Data Deletion Instructions.