iMaker Synq Privacy Policy

01 Introduction & Entity Information

Welcome to iMaker Synq (hereinafter referred to as "iMaker Synq", "we", "us", or "our"), an enterprise communication, CRM synchronization, and WhatsApp Business Cloud API middleware service engineered and maintained by iMaker Technologies (registered domain: imaker.in).

This Privacy Policy governs our collection, storage, processing, and deletion of information when businesses, organizations, developers, and their end-user contacts interact with the iMaker Synq application suite, including web applications, backend dispatchers, webhook listeners, mobile companion applications, and integrated API endpoints.

02 Scope of Policy & Role (Processor vs. Controller)

Under international data protection regulations including the EU/UK General Data Protection Regulation (GDPR) and the Indian Digital Personal Data Protection Act, 2023 (DPDP):

• Data Controller: For workspace administrative accounts (e.g., business name, admin email, subscription billing info), iMaker acts as the Data Controller.
• Data Processor: For communications exchanged between our business clients and their end customers over WhatsApp Business Cloud API, Odoo ERP webhooks, and CRM integrations, iMaker Synq acts strictly as a Data Processor operating under the instructions of the business subscriber.

03 Information We Collect

To provide high-throughput API routing and multi-agent customer support, we collect the following categories of information:

A. Account & Registration Data

• Business name, representative name, business physical address, and contact email.
• Authentication credentials, password hashes (salted bcrypt), and multi-factor authorization tokens.
• Billing details (processed via secure, PCI-DSS compliant third-party gateways; we never store raw credit card numbers).

B. Meta & WhatsApp Cloud API Credentials

• WhatsApp Business Account (WABA) IDs, Phone Number IDs, and Meta App IDs.
• Encrypted Meta Graph System User Access Tokens, used exclusively to route messages on behalf of your authorized business number.
• Webhook verification tokens and HMAC secret keys.

C. Message Transmissions & Metadata

• Sender and recipient telephone numbers (e.g., E.164 format: +91XXXXXXXXXX).
• Message payloads: text bodies, template IDs, button selections, and media URLs delivered via Meta Cloud API webhooks.
• Delivery timestamps, status receipts (sent, delivered, read, failed), and error codes.

D. System & Device Telemetry

IP addresses, user agent strings, API latency metrics, and audit log entries generated when your agents access the workspace dashboard or mobile app.

04 How We Use and Process Information

We process information strictly for legitimate commercial and operational purposes, including:

1. Real-Time Message Routing: Forwarding incoming WhatsApp messages to your configured webhook handlers, Odoo ERP endpoints, or multi-agent web inbox.
2. ERP & CRM Synchronization: Syncing customer contact profiles, sales quotations, and delivery alerts between WhatsApp and connected databases (e.g., Odoo, HubSpot).
3. Template Broadcasting: Submitting interactive template messages to Meta for approval and dispatching pre-approved transactional alerts to opt-in recipients.
4. Service Reliability & Security: Identifying spam, preventing webhook replay attacks, and maintaining platform uptime SLAs.

05 Meta / WhatsApp Cloud API Platform Compliance

iMaker Synq strictly adheres to the Meta Platform Terms and the WhatsApp Business Solution Terms:

• We do not transfer or disclose WhatsApp user data to third-party ad networks or data brokers.
• We enforce mandatory opt-in policies for outbound marketing templates in accordance with WhatsApp Business Messaging Policies.
• All Meta API tokens provided during onboarding are stored in encrypted vaults and used strictly to execute customer-initiated messaging.
• We maintain active endpoints supporting Meta Data Deletion callbacks and automated user revocation requests.

06 Third-Party Services & Subprocessors

We engage vetted third-party infrastructure providers to operate the iMaker Synq platform. These subprocessors are bound by stringent confidentiality agreements and Data Processing Addendums (DPAs):

07 Data Retention & Archival Policies

We retain personal information only for as long as necessary to provide the service and satisfy statutory obligations:

• Active Conversation Logs: Retained for 90 days by default to support multi-agent support continuity, after which they are automatically archived or purged according to workspace settings.
• Meta Cloud API Access Tokens: Retained for the duration of your active subscription. Deleted within 24 hours of workspace termination or manual disconnect.
• Financial & Invoice Records: Retained for statutory periods (7 years) to comply with tax and audit laws.
• Encrypted Backups: System snapshots cycle on a 30-day rolling deletion schedule.

08 Data Security Architecture

Security is engineered into every tier of the iMaker Synq stack:

• Encryption in Transit: All HTTP API calls, socket events, and webhooks are encrypted using Transport Layer Security (TLS 1.3).
• Encryption at Rest: Database volumes, access credentials, and customer conversation records are encrypted using AES-256 GCM.
• Webhook Signature Verification: Inbound webhooks from Meta Cloud API are cryptographically verified using SHA-256 HMAC signatures to prevent spoofing.
• Tenant Isolation: Multi-tenant isolation ensures data belonging to one workspace is completely unreadable by any other workspace.

09 Your Privacy Rights (GDPR & DPDP)

Depending on your jurisdiction, you possess the following enforceable data rights:

• Right of Access: Request a full export of your personal information and messaging history.
• Right of Rectification: Request correction of inaccurate or outdated contact profiles.
• Right to Erasure (Right to be Forgotten): Request the permanent deletion of your account and related message logs.
• Right to Restrict or Object to Processing: Revoke webhook routing or WhatsApp message sync at any time.

10 User Data Deletion Instructions

We provide a dedicated, automated self-service portal to execute data deletion in accordance with Meta Platform guidelines and international privacy frameworks.

You can disconnect the app directly via your Facebook Business Settings or submit a request on our Data Deletion Request Page. Deletions are processed within 48 to 72 hours, and a verifiable tracking reference ID is issued upon submission.

11 Cookies & Local Storage

iMaker Synq utilizes essential cookies and localStorage strictly to maintain authenticated user sessions, retain user interface theme preferences (dark/light mode), and prevent cross-site request forgery (CSRF). We do not deploy third-party advertising cookies or behavioral tracking pixels.

12 Contact Information & Data Protection Officer

If you have questions, feedback, or wish to exercise your data rights, please contact our compliance desk:

13 Privacy FAQ