Privacy Policy

1. Scope and roles

This policy applies to the Wings Flow website, accounts, workspaces, APIs and support services. For account and service-administration data, Wire Wings acts as the data fiduciary/controller. For contacts, conversations and other information a customer imports or processes through its workspace, the customer determines the purpose and means of processing and Wire Wings generally acts as its processor/service provider.

2. Information we collect

• Account information such as name, business name, email address, authentication identifiers and profile image.
• Workspace information, team membership, role, plan, settings and audit activity.
• Meta and WhatsApp asset identifiers such as Meta Business ID, WABA ID, phone-number ID, display number, verified business name, template metadata and connection status.
• Customer-controlled WhatsApp data, including contact identifiers, profile names, message content and media references, delivery/read status and conversation metadata.
• Consent and suppression records supplied by customers, including opt-in source and timestamps.
• Technical and usage data such as IP address, device/browser information, request logs, error reports and security events.
• Billing and transaction metadata when paid plans are enabled. Payment-card details are processed by the payment provider and are not intended to be stored by Wings Flow.

3. Meta permissions and data

Wings Flow uses Facebook Login for Business and the WhatsApp Business Platform only after an authorized business user starts the connection flow and grants access. The whatsapp_business_management permission is used to discover and manage the customer-selected WhatsApp Business Account, phone numbers, business profile, templates and webhook subscription. The whatsapp_business_messaging permission is used to send and receive messages, retrieve delivery status and handle message media for the connected number. The business_management permission is used to identify and administer business assets explicitly shared with Wings Flow.

• We do not ask customers for their Facebook or WhatsApp passwords.
• Access tokens are stored server-side in encrypted form and are not displayed in the browser.
• We do not sell Meta or WhatsApp data or use message content for unrelated advertising.
• A workspace administrator can disconnect a WhatsApp account, after which Wings Flow stops new API access for that connection.

4. How we use information

• Provide authentication, tenant isolation, WhatsApp onboarding, messaging, inbox, templates, campaigns and automation features.
• Route incoming webhooks to the correct customer workspace and maintain delivery records.
• Secure, troubleshoot, monitor and improve the service.
• Provide support, service notices, billing and account administration.
• Enforce acceptable-use rules and comply with legal obligations.

5. Legal grounds and customer responsibilities

Depending on applicable law, processing is based on performance of a contract, legitimate business interests, consent and/or compliance with law. Customers are responsible for having a lawful basis and valid WhatsApp opt-in before uploading contacts or sending messages, and for honoring opt-outs and applicable messaging rules.

6. Sharing and subprocessors

We share data only as needed to operate Wings Flow, comply with law, protect the service, or carry out a customer instruction. Service-provider categories can include cloud hosting, database and storage, monitoring, email delivery, payment processing and customer support. Meta processes WhatsApp and Facebook data under its own terms and policies. We do not sell personal data.

7. International transfers

Service providers may process data outside the user’s state or country. Where required, we use contractual, organizational and technical safeguards appropriate to the transfer.

8. Retention

We retain account and workspace data while the account is active and for a limited period afterward for recovery, security, dispute resolution and legal compliance. Message and contact retention may be controlled by the customer’s plan or settings. Webhook deduplication, security and audit records may be retained separately for operational integrity. Data is deleted or de-identified when it is no longer required, subject to backups and legal holds.

9. Security

We use tenant-scoped authorization, server-side sessions, encryption in transit, encryption of Meta credentials at rest, webhook-signature verification, access controls, audit logging and operational monitoring. No security measure is infallible; users should protect their credentials and promptly report suspected misuse.

10. Your choices and rights

• Access, correct or export account information.
• Disconnect Meta/WhatsApp assets from the workspace.
• Request deletion of an account or personal data.
• Object to or restrict certain processing where applicable.
• Withdraw consent without affecting earlier lawful processing.
• Contact the relevant data-protection authority if a concern remains unresolved.

11. Children

Wings Flow is a business service and is not directed to children. We do not knowingly permit children to create accounts.

12. Changes and contact

We may update this policy and will post the new effective date on this page. Questions or requests can be sent to contact@wirewings.com with the subject “Wings Flow Privacy Request”. Wire Wings Pvt Ltd is located at S Trade Center, 1st Floor, Near Police Headquarters, Sector 7, Gomti Nagar Extension, Lucknow, Uttar Pradesh, India.