Privacy Policy

1. Who we are and what this covers

TicAte (“TicAte”, “we”, “us”) provides a WhatsApp Business platform: a shared team inbox, contact records, sales pipelines, message templates, broadcasts and automations, built on the official Meta WhatsApp Business Platform (Cloud API). We are based in Chennai, Tamil Nadu, India.

This policy covers two different relationships, and it matters which one applies to you:

Our use and transfer of information received from Meta APIs adheres to the Meta Platform Terms, the WhatsApp Business Solution Terms and the WhatsApp Business Messaging Policy, including the Limited Use requirements.

2. WhatsApp data we process

When a business connects its WhatsApp Business Account to TicAte, Meta delivers messages and events to us through the Cloud API webhook. Specifically, we receive and store:

2.1 Message content and metadata

• The text of every message sent to or from the connected business number.
• Media — images, documents, audio, video and voice notes — downloaded from Meta and stored in our file storage. Media is served only through short-lived signed links; a raw storage path is never public.
• Message metadata — the Meta message ID, direction (inbound or outbound), timestamp, delivery status (sent, delivered, read, failed), the template used if any, and the message being replied to.
• Emoji reactions and who applied them.
• Conversation state — open, closed, assigned agent, unread count, and the last message preview.

2.2 Contact data

• The end user’s WhatsApp phone number, normalised to E.164 format. This is the core identifier.
• The WhatsApp profile name the end user has set, as supplied by Meta.
• Anything the business adds: name, email address, company, tags, notes written by agents, and custom fields the business defines itself.
• Deals linked to the contact — stage, value and owner — where the business uses pipelines.

2.3 Data imported through Coexistence

Where a business enables Coexistence, Meta transfers recent chat history and the contact list from the WhatsApp Business app on the business’s phone into the platform, so the team sees existing conversations. This import is initiated by the business, is approved on the handset, and is subject to this policy from the moment the data reaches us.

2.4 Business account credentials

We store the WhatsApp Business Account ID, phone number IDs, display numbers, and the access and verify tokens issued by Meta. Tokens are encrypted at rest with AES-256-GCM before they are written to the database and are never returned to a browser or written to a log.

2.5 Business user accounts

For the people who log in: name, email address, hashed password, role (owner, admin or agent), workspace membership, active sessions and login timestamps.

3. What we never do with your data

These are hard commitments, not aspirations:

• We do not sell, rent or licence WhatsApp message content, phone numbers or contact data to anyone.
• We do not use WhatsApp data for advertising, ad targeting, or building advertising profiles.
• We do not use one customer’s data to serve another. Every database query is scoped to a single workspace and re-checked on the server for every request.
• We do not train AI models on your messages or contacts. Where a business enables the AI features, content is sent to that business’s chosen provider for that request only, and we configure those integrations to disable provider-side training where the provider offers that setting.
• We do not read your conversations. Support staff access a workspace only with the business’s explicit, logged permission for a specific issue.
• We do not transfer data to data brokers or enrichment services.

4. Website visitors

Separately from the platform, on ticate.com we collect:

• Enquiry form submissions — the name, company, email address, phone number, team size and message you type in, plus the IP address it came from and the time.
• Server logs — IP address, user agent, page requested and timestamp.
• One session cookie (ticate_session), used solely to protect the enquiry form against cross-site request forgery. It expires when you close your browser.

This website runs no advertising trackers, no analytics pixels and no third-party scripts of any kind. Its fonts are served from our own domain, so loading a page sends your IP address to nobody but us.

5. Why we process it

• To deliver the service — showing a business its conversations, sending the messages it composes, running the automations it built.
• To route and assign conversations to the right agent.
• To report — response times, delivery rates and campaign results, for the business’s own workspace only.
• To keep the service secure — rate limiting, abuse prevention, verifying webhook signatures, and investigating faults.
• To meet legal obligations, including Meta’s platform requirements.

Where Indian law applies, our lawful basis is performance of a contract and our legitimate interest in operating a secure service. Where the EU or UK GDPR applies, our bases are Article 6(1)(b) contract and 6(1)(f) legitimate interests; for the enquiry form, consent.

6. How long we keep it

A business can shorten any of these for its own workspace, and can delete individual conversations, contacts or media at any time from inside the product.

When a workspace is closed, all of its message content, media and contact records are permanently deleted within 30 days. Encrypted backups age out on a rolling 35-day cycle, so a closed workspace is gone from backups within 65 days at the outside.

7. Who we share it with

We share personal data only with the sub-processors below, only for the purpose stated, and only under written terms that hold them to standards no weaker than this policy. There are no other recipients.

We may also disclose data where we are legally required to — a valid court order or binding demand from a competent authority. Where we are permitted to tell the affected business, we will.

If TicAte is ever involved in a merger or acquisition, personal data may transfer to the acquirer. We will give notice before that happens and the data stays subject to a policy at least as protective as this one.

8. Where it is stored

Production data is hosted in India. The table in section 7 lists where each recipient processes data. Meta processes message delivery on its own global infrastructure under its own terms.

TicAte can also be deployed entirely on a customer’s own infrastructure. In that arrangement the customer’s data never reaches our servers at all, and the customer is responsible for its storage and security.

Where personal data covered by the EU or UK GDPR is transferred to India, we rely on Standard Contractual Clauses together with the technical measures in section 9.

9. How we protect it

• Encryption in transit — TLS on every connection, to the browser and to Meta.
• Encryption at rest — WhatsApp access and verify tokens are encrypted with AES-256-GCM before storage; disk-level encryption on the database and file storage.
• Webhook authentication — every inbound Meta webhook has its HMAC signature verified. Forged callbacks are rejected before processing.
• Workspace isolation — every query is scoped by workspace and the caller’s role is re-checked server-side on every request, never trusted from the client.
• Access control — owner, admin and agent roles; sessions are revocable; passwords are hashed, never stored or recoverable in plain text.
• Rate limiting on authentication and message-sending paths.
• Signed media links that expire, so a leaked URL stops working.

No system is perfectly secure. If a breach affects your personal data, we will notify the affected businesses and the relevant authority without undue delay and, where required, within 72 hours of becoming aware.

10. Deleting your data

Full step-by-step instructions, including what we need in order to verify a request, are on our data deletion page.

11. Your rights

Depending on where you live, you may have the right to:

• Access the personal data held about you.
• Correct data that is wrong or incomplete.
• Delete it, as described in section 10.
• Export it in a portable format.
• Object to or restrict certain processing.
• Withdraw consent, where consent was the basis.
• Nominate someone to exercise these rights if you are incapacitated or deceased (India’s DPDP Act).
• Complain to a supervisory authority — the Data Protection Board of India, or your local authority in the EU or UK.

Write to privacy@ticate.com. We respond within 30 days. Where we hold the data as a processor for a business, we will forward your request to that business and tell you we have done so.

12. Children

TicAte is a business tool and is not directed at children. We do not knowingly collect data from anyone under 18. If you believe a child’s data has reached us, write to privacy@ticate.com and we will delete it.

13. Changes to this policy

We update this policy when our practices change. The “last updated” date at the top always reflects the current version. For material changes we notify workspace owners by email at least 30 days before they take effect.

14. Contact us