Privacy policy
Draft for owner review. This page is not yet an effective policy. The operator must confirm the legal and operating details before publication.
Navak Digital Connect is operated by Navak Digital LLP. Contact contact@navakdigital.com about privacy, access or deletion. This policy covers our business messaging portal and information processed on our customers’ instructions.
Our role
Business customers choose why and whom they message. They are responsible for their notices, recipient permission and lawful use. We provide the authorized integration. Meta and WhatsApp operate their own services under their terms and privacy policies.
Information handled by this portal
We store workspace names, users’ work email addresses and password verifiers, session records, connected WhatsApp account and phone identifiers, display names, phone numbers and encrypted access tokens. We retrieve templates and send customer-requested template values to Meta. We receive signed webhook events and keep message identifiers, event types, delivery status and event times. This implementation discards message bodies, attachments and recipient details from webhook payloads rather than storing them.
Purposes and sharing
We use this information to authenticate users, connect authorized assets, send requested messages, show activity, prevent abuse and support customers. Tokens and template values are sent to Meta over HTTPS to provide those functions. We do not ask for Meta passwords. This implementation has no AI processing or advertising analytics integration.
The selected portal hosting and database provider is Cloudflare (Workers and D1). Navak also uses Hetzner and Microsoft Azure; before launch the operator must confirm which additional services process portal data, the specific services, processing and backup locations, provider agreements and any additional processors used in the deployed service.
Retention and deletion
The implemented cleanup removes activity metadata after 30 days, sessions after 12 hours and expired signup attempts and rate-limit records. Account records remain until the operator processes an account-deletion request. Disconnecting a connection removes its locally stored token, connection and activity from the application database. Database pages and existing backups require the operator’s secure storage and deletion process; disconnection does not promise erasure from backups.
Before publication, Navak must confirm backup expiry, request response periods, support-record retention and any legally required retention. Meta and customers may retain independent copies. Deletion here cannot remove messages already delivered to recipients.
Security and cookies
The portal uses password hashing, server-side sessions, restricted workspace access, request-origin and CSRF checks, authenticated webhook signatures and encrypted token storage. Production requires HTTPS. Its essential sign-in cookie lasts up to 12 hours. Meta’s SDK loads when Embedded Signup is enabled and uses Meta’s own technology to authorize the connection. No security measure guarantees complete protection.
Your choices and requests
Manage Meta access through your business settings. Email us to request access, correction or deletion, identifying your relationship to the service and the minimum relevant business or account details. Do not send passwords, OTPs, access tokens or full message histories. We may verify authority and coordinate with the business controlling the information. See data-deletion instructions.
Details to confirm before publication
Registered office and responsible privacy/grievance contact; effective date; actual processing locations and transfer arrangements; any additional services, tracking or AI features; backup and support-record retention; request handling periods; applicable age requirements and legal obligations. The deployed practices must match the approved policy.