Data Safety and Data Handling

1. Purpose

This page describes how Sendzoy, a product by Ahanya IT Solutions, handles data in its current architecture. It is a product disclosure, not an ISO, SOC, GDPR certification, or government accreditation claim.

2. Multi-tenant isolation

Application queries and authorization checks scope business records to the active organization/workspace. Users only access workspaces they belong to (or platform administrators acting through the Platform Admin portal).

3. Categories of stored data

• User and agent identity data for authentication and RBAC.
• WhatsApp account connection identifiers and status needed for Meta Cloud API calls.
• Contact records and CRM fields you enter or import.
• Templates, campaigns, conversations, messages, and webhook-driven delivery events.
• Messaging balance ledgers, invoices, subscription records, and manual activation audit rows for platform billing.
• Operational logs for webhooks, queues, and API usage.

4. Message and webhook handling

Outbound sends and inbound webhook events are processed to update conversations, statuses, opt-outs, and billing ledgers. Webhook payloads are stored/processed as needed for reliability and troubleshooting. Message content may include personal data of your end customers — you control what you send.

5. Opt-out / STOP

When the product detects configured opt-out keywords (such as STOP) on inbound messages, it marks the contact as opted out and blocks further WhatsApp outreach from the workspace according to current product rules. Administrators may record opt-in only through the product controls where permitted.

6. Security practices (product level)

The Platform uses password hashing, session authentication, role/permission checks, and server-side validation. Hosting hardening, encryption-at-rest configuration, and backup regimes depend on the specific deployment environment and are not asserted as universal guarantees on this page.

7. Customer controls

Limit agent access with roles, review chat history and ledgers inside the product, export messaging balance history where available, and remove contacts you no longer need — subject to retention required for billing disputes and security.