Privacy Policy

Effective Date: 01/04/2025
Last Updated: 25/09/2026

1. Who we are

Weavelinx, Office 513, Sukhwani Boulevard, Baner Sus Road, Pune builds and sells business software, and provides custom web and application development services. In this policy “we”, “us” and “Weavelinx” mean that entity.

Contact: [email protected]

2. What this policy covers

This policy applies to everything we sell and operate, including:

Weavelinx Marketplace (marketplace.weavelinx.com) — digital products such as UI designs, templates, themes and graphics.
Weavelinx CRM — customer relationship management software, licensed to businesses as a WordPress plugin, together with its companion mobile application and its optional call-logging agent.
Weavelinx Property Listing — property listing and enquiry software, licensed to businesses.
Weavelinx messaging services — the shared WhatsApp Business and email messaging capability used by the products above.
Our licensing and feature services (api.weavelinx.com), which authorise licensed software and provide its server-side features.
Custom development services we provide to clients under contract.
Future Weavelinx products that use the same integrations and services described here.

Where a specific product does something unusual, it is named. Otherwise the rules below apply to all of them.

3. When you buy from us or hold an account

Here we are the controller. We collect:

Account and contact details — name, email, and the details you give us.
Billing and transaction data — billing details, payment information, purchases, downloads and payment history. Card details are handled by our payment gateway, Razorpay, and are never stored by us.
Usage data — IP address, browser type, device information and site activity.
Cookies and similar technologies, to keep you signed in, remember preferences and understand how the site is used.

We use this to provide and support what you bought, to take payment, to meet legal and tax obligations, and — where you have not opted out — to tell you about our products.

4. When you license our software

Also as controller, for the licence itself:

Licence and activation data — your licence key, the domain name of each site where the software is activated, and the IP address that domain resolves to at activation.
Validation records — our licensed software checks periodically that its licence is still valid. We log these checks, which tells us that a site is active and roughly how often it is used. We use this to enforce licence terms, to support you, and to understand which customers are actually using what they bought.
Support correspondence, and the diagnostic information you send us with it.

We do not read the contents of your database, your customers’ records, or your messages in order to operate a licence.

5. When our software handles your customers’ data

This is the part that matters most, and the role is different. When a business licenses Weavelinx CRM or Weavelinx Property Listing, that business decides what data it collects about its own customers and what it does with it. The business is the controller. We are a processor acting on its instructions.

In practice, most data our software touches lives in the business’s own database, on the business’s own website. Our services carry it, and in some cases process it on request, but the records are theirs.

5.1 What our software processes, by integration

Integration	Data	Where it is stored
WhatsApp Business	WhatsApp Business Account ID, Phone Number ID, display number, business profile; the access token Meta issues; message templates and their approval status; message text and attachments; sender and recipient phone numbers; the name on the sender’s own WhatsApp profile; timestamps, delivery and read receipts; the number’s quality rating and messaging limit	Conversations in the business’s own database. Connection records and delivery logs on our servers.
Email inboxes	Mailbox credentials, message subjects and bodies, addresses, attachments	Same split as above
Facebook Lead Ads	Page ID and name, Page access tokens, lead form submissions with the contact details the form collects	Forwarded to the connected CRM and retained on our relay only as long as needed to deliver
Enquiry and listing forms	Whatever the business’s form collects — typically name, phone, email, the property enquired about, and consent	The business’s own database
Call logging (optional agent)	Call date, time, direction, duration and the other party’s number, matched against the business’s CRM records; and, where the business has switched it on and the phone’s own dialler has made one, the recording of the call	The business’s own website, in a location not publicly reachable
CRM records	The business’s leads, notes, meetings, follow-ups and deal history	The business’s own database

About call recordings. Our software does not record telephone calls, and cannot — Android does not permit an application to record a call, and we have not tried to work around that.

What some business phones do have is a dialler, built in by the phone’s manufacturer, that records calls when the phone’s owner switches that setting on. Those recordings are ordinary audio files sitting in the phone’s storage.

Where a business chooses to use our optional call-logging agent, and points it at that folder, the agent files those existing recordings against the right customer’s record — so a call that already happened, and was already recorded by the phone, can be found afterwards by the people who need it. The files are uploaded to the business’s own website and stored where the public cannot reach them, and are shown only to staff permitted to see that customer. They are not stored on our servers.

Turning this on is the business’s decision, as is making sure the people on those calls are told. Our licence terms require it, and the agent will not file anything until someone has deliberately chosen a folder for it.

5.2 WhatsApp messaging

Storage. Conversations are stored in the licensed business’s own database. Attachments are stored on that site in a location that is not publicly reachable, and are served only to signed-in users of that business’s software who are permitted to see the relevant record.
In transit. Sending and receiving run through our messaging service at api.weavelinx.com and a private session service that maintains the connection to WhatsApp. Message content is held only in memory while it waits in the paced sending queue — typically seconds to a few minutes — and is discarded once sent. We do not write message text to disk on our servers.
Delivery records. We keep a record of each accepted send — an internal id, the connection, the recipient’s address, the channel, the status and the time. This record does not contain the message. We delete these records after 90 days.
Inbound messages are delivered from our service directly to the business’s own site over a signed webhook, and stored there.
One recipient at a time. Our software has no bulk or broadcast capability. The send interface accepts a single recipient and rejects a list, and messages are released from a rate-limited queue rather than sent in a burst.
Consent and opting out. Marketing templates carry an opt-out. A recipient who replies STOP — or anything our software recognises as a request to stop — is marked opted out and excluded from further marketing messages. Messages a recipient asked for, such as a booking confirmation, are treated separately from marketing.

5.3 Credentials

Access tokens and mailbox passwords a business gives us — WhatsApp, Meta, email — are stored encrypted (AES-256) on our servers. They are never returned to the software on the business’s site, never readable back through our interfaces, and should never be sent to us by email.

6. If you are a customer of a business that uses our software

If a business messaged you on WhatsApp, or you filled in their enquiry form, or they logged a call with you — that business holds your data and decides what happens to it. We process it for them.

To see, correct or delete your data, contact that business. If you contact us instead, we will pass your request to them and confirm when we have done so. We will not change or delete a business’s records on our own initiative except where the law requires it.

7. Automated assistance and AI

Several of our products include an assistant that drafts replies, scores how promising an enquiry looks, and summarises a day’s work.

This only happens when a business turns these features on, and only for the record being worked on. It is not continuous, and nothing is sent in the background.

What is sent, and what is not. Our software first assembles a summary of the single record being worked on, on the business’s own site. Only that summary leaves the site, and it is sent to Google’s Gemini API for processing, with the result returned to the business. Google acts as a sub-processor for this.

We do not send the business’s database, its customer list, or a full message archive, and nothing is sent in the background — only when someone asks for a draft, a score or a summary.

A business can turn this off, in which case nothing is sent for AI processing.
Where a business supplies its own AI provider key, content goes to that provider instead, under that provider’s terms.
We do not use message content to train AI models of our own.

8. Who else sees data

We do not sell personal information. We share it only with:

Razorpay, our payment gateway, to take payment. Card details are handled by Razorpay and are never stored by us.
Meta Platforms — for WhatsApp Business messaging and Facebook Lead Ads.
Google — for the AI assistance in part 7, where enabled.
Analytics providers, for site usage.
Hostinger, who host our websites and the servers running our licensing, messaging and feature services. Those servers are located in India.
Authorities, where the law requires it.

Our own staff access customer data only where needed to provide support, and only with the business’s knowledge.

9. International transfers

Our own servers are in India. Our websites, our licensing and feature services, and the messaging service that carries WhatsApp and email traffic all run on infrastructure hosted in India by Hostinger. Data a business’s software sends us is processed there.

Some data still leaves India, because some of the services our products connect to are operated from outside it:

Meta Platforms — WhatsApp messages are delivered to their recipients through WhatsApp, and Facebook Lead Ads data comes from Meta. Meta processes this on its own infrastructure, under its own terms.
Google — where a business has enabled AI assistance, the summary described in part 7 is sent to Google’s Gemini API.

These transfers happen because they are the only way to provide the service the business asked for: you cannot send a WhatsApp message without WhatsApp. Where we have a choice about what leaves, we send the minimum needed — see part 7.

We keep a record of where data goes and why, and we will update this section if that changes.

10. Retention

Account, billing and tax records — for as long as we must keep them by law.
Licence and activation records — for as long as the licence exists, and afterwards as needed for our own records(1 year).
Facebook lead data on our relay — only as long as needed to deliver it to the connected CRM.
WhatsApp connection records — until the number is disconnected. When a business disconnects a number we delete its connection record and stored access token, and destroy the session.
Message content on our servers — held in memory only, for as long as it takes to send. Never written to disk.
Message delivery records on our servers — 90 days, then deleted automatically.
Data in a business’s own database — for as long as that business keeps it. Deletion is theirs to perform, and nothing in our software prevents it.

11. Security

We use HTTPS for transmission, AES-256 encryption for stored credentials, and access controls so that a business’s staff see only the records they are entitled to. Attachments and call recordings are stored outside publicly reachable locations and served only through checks on who is asking.

No system is perfectly secure, and we do not claim otherwise. If a breach affects your data we will notify you and the relevant authority as the law requires.

12. Your rights

Depending on where you live, you may have the right to access, correct, delete or export your data, to object to processing, and to withdraw consent.

For data we hold as controller (parts 3 and 4), contact us.
For data we hold as processor (part 5), contact the business it belongs to — see part 6.

We process verified deletion requests within 30 days. Requests can be made through our data deletion page (please follow the instructions on our Data Deletion page at: https://marketplace.weavelinx.com/data-deletion-instructions) or by email: [email protected]

13. Children

Our products are sold to businesses and are not directed at children. We do not knowingly collect data from anyone under 18.

14. Changes

We update this policy as our products change. The “last updated” date above shows when. Material changes will be notified to licensees.

15. Contact

If you have any questions, concerns, or requests related to this Policy or your personal information, please contact us at:

Email: [email protected]
Website: https://weavelinx.com

If you are unhappy with how we have handled a request, say so at that address and we will look at it again.