Headway Automate

Privacy policy

Last updated 16 October 2026

This policy explains how Headway Talent Consulting Pvt Ltd (“Headway”, “we”), Gurugram, Haryana, India, handles information in the Headway WhatsApp Automation Portal. It is written to meet the Digital Personal Data Protection Act, 2023 and Meta’s WhatsApp Business Platform requirements. Have a lawyer review it before launch.

Who is responsible for what

For the account details of businesses that sign up (our clients), Headway is the data fiduciary. For the WhatsApp messages and contact details of a client’s customers, the client is the data fiduciary and Headway processes that data only on the client’s instructions.

What we collect

  • Account data: name, email, password (stored only as a one-way hash), business name, business phone.
  • WhatsApp Business connection data: WhatsApp Business Account ID, phone number ID, display number and an access token issued by Meta (encrypted with AES-256-GCM).
  • Messaging data: phone numbers, profile names, message content and delivery status for chats with the client’s WhatsApp number; leads, bookings and opt-in records.
  • Message templates the client creates (name, language, category, text) and Meta’s approval status for each.
  • Billing data: Razorpay subscription identifiers. Card and UPI details are handled by Razorpay, not stored by us.

How we use it

  • To send and receive WhatsApp messages on the client’s behalf and run the automations the client switches on.
  • To generate AI replies: the customer’s message and the client’s business profile are sent to OpenAI for processing. OpenAI does not use API data to train its models.
  • To show dashboards, send account emails and alerts, bill subscriptions and prevent abuse.

We do not sell personal data and do not use clients’ customer data for our own marketing.

Retention

Message content is deleted automatically 180 days after it is sent or received. Other client data is kept while the account is active and deleted within 30 days of a deletion request.

Security

Data is sent only over HTTPS. WhatsApp access tokens and registration PINs are encrypted at rest with AES-256-GCM and are never shown in the portal or written to logs. Each client can see only its own data, and access to our systems is limited to staff who need it.

Sharing

We share data only with service providers needed to run the service: Meta (WhatsApp Cloud API, acting as a data processor for message delivery), OpenAI (AI replies), Razorpay (payments), our hosting provider in India, and email delivery. Each is bound by its own data protection terms.

Your rights

Clients can download all their data from Settings and delete their account there. Customers of a client can ask that business directly, or write to us and we will forward the request. See Data deletion.

Contact

Grievance officer: Headway Talent Consulting Pvt Ltd, Gurugram, Haryana — privacy@headwaytalentconsulting.com