Blaster Messaging
Privacy Policy
Blaster Messaging is a web application that lets businesses connect their own WhatsApp Business number through Meta's WhatsApp Business Platform, keep a list of their contacts, create message templates, send messages and campaigns, and read and answer replies. The service is operated by Orena Solutions, Vadodara, Gujarat, India ("we", "us"). This policy explains what information we handle, why, how long we keep it, and how to have it deleted.
1. Who this policy covers
- Customers: businesses that sign up for Blaster Messaging, and the people in those businesses who use it.
- Recipients: the people our customers message on WhatsApp, and who message our customers back.
For recipients' information, our customer is the data fiduciary (data controller) and we act as their data processor: we handle that information only on the customer's instructions and only to provide the service.
2. Information we collect
| Information | Where it comes from | Why we need it |
|---|---|---|
| Account details: name, business name, email address, phone number, login credentials (stored hashed) | The customer, at sign-up | To create and secure the account, and to contact the customer about the service |
| WhatsApp Business Account details: business portfolio ID, WhatsApp Business Account ID, phone number ID, display name, quality rating, messaging limit | Meta, when the customer connects their number through Meta's sign-up window | To send and receive messages for the customer |
| An access token issued by Meta for the customer's WhatsApp Business Account | Meta, after the customer approves the connection | To call Meta's WhatsApp APIs on the customer's behalf. Stored encrypted, never shown in the application |
| Contact lists: names, phone numbers, tags, opt-in status and any other fields the customer uploads | The customer (typed in or imported from a file) | To send the messages the customer chooses |
| Message templates, message content, media, delivery and read status, and replies | The customer, recipients and Meta (delivery status webhooks) | To send messages, show conversations in the inbox and produce delivery reports |
| Usage and technical logs: sign-in times, IP address, browser type, errors | Our servers | Security, troubleshooting and preventing abuse |
| Billing details: plan, invoices, payment status. Card numbers are handled by our payment provider and never stored by us | The customer and our payment provider | To charge for the service |
We do not use Facebook or WhatsApp data for advertising, we do not sell any data, and we do not use recipients' data for any purpose other than providing the service to the customer who sent the message.
3. Data we receive from Meta
When a customer connects WhatsApp, Meta shares with us the IDs of the customer's business portfolio, WhatsApp Business Account and phone number, and an access token. We use the permissions whatsapp_business_management (to manage the customer's WhatsApp Business Account, phone numbers and message templates) and whatsapp_business_messaging (to send messages and read delivery status), and, where the customer allows it, business_management (to read the name and verification status of the customer's business portfolio). We use this data only to provide the features the customer uses, in line with the Meta Platform Terms and Developer Policies.
4. Legal basis and consent
- We process customers' account information to perform our contract with them.
- Customers must have their recipients' consent (opt-in) before messaging them on WhatsApp, as required by WhatsApp's Business Messaging Policy and by the Digital Personal Data Protection Act, 2023. The service records opt-in and opt-out status and stops campaigns to anyone who replies STOP.
5. Who we share data with
We share data only with service providers that help us run Blaster Messaging, under contracts that require them to protect it:
- Meta Platforms (WhatsApp Business Platform), to deliver messages.
- Cloud hosting and database providers (for example Supabase and our server host), to store data and run the application.
- Email delivery provider, to send account and service emails.
- Payment provider, to process subscription payments.
We may disclose information if required by law or a valid order of an Indian court or authority. Data may be stored on servers outside India; we use providers with appropriate security safeguards.
6. How long we keep data
- Account data: while the account is active, and up to 90 days after it is closed.
- Contacts, messages and reports: as long as the customer keeps them, or up to the retention period the customer sets. Deleted items are removed from backups within 30 days.
- Access tokens: deleted as soon as the customer disconnects WhatsApp or closes the account.
- Invoices: as long as Indian tax law requires.
7. Security
Data is sent over HTTPS. Access tokens are encrypted at rest. Each customer's data is separated at the database level so one customer cannot see another's data. Staff access is limited to what is needed to run and support the service, and every sign-in is logged.
8. Your rights
You can ask us to access, correct, export or delete your personal data, or withdraw consent, by emailing contactus@orena.solutions. If you are a recipient of a customer's messages, you can also reply STOP to that business on WhatsApp, or contact that business directly; we will help them act on your request. We reply within 30 days.
9. How to delete your data
See our data deletion instructions. In short: customers can disconnect WhatsApp and delete their workspace in Settings, or email us. People who connected their Facebook account can also remove our app in Facebook Settings, Business Integrations, which tells us to delete the data we received from Meta.
10. Children
Blaster Messaging is a business service and is not meant for anyone under 18.
11. Changes
We will post any change to this policy on this page with a new date, and email customers about important changes.
12. Contact and grievance officer
Email: contactus@orena.solutions
Grievance officer: the person named in reply to your email, within 7 days.