Privacy Policy

Chatyfy is operated by Tesla Online Solution (“we”, “us”, “our”). We provide a software platform that allows spa, salon and wellness businesses to communicate with their customers over the WhatsApp Business Platform — sending appointment reminders, promotional campaigns and service messages, and handling replies through a shared team inbox.

In most cases our customers — the businesses that use Chatyfy — are the data controllers of the customer information they upload and the messages they send. Tesla Online Solution acts as a data processor, handling that information on their instructions. For account and billing information relating to those businesses themselves, Tesla Online Solution is the controller.

You can reach us at any time at teslaonlinesolution@gmail.com.

We collect the following categories of information:

Business account information

• Business or outlet name, city and address.
• Names, email addresses and roles of staff accounts you create.
• Authentication data, including a hashed password or a Google sign-in identifier. We never store passwords in plain text.
• Your chosen subscription plan and usage counts.

Customer contact data you upload

• Customer names and WhatsApp phone numbers.
• Email addresses, where you choose to provide them.
• Tags, segments and custom attributes you add — for example preferred treatment, membership tier or visit history.
• Opt-in status, recording whether a customer has consented to receive marketing messages.

Message content and metadata

• The content of messages sent from your account to your customers.
• The content of messages your customers send to your WhatsApp Business number, which Meta delivers to us by webhook.
• Delivery metadata: sent, delivered, read and failed states, timestamps, Meta message identifiers and error codes.
• Internal notes your staff add to a conversation. These are never delivered to the customer.

WhatsApp connection data

• Your WhatsApp Business Account (WABA) ID and Phone Number ID.
• The access token used to send messages on your behalf. This is stored in a restricted location, is never exposed to a web browser, and is only ever displayed to you in masked form.
• Your message template library and its approval status, as reported by Meta.

Technical data

• Basic request and error logs generated when you use the application, used for security and troubleshooting.
• A locally stored preference recording which outlet you last viewed.

We do not collect payment card details. We do not knowingly collect special category data such as health records, and you should not upload clinical or medical information to Chatyfy.

• To operate the service: delivering your messages to WhatsApp, receiving replies, and presenting conversations in your inbox.
• To show you delivery, read and reply statistics for your campaigns.
• To authenticate users and enforce access control, so each outlet sees only its own data.
• To provide support when you contact us, and to investigate faults.
• To protect the service against abuse, spam and unauthorised access.
• To meet our legal obligations and to comply with Meta's platform requirements.

We do not sell your data. We do not use the contents of your customers’ messages for advertising, and we do not use your data to train machine learning models.

Where data protection law requires a legal basis, we rely on the following:

• Performance of a contract — processing necessary to provide the service you have subscribed to.
• Legitimate interests — securing the platform, preventing abuse and improving reliability.
• Consent — for marketing messages sent to end customers. Obtaining and recording that consent is the responsibility of the business sending the messages.
• Legal obligation — where we must retain or disclose information to comply with applicable law.

Chatyfy is built on the WhatsApp Business Platform provided by Meta Platforms, Inc. When you connect your WhatsApp Business Account:

• Messages you send are transmitted to Meta's Cloud API for delivery. Meta processes them under its own terms and privacy policy.
• Messages your customers send are delivered to us by Meta through a signed webhook. We verify the cryptographic signature on every inbound request and reject anything that fails.
• We use Meta data only to provide the messaging features you have asked for. We do not use it for any independent purpose.
• We do not transfer Meta data to any data broker, advertising network or unrelated third party.
• We retain Meta data only for as long as it is needed to provide the service, and delete it on request as described below.

Our handling of this data is subject to the Meta Platform Terms, the WhatsApp Business Messaging Policy and the WhatsApp Commerce Policy. Where this policy conflicts with those terms in relation to Meta data, the Meta terms take precedence.

Your use of WhatsApp is also governed by Meta’s own privacy policy, which is available on Meta’s website. We have no control over how Meta processes data once it reaches its systems.

Chatyfy runs on Google Cloud infrastructure. Specifically we use Google Firebase services:

• Cloud Firestore stores business accounts, contacts, templates, campaigns, conversations and messages.
• Firebase Authentication stores sign-in credentials and manages sessions.
• Cloud Functions and Firebase Hosting run and serve the application.
• Cloud Storage holds any media you upload, such as template images.

Each business is stored in a separate, isolated area of the database. Access rules are enforced at the database level, not merely hidden in the interface, so one business cannot read another’s contacts, conversations, campaigns or WhatsApp credentials.

Google acts as our sub-processor for hosting and storage, and processes data under its own security and privacy commitments.

We share data only in these circumstances:

• Meta Platforms, Inc. — message content and recipient numbers, in order to deliver your messages over WhatsApp.
• Google Cloud / Firebase — as our hosting, database and authentication provider.
• Within your own business — staff accounts you create can see the conversations and contacts of the outlet they are assigned to.
• Legal requirements — where we are required by law, court order or a valid request from a competent authority.
• Business transfer — if Tesla Online Solution is involved in a merger, acquisition or sale of assets, data may transfer to the successor entity under the same protections. We will notify you before this happens.

We do not sell, rent or trade personal data, and we do not share it with advertisers.

• All traffic to and from the application is encrypted in transit using HTTPS/TLS. Data is encrypted at rest by Google Cloud.
• Database access rules enforce strict separation between businesses, so a request for one business's data returns nothing from another.
• WhatsApp access tokens are held in a restricted store, are never sent to a web browser, and are shown only as the last four characters.
• Inbound webhooks from Meta are authenticated by verifying a cryptographic signature over the exact request payload. Unsigned or altered requests are rejected.
• Administrative operations require a verified identity and are checked against server-side records, never against values supplied by the browser.
• Access to production systems is limited to authorised personnel.

No system can be guaranteed completely secure. If we become aware of a breach affecting your data, we will notify you without undue delay and, where required, notify the relevant supervisory authority.

• Contacts, conversations, messages, templates and campaign records are retained for as long as your account is active.
• If you close your account, we delete or irreversibly anonymise your data within 90 days, except where we must retain records to meet a legal obligation.
• Deletion requests are actioned within 30 days — see our Data Deletion page for the full procedure.
• Backups are retained for up to 30 days and are then overwritten on a rolling basis. Data deleted from the live system is removed from backups within that window.
• Basic security and audit logs may be retained for up to 12 months.

Depending on where you live, you may have some or all of the following rights over your personal data:

• Access — obtain a copy of the personal data we hold about you.
• Correction — have inaccurate or incomplete data corrected. Most information can be edited directly in the app.
• Deletion — request erasure of your data. See our Data Deletion page.
• Restriction and objection — ask us to limit or stop certain processing.
• Portability — receive your data in a structured, machine-readable format. Contacts can be exported to CSV from within the app at any time.
• Withdraw consent — where processing relies on consent, withdraw it at any time without affecting prior processing.
• Complain — lodge a complaint with your local data protection authority.

To exercise any of these rights, email teslaonlinesolution@gmail.com. We respond within 30 days and will not charge a fee for a reasonable request. We may ask you to verify your identity first.

If you received a WhatsApp message from a business using Chatyfy and you want your data removed, you have two routes:

• Reply STOP to the WhatsApp conversation. This immediately opts you out of marketing messages from that business.
• Email teslaonlinesolution@gmail.com with the phone number concerned and the name of the business. We will pass the request to that business and, where we are able to act directly, delete the data ourselves.

Because the business — not Tesla Online Solution — decides what customer data to collect, we may need to direct part of your request to them. We will tell you if that is the case.

Chatyfy does not use advertising cookies, tracking pixels or third-party analytics profiling. We use only what is necessary to run the service:

• A session cookie or token set by Firebase Authentication to keep you signed in.
• Browser local storage recording which outlet you last viewed, so the app opens where you left off.

Clearing your browser storage will sign you out and reset that preference. It will not delete any data held in your account.

Chatyfy is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under the age of 18, and accounts may only be created by adults acting for a business.

Businesses using Chatyfy must not upload contact details of children, or send marketing messages to them, without the verifiable consent of a parent or guardian and in accordance with applicable law. If we become aware that we hold data relating to a child collected without proper consent, we will delete it promptly. If you believe this has happened, contact us at teslaonlinesolution@gmail.com.

Tesla Online Solution is based in India. Our infrastructure providers, Google and Meta, operate globally, and your data may be processed in countries other than your own — including the United States.

Where data is transferred out of a jurisdiction that restricts such transfers, we rely on the safeguards offered by those providers, including standard contractual clauses and their own compliance programmes.

We may update this policy as the service evolves or as legal requirements change. The effective date at the top of this page always reflects the current version.

If we make a material change — for example, a new category of data or a new recipient — we will notify account holders by email or through the application before it takes effect. Continuing to use Chatyfy after a change takes effect means you accept the revised policy.

For any question about this policy, about how your data is handled, or to exercise your rights: