Privacy Policy

1. Information We Collect

1.1 Account Information

• Username, email, phone — provided at registration
• Hashed password — never stored in plain text (bcrypt)
• Generated API key & trigger token — for authenticating your requests

1.2 WhatsApp Session Data

• Connection credentials from WhatsApp's Linked Devices flow (stored encrypted, used only to maintain your active session)
• The phone number linked to each session (visible in your dashboard)
• We do not read, archive, or analyze the content of incoming messages on your linked WhatsApp account beyond what's required to deliver outgoing messages you initiate.

1.3 Message Metadata

• Outgoing messages: recipient phone, slot used, status (sent/delivered/failed), timestamp, and a preview (first 300 chars) for your own dashboard log
• Logs are capped at the most recent 2000 entries per user and rotate automatically

1.4 Payment Information

• Processed entirely by Razorpay — we receive only the order ID and payment confirmation
• We do not see or store your card number, CVV, or UPI credentials

1.5 Usage & Technical Data

• IP addresses for rate-limiting and brute-force protection
• Browser session cookies (httpOnly, signed) — used only for authentication
• We do not use third-party analytics or advertising trackers

2. How We Use Your Information

• To operate the gateway (delivering messages, maintaining sessions)
• To authenticate your dashboard and API requests
• To send transactional notices about your account (subscription expiry, security alerts)
• To prevent abuse (rate limiting, fraud detection, banned-content checks)
• To comply with legal requests (Indian law enforcement requests with valid subpoena)

3. Data Sharing

We do not sell your data. We share it only with:

• Razorpay — for processing your subscription payments (PCI-DSS compliant)
• WhatsApp / Meta — by necessity, since we relay your messages through the WhatsApp network
• Law enforcement — only when legally compelled (valid Indian subpoena)
• Service providers (hosting, monitoring) — bound by data-processing agreements

4. Data Retention

• Account data: kept while your account is active + 90 days after deletion
• Message logs: last 2000 entries per user, auto-rotated
• Payment records: 7 years (Indian tax law)
• Webhook delivery logs: last 500 entries, auto-rotated

5. Your Rights

You can, at any time:

• Export your data (messages, settings) from Settings → Account
• Delete your account (Settings → Account → Delete Account)
• Disconnect any WhatsApp session immediately
• Regenerate your API key / trigger token
• Contact us for any data-related question: support@aumfig.com

6. Security

• All traffic served over HTTPS (TLS 1.2+)
• Passwords hashed with bcrypt (cost 10)
• API keys generated with cryptographically secure random
• WhatsApp session credentials stored encrypted at rest
• Webhook payloads signed with HMAC-SHA256 (if secret configured)

7. Unofficial WhatsApp API Disclaimer

Aumfig API is an unofficial gateway built on the open-source Baileys library. We are not affiliated with, endorsed by, or sponsored by WhatsApp LLC or Meta Platforms, Inc. "WhatsApp" is a trademark of Meta Platforms, Inc.

Using an unofficial API carries inherent risk — WhatsApp may, at any time, suspend or ban accounts that violate their Terms of Service. We provide anti-ban safeguards (rate limits, send windows, jitter) but cannot guarantee your account will remain unbanned. Use responsibly.

8. Children's Privacy

Our service is intended for users 18 years and older. We do not knowingly collect data from anyone under 18.

9. Changes to This Policy

We may update this policy as the service evolves. Material changes will be announced in your dashboard 30 days before taking effect.

10. Contact

Aumfig API
Email: support@aumfig.com
Grievance Officer: support@aumfig.com (response within 7 days as required by Indian IT Rules 2021)