Effective date: 30 June 2026
Corbital Technologies LLP ("WhatsMark", "we", "us", or "our") operates https://whatsmark.io
and the WhatsMark platform (the "Service"), a cloud-based platform for automating and managing
WhatsApp marketing and communication. This Privacy Policy explains how we collect, use, disclose, and
safeguard your information when you use the Service, in accordance with the Digital Personal Data
Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000, and applicable rules.
By using the Service, you consent to the practices described in this Policy.
1.1 Who we are (Data Fiduciary)
For the purposes of the DPDP Act, Corbital Technologies LLP is the Data Fiduciary in respect of
account and billing data of our customers. For end-customer contact data that our customers upload and
message through the Service, our customer is the Data Fiduciary and WhatsMark acts as a Data
Processor on their behalf.
office email: — [email protected]
1.2 Information we collect
a) Information you provide:
Account & identity data: name, business name, email, phone number, password.
Billing data: billing address, GSTIN/tax ID, country, and payment-method details (processed by our
payment gateways — including Paddle and Razorpay for international/USD payments — we do not store full card
numbers).WhatsApp connection data: WhatsApp Business Account (WABA) IDs, phone-number IDs, access tokens,
and business profile information you connect to the Service.Content you create: campaigns, message templates, automation flows, and contact lists you upload.
b) End-customer data you process through WhatsMark: contact names, phone numbers, attributes,
custom fields, conversation history, and message delivery/read status. You are responsible for having a
valid lawful basis and opt-in consent for every contact you upload (see the Fair Use Policy).
c) Information collected automatically: IP address, device and browser type, operating system,
log data, usage analytics, and cookies (see our separate Cookie Policy).
1.3 How we use your information
To provide, operate, secure, and maintain the Service;
To process subscriptions, payments, taxes (GST), and invoices;
To connect and synchronise your WhatsApp Business Account via Meta's APIs;
To send transactional and service communications (and, where you opt in, product updates);
To provide support, prevent abuse and fraud, and enforce our Terms and Fair Use Policy;
To comply with legal obligations and lawful requests from authorities.
1.4 Legal bases (DPDP Act)
We process personal data on the basis of your consent, and where applicable for the performance
of our contract with you, compliance with law, and our legitimate certain legitimate uses as
permitted under the DPDP Act. You may withdraw consent at any time (see "Your rights").
1.5 WhatsApp / Meta platform data
The Service operates on top of the WhatsApp Business Platform provided by Meta. When you connect
your WABA:
Your use of WhatsApp is additionally governed by Meta's WhatsApp Business Terms, WhatsApp Business
Messaging Policy, and Commerce Policy.Messages, templates, and media you send are transmitted to and processed by Meta on Meta's
infrastructure, which may store data in data centres outside India. We do not control Meta's
processing.We access Meta APIs only to the extent needed to deliver the Service and in compliance with Meta's
Platform Terms and Developer Policies.
1.6 How we share information
We do not sell your personal data. We share it only with:
Service providers / processors — hosting, payment gateways, email/SMS delivery, analytics, and
customer-support tools, bound by confidentiality and data-protection obligations;Meta — as required to deliver WhatsApp messaging;
Legal / regulatory authorities — where required by law, court order, or to protect rights and
safety;Business transfers — in connection with a merger, acquisition, or sale of assets, with notice.
1.7 Data retention
We retain personal data for as long as your account is active and as needed to provide the Service,
then for the period required to comply with legal, tax, and accounting obligations. On account
deletion, we delete or anonymise personal data within a reasonable period, subject to residual copies
in secure backups that are purged on a rolling schedule.
1.8 Data security
We employ industry-standard safeguards including encryption in transit (HTTPS), encryption of
sensitive credentials at rest, access controls, and regular security reviews. No method of transmission
or storage is 100% secure, and we cannot guarantee absolute security.
1.9 Your rights (DPDP Act)
Subject to the DPDP Act, you have the right to:
Access a summary of the personal data we process about you;
Correct, complete, update, or erase your personal data;
Withdraw consent at any time;
Nominate another person to exercise your rights in the event of death or incapacity;
Grievance redressal — raise complaints with our Grievance Officer.
To exercise any right, contact [email protected]. If unsatisfied, you may complain to the Data
Protection Board of India.
1.10 Children
The Service is not directed to individuals under 18. We do not knowingly process the personal data of
children. Where required, processing of a child's data will only occur with verifiable parental/guardian
consent as mandated by the DPDP Act.
1.11 Changes to this Policy
We may update this Policy from time to time. Material changes will be notified via the Service or email.
Continued use after changes take effect constitutes acceptance.
General privacy queries: [email protected].