Privacy Policy

Draft for testing · Updated 1 October 2026

This policy describes the current test application. The operator must confirm retention periods, service providers and operating arrangements before production use.

ChirpHop is operated by Protologic Solutions Private Limited. For privacy questions or requests, contact kamal@protologicsln.com.

Information processed

• Account and team information: username, email address, display name, password hash, verification records, workspace membership, roles and invitations.
• Messaging data supplied or synchronised by workspace users: contact names and numbers, groups and available participant counts, tags, templates, campaign content, attachments, schedules and recipient selections.
• Operational records: campaign runs, submission outcomes, errors, report snapshots, audit events and tracked-link request counts where link tracking is used.
• Connection information: WhatsApp session credentials for the linked-device connection; for the official API, authorised WhatsApp Business Account and phone identifiers, business/display names, encrypted access tokens and registration status.

How information is used

We process this information to authenticate users, enforce workspace permissions, connect authorised messaging accounts, manage campaigns and templates, execute scheduled work, display results, handle support and protect the service. Workspace members can access shared data according to their assigned roles.

Meta and other providers

When you choose the official API setup, Meta hosts the authorisation flow. ChirpHop exchanges the returned authorisation code on the server and stores the resulting access token encrypted. Meta receives the information needed for the connection and messages you authorise. The linked-device connection is a separate integration and is not the official WhatsApp Business Platform API.

Verification and invitation emails may be sent through the operator's configured email provider. The current HTTPS test site uses Cloudflare Tunnel, which proxies traffic to the operator's computer. Meta, email and network providers process information under their own policies and may process it in other countries.

Storage and security

The test deployment stores application records in SQL Server on the operator's computer. Attachments and linked-device sessions are stored separately on that computer. Account passwords are hashed; official API tokens are encrypted with a separate key. Access is restricted by account and workspace permissions. These measures do not guarantee that every security incident can be prevented.

Cookies

ChirpHop uses an essential login-session cookie. The Meta authorisation flow loads Meta's JavaScript SDK and may use Meta cookies under Meta's policies. This policy does not describe any advertising or analytics cookies as necessary for ChirpHop.

Retention and requests

The test deployment does not yet apply a universal automatic retention schedule to stored workspace records. Records may remain until they are removed through available controls or an administrator processes a request. If backup copies exist, their deletion must also be addressed by the operator; a production backup-retention schedule has not yet been established.

You can request access, correction or deletion by emailing the contact above. See data-deletion instructions for the information to include. Requests concerning shared business records require verification of authority and scope. We will explain any information that must be retained and why.

Workspace responsibilities

Workspace owners are responsible for having permission to upload and use recipient information and message content, and for explaining their own use of that data to recipients. Do not upload information you are not authorised to process.