Last updated: 17 September 2026

This Privacy Policy explains how ZupiChat, a software product owned and operated by Codelith Lab Private Limited ("ZupiChat", "we", "us", "our"), collects, uses, shares and protects information when you use our WhatsApp Business messaging platform available at zupichat.com and related apps (the "Service"). We are committed to compliance with India's Digital Personal Data Protection Act, 2023 (DPDP Act), the EU/UK GDPR where applicable, and applicable UAE data-protection law for our international customers.

1. Who we are & our two roles

Codelith Lab Private Limited (CIN U62091PN2025PTC247887), registered office: Sr No 61/1a, Hari Om Apartment, Lipane Wasti, Ambegaon, Haveli, Pune, Maharashtra 411046, India. ZupiChat is software that businesses use to message their own customers on WhatsApp. On Meta's developer platform, the app that powers ZupiChat is listed under the name Codelith Lab.

For data about you as our customer (your account, billing, usage), ZupiChat is the data controller / data fiduciary. For the end-customer data you process through the platform (your contacts, the people you message on WhatsApp, conversation content), you are the controller / data fiduciary and ZupiChat acts only as your processor / data processor, handling that data on your instructions.

2. Information we collect

• Account & identity: name, business name, email, phone number, and login credentials.
• WhatsApp Business data (data we receive from Meta): when you connect your WhatsApp Business Account to ZupiChat through Meta's Embedded Signup, Meta shares with us your WhatsApp Business Account ID, phone number ID and display number, business profile details, your message templates and their review status, and an access token that lets ZupiChat act on that account. Through webhooks we also receive the messages exchanged between you and your customers and their delivery and read status. Your WhatsApp Business Account and phone number stay owned by you, in your own Meta business portfolio.
• Contacts you upload: phone numbers, names, tags and attributes of the people you choose to message. You confirm you have a lawful basis and valid opt-in to contact them.
• Billing: subscription, wallet balance and transaction records. Card/UPI details are handled directly by our payment gateways and are never stored on our servers.
• Technical & usage: IP address, device/browser type, log data and cookies (see our Cookie Policy).

3. How we use information

• To provide, operate and secure the Service and route your WhatsApp messages through Meta.
• To process payments, manage your wallet and prevent fraud.
• To provide support, send service notices, and improve the product.
• To comply with legal obligations and Meta/WhatsApp platform requirements.

We do not sell your data or your end-customers' data, and we do not use the content of your conversations for advertising.

4. WhatsApp, Meta & Platform Data

ZupiChat is not affiliated with or endorsed by Meta/WhatsApp. Your use of WhatsApp messaging is additionally governed by the WhatsApp Business Messaging Policy and Meta's terms. Message content is transmitted through Meta's Cloud API; Meta processes it under its own terms. We retain message and contact data only as long as needed to provide the Service to you or as required by law.

We use the data we receive from Meta only to provide ZupiChat to the business that connected its account: to show its number and account details, create and sync its message templates, send the messages its own team writes or schedules, and show its customers' replies in its team inbox. Each business can access only its own data.

We do not sell this data, use it for advertising, build profiles from it, or use it to train AI models, and we share it only with the service providers listed in section 6.

You can end our access at any time: disconnect the number inside ZupiChat, or remove the Codelith Lab app from your Meta business settings. See our Data Deletion Instructions.

5. Legal bases & your rights

India (DPDP Act, 2023): we process personal data on the basis of consent or legitimate uses. You may request access, correction, updating, or erasure of your personal data, and may nominate another person to exercise your rights.

EEA/UK (GDPR): where applicable, our legal bases are contract, consent, legal obligation and legitimate interests. You have rights of access, rectification, erasure, restriction, portability and objection.

UAE: for customers in the UAE, we handle personal data consistent with the applicable Personal Data Protection Law.

To exercise any right, contact our Grievance Officer (section 10).

6. Sharing & subprocessors

We share data only with: (a) Meta/WhatsApp, to deliver messages; (b) payment gateways, to process payments; (c) our hosting provider, Contabo Asia Private Limited, whose servers in Singapore run the Service; (d) AI model providers — OpenAI, Google (Gemini) and Groq — only when a business turns on AI replies, and only the message text and that business's own instructions needed to write the reply (questions typed into the assistant on our website are handled the same way); (e) services a business chooses to connect, such as its own Google Dialogflow agent or Razorpay account; and (f) authorities where legally required. All of them are bound by confidentiality and data-protection obligations.

7. Data retention & deletion

We keep account and billing records while your account is active and afterwards only for the period required by tax and legal rules. Conversation, contact and WhatsApp connection data are kept while your account is active.

When you ask us to delete your data or close your account, we revoke ZupiChat's access token for your WhatsApp Business Account immediately, delete your data from our live systems within 7 days, and backup copies are deleted automatically within 30 days. How to ask: see our Data Deletion Instructions.

8. Security

We use encryption in transit (TLS), access controls, and reasonable technical and organisational measures to protect data. Backups are kept on access-restricted storage, and off-site backup copies are encrypted. No method of transmission or storage is completely secure; we cannot guarantee absolute security.

9. International transfers

Our servers are located in Singapore. The service providers in section 6 may process data in other countries, including India and the United States. Where required, we put appropriate safeguards in place for such transfers.

10. Grievance Officer & contact

For any privacy question, request, or complaint, contact our Grievance Officer:

Codelith Lab Private Limited — Grievance Officer
Registered office: Sr No 61/1a, Hari Om Apartment, Lipane Wasti, Ambegaon, Haveli, Pune, Maharashtra 411046, India
Email: business.codelithlab@gmail.com
WhatsApp: +91 86691 17894
We aim to acknowledge complaints within 48 hours and resolve them within the timelines prescribed under applicable law.

11. Children

The Service is intended for businesses and is not directed to children under 18. We do not knowingly collect their data.

12. Changes

We may update this policy from time to time. Material changes will be posted on this page with a new "last updated" date.