Privacy Policy

Effective Date: October 10, 2026 · Last Updated: October 10, 2026

Strict Prohibition on Selling or Monetizing Personal Data

B2ZConnect DOES NOT sell, rent, lease, trade, license, or monetize customer personal data, recipient phone numbers, WhatsApp message contents, or communication metadata to third-party ad networks, data brokers, or marketing exchanges under any circumstance.

1. Overview & Architecture Scope

B2Z Connect Software Technologies ("we", "us", or "our", operating B2ZConnect accessible at https://b2zconnect.com, with registered office at 2228/2b, west 3rd street, Pudukkottai, Tamilnadu, India) provides customer engagement, notification middleware, and messaging automation infrastructure. We bridge business management systems, Point of Sale (POS) terminals, ERPs, billing applications, and custom webhooks with official telecommunication and conversational channels, primarily the Meta WhatsApp Business Cloud API and Indian telecom carrier SMS networks.

This Privacy Policy establishes our protocols for handling data collected from registered business clients, authorized administrators, and end-recipient customers receiving transactional updates and support messages.

2. Data Processing Relationship (Controller vs. Processor)

Under global privacy frameworks (including India's Digital Personal Data Protection Act, 2023, and the General Data Protection Regulation):

Entity Role	Primary Entity	Responsibilities & Authority
Data Controller (Data Fiduciary)	The Business Client (Retailer, School, Clinic, Enterprise)	Collects explicit customer opt-in consent; defines messaging content; manages customer relationship; processes end-user opt-out preferences.
Data Processor (Data Processor)	B2ZConnect Middleware Platform	Acts solely upon documented instructions of the Data Controller; executes automated message dispatching; provides live chat customer service window replies; logs delivery status.
Data Controller (Direct)	B2ZConnect Platform Management	Applies strictly to direct business account registration, owner credentials, authentication tokens, and prepaid ledger billing records.

3. Categories of Information We Process

We enforce data minimization, capturing only information essential to operational message delivery:

Business Account Credentials & Profiles: Account owner full name, official business email, mobile phone number, enterprise legal entity name, salted bcrypt password hashes, and prepaid wallet transaction history.
End-User Recipient Contact Information: Recipient mobile phone numbers in international E.164 format (e.g., +919876543210), customer display names, and purchase/order identifiers provided by client integrations.
Transactional Template Parameters: Dynamic message placeholder values (such as bill amounts, receipt URLs, booking appointment dates, loyalty points balances, OTP tokens, or dispatch notices) provided via our secure trigger APIs.
WhatsApp API Data Collection: We collect and process data via the official Meta WhatsApp Business Cloud API strictly to facilitate business communication. This includes: WhatsApp Business Account (WABA) IDs, phone number IDs, verified business display names, profile metadata, messaging quality ratings, and tier limits; customer contact numbers in E.164 format; approved template names and dynamic parameters; inbound and outbound message content; provider message IDs (wamid.xxx); delivery timestamps and status receipts (queued, sent, delivered, read, failed); and customer support live chat transcripts conducted within the 24-hour service window.
Ephemeral Media Data: Inbound media sent by customers (images, PDF documents, voice notes) is streamed on-demand directly from Meta Graph CDN endpoints and cached only in browser session memory for up to 24 hours. We do not store inbound customer media on persistent cloud storage buckets.
Regulatory & Security Metadata: Inbound webhook HMAC-SHA256 signature hashes, TRAI DLT Principal Entity (PE) IDs, approved 6-character Header IDs, and Meta WhatsApp Phone Number IDs.

4. Purpose and Legal Basis of Processing

All data handling operations are grounded in legitimate contractual necessity and statutory compliance:

Contractual Performance: Triggering automated transactional notifications (digital receipts, order confirmations, service alerts) initiated by business software via authenticated APIs.
Customer Support Service: Allowing business agents to converse with customers via two-way WhatsApp live chat within Meta's authorized 24-hour customer care window.
Consent-Driven Campaigns: Distributing opt-in announcements, festive greetings, and utility updates on behalf of the business client.
Regulatory Mandates: Enforcing TRAI DLT compliance (India) and maintaining financial transaction ledgers for prepaid wallet debits and tax invoicing.
Anti-Spam & Opt-Out Tracking: Automatically honoring customer revocation of consent via standardized opt-out keywords.

5. Meta WhatsApp Business Cloud API & Tech Provider Compliance

B2ZConnect operates as an authorized middleware solution leveraging the official Meta WhatsApp Business Cloud API. We adhere strictly to Meta's Platform Terms, Developer Policies, and WhatsApp Business Messaging Policies:

Key Meta Compliance Standards Implemented by B2ZConnect

Zero Third-Party Advertising: WhatsApp data is never utilized for behavioral ad targeting, lookalike audience modeling, or cross-platform data enrichment.
Explicit Customer Opt-In: Business clients certify that recipients have provided prior, affirmative opt-in consent before receiving business-initiated template messages.
Automated Opt-Out (STOP Keywords): Recipients can reply with standard opt-out keywords (STOP, UNSUBSCRIBE, QUIT, CANCEL, OPTOUT). Our webhook pipeline automatically flags the conversation as opted out (has_opted_out = true) and blocks further automated broadcasts.
24-Hour Customer Care Window: Free-form conversational replies can only be sent within 24 hours of a customer-initiated message. Once the window expires, agent input is locked until the customer re-engages or an approved utility template is triggered.
Direct & Solution Partner Provisioning: Support for Meta Embedded Signup where direct clients maintain their own payment relationship with Meta, with zero markup hidden in carrier fees.
HMAC-SHA256 Webhook Verification: Every inbound payload from Meta is cryptographically validated using the app secret signature before processing.

6. Meta Platform & User Data Deletion Instructions

In compliance with Meta Platform Terms (Section 4.b) and user privacy rights, B2ZConnect provides transparent, automated, and manual mechanisms for users to request permanent deletion of their personal data.

Method 1: Automated Meta Data Deletion Callback

B2ZConnect implements a compliant automated data deletion callback endpoint:

Callback URL: https://api.b2zconnect.com/api/v1/webhooks/meta/data-deletion

Signature Verification: When invoked by Meta, our service validates the cryptographic signed_request using HMAC-SHA256.

PII Anonymization: Associated customer PII (name, phone number, email, date of birth) is permanently overwritten with irreversible hashes, and active WhatsApp conversation threads are archived.

Status Tracking URL: A confirmation code and verification URL are returned immediately: https://api.b2zconnect.com/api/v1/webhooks/meta/data-deletion/status?code=<confirmation_code>

Method 2: Remove App via Facebook Settings (For WhatsApp Business Account Owners)

If you connected your WhatsApp Business Account to B2ZConnect via Meta Embedded Signup or Facebook Login, you can delete your data by removing the application:

Log into your Facebook account and navigate to Settings & Privacy > Settings.

On the left sidebar, navigate to Apps and Websites.

Find B2ZConnect in your active application list and click Remove.

Ensure you check the box requesting Facebook to notify B2ZConnect to delete your user data, then click Send Request.

Meta will automatically trigger our Data Deletion Callback, providing you with a status confirmation link.

Method 3: Self-Service Account & Data Deletion in Dashboard

Registered business clients can permanently delete their account and associated tenant data at any time directly inside the platform:

Log into your business console at https://b2zconnect.com/login.

Navigate to Settings > Account Management tab.

Under the Danger Zone / Delete Account section, click Delete Account and confirm your password.

Your tenant account, API keys, CRM directory, and conversation records are immediately queued for permanent sanitization and erasure.

Method 4: Direct Deletion Request via Email

End users, customers, and business operators can also request data or account deletion directly by contacting our Data Protection and Administrative team at admin@b2zconnect.com or privacy@b2zconnect.com. Please include your mobile phone number (with country code) or business tenant identifier. We will acknowledge your request within forty-eight (48) hours and complete data deletion or anonymization within thirty (30) calendar days.

7. Sub-Processors & Infrastructure Providers

Our primary core infrastructure (compute, PostgreSQL databases, and asynchronous message queues) is hosted in India at the AWS Mumbai Data Center (ap-south-1). We engage trusted infrastructure and telecommunications sub-processors bound by confidentiality and Data Protection Addendums:

Sub-Processor	Purpose & Service Scope	Security & Compliance Standards
Amazon Web Services (AWS)	Primary cloud hosting, Amazon RDS PostgreSQL database, and Amazon SQS message queues hosted at AWS Mumbai DC, India (ap-south-1).	ISO 27001, SOC 1/2/3, PCI-DSS Level 1, AES-256 encryption at rest.
Meta Platforms, Inc.	WhatsApp Business Cloud API message routing, delivery verification, and template authorization.	SOC 2, SOC 3, ISO 27001, End-to-end transport encryption.
Razorpay Software Pvt Ltd	Payment gateway processing for business prepaid wallet recharges.	PCI-DSS Level 1 compliant. No card credentials stored by B2ZConnect.
Enterprise SMS Aggregators	Delivery of TRAI DLT-approved transactional and OTP SMS messages across Indian telecom networks.	TRAI TCCCPR 2018 telecom security guidelines.

8. Security Architecture & Multi-Tenant Isolation

We maintain multi-layered technical, administrative, and physical safeguards:

Strict Tenant Isolation: Every database query, queue dispatch, and cache read is scoped strictly by tenant identifier (shop_id). Cross-tenant access is structurally prohibited at the ORM and database engine level.
AES-256-GCM Token Encryption: All Meta WhatsApp access tokens, API secrets, and partner keys are encrypted at rest using AES-256-GCM authenticated encryption.
Zero Token Leakage in Logging: Structured application logging enforces automated wildcard redaction for sensitive fields (tokens, passwords, authorization headers).
Transport Layer Security: All API communication, webhooks, and dashboard interactions mandate TLS 1.3 encryption in transit with HTTP Strict Transport Security (HSTS).

9. Data Retention & Disposal Policy

Personal data is retained only for the duration of the active business engagement:

Chat History & Operational Message Logs: WhatsApp two-way customer chat history, customer conversation threads, dispatch logs, and delivery receipts are retained for three (3) months (90 days) to facilitate customer support follow-ups, billing reconciliations, and dispute resolution, after which they are automatically archived or permanently purged.
Account Closure: Upon account deletion (via Settings > Account Management or written request), customer database profiles and live chat conversations are permanently sanitized or deleted within thirty (30) days.
Statutory Financial Records: Prepaid wallet ledger entries, tax invoices, and GST accounting transactions are preserved for seven (7) years to comply with statutory taxation and auditing laws.

10. Individual Privacy Rights & Statutory Remedies

Under India's Digital Personal Data Protection Act, 2023 (DPDP Act), and applicable global data protection statutes, data principals possess the following rights:

Right to Access & Summary: Request an accessible summary of personal data being processed and the identities of data processors involved.
Right to Correction & Erasure: Rectify inaccurate personal records and request the deletion of obsolete data not mandated by statutory law.
Right to Grievance Redressal: Submit grievances regarding data processing directly to our Grievance Officer before approaching regulatory bodies.
Right to Nominate: Nominate an individual to exercise privacy rights on your behalf in the event of death or incapacity.

11. Children's Privacy

B2ZConnect provides business-to-consumer (B2B2C) customer communication and engagement middleware connecting businesses directly with their customers. Our platform, management console, and messaging tools are intended for use by adult business operators and individuals who are at least 18 years of age.

We do not knowingly collect personal data directly from or target promotional campaigns to children under the age of 18. In scenarios where a business client utilizes B2ZConnect to transmit transactional notifications concerning minors (such as school attendance, academic fee notices, or healthcare appointments), all messages are directed strictly to the verified mobile contact numbers of registered parents or legal guardians, with prior parental consent obtained and managed by the business client.

12. Grievance Redressal Officer & Contact Details

Pursuant to Rule 3(2) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and the Digital Personal Data Protection Act, 2023, the designated Grievance & Data Protection Officer for B2ZConnect is:

Designation	Grievance & Data Protection Officer
Platform / Entity	B2Z Connect Software Technologies
Privacy & Deletion Inquiries	admin@b2zconnect.com / privacy@b2zconnect.com
Support & Phone Contact	support@b2zconnect.com \| 📞 +91 88800 86857
Registered Office	2228/2b, west 3rd street, Pudukkottai, Tamilnadu, India
Response SLA	Acknowledgment within 48 hours; resolution within 30 business days.

Disclaimer: WhatsApp is a registered trademark of Meta Platforms, Inc. B2ZConnect is an independent business communications platform developed using the official Meta WhatsApp Business Cloud API. B2ZConnect is not directly endorsed, sponsored, or affiliated with Meta Platforms, Inc. other than as an authorized technology integration provider.