1. Overview & Scope
Welcome to EngageOriga (referred to as "Origa Automation", "we", "us", or "our"), operated by Origa Network LLP. We provide a multi-tenant software-as-a-service platform that empowers businesses to connect their WhatsApp Business accounts to Meta's official WhatsApp Business Platform (Cloud API), coordinate customer inquiries across shared team inboxes, compose and manage approved message templates, and run compliant broadcast campaigns.
This Privacy Policy explains how we collect, store, process, transfer, and protect your information when you visit our website, register for an account, connect your WhatsApp Business credentials via Meta's Embedded Signup flow, or interact with our software applications and APIs.
Core Privacy Guarantee
We never sell, rent, or monetize your contact lists, messages, or metadata to third-party advertisers. Your data remains strictly isolated in your dedicated workspace.
2. Data Controller vs. Data Processor Roles
Under applicable data protection legislation—including the European Union General Data Protection Regulation (GDPR), the UK GDPR, and the Digital Personal Data Protection Act, 2023 (India DPDP Act)—the legal designation of data depends on the nature of the information:
We act as a Data Controller for your account registration credentials, billing details, workspace member profiles, and direct business communications with us. We decide how this administrative data is stored and processed to maintain your subscription.
You (the business customer) are the Data Controller for your end-customers' WhatsApp phone numbers, chat transcripts, media attachments, and custom attributes. We act exclusively as a Data Processor processing this data strictly on your instructions and in accordance with our Data Processing Terms.
3. Information We Collect
We collect information in three primary categories to deliver the EngageOriga platform effectively:
A. Workspace & Authentication Information
- Business identity: Company name, registered country, website URL, and billing address.
- Team members: Full names, work email addresses, encrypted passwords, avatar images, and assigned role (Owner or Agent) with per-module permission grants.
- Payment data: Transaction receipts and subscription tier status. Payment card numbers are processed directly by our PCI-DSS compliant payment gateways and are never stored on our servers.
B. Meta WhatsApp Cloud API Credentials & Metadata
- Meta IDs: Meta Business Account ID (WABA ID), WhatsApp Phone Number ID, and Business Profile display information.
- Access Tokens: System user tokens and OAuth access tokens granted via Meta's Embedded Signup flow. All tokens are encrypted at rest using AES-256 and are never exposed in front-end client bundles.
- Webhook Signatures: HMAC-SHA256 signature verification keys used to validate incoming events from Meta Graph APIs.
C. Customer Messaging Data (Processed on Your Behalf)
- End-user phone numbers: WhatsApp phone numbers in E.164 standard format and WhatsApp profile names.
- Message content: Inbound and outbound message text, quick replies, call-to-action button clicks, and media references (images, videos, audio, documents).
- Delivery receipts: Timestamps for messages sent, delivered, read, and failed, along with Meta error codes where applicable.
- Templates: Text, headers, variables (e.g. {{1}}), and categories submitted to Meta for approval.
4. Meta WhatsApp Business Platform (Cloud API) Integration
Unlike legacy tools or unauthorized third-party mods, EngageOriga connects solely to the official Meta WhatsApp Business Platform (Cloud API) hosted by Meta Platforms, Inc.
- No unofficial phone scraping, emulators, or web session hacks.
- Full compliance with Meta Developer Policies and WhatsApp Terms.
- All incoming webhooks verified with Meta's SHA-256 secret.
- Immediate access token revocation upon number disconnection.
When a customer messages your WhatsApp Business number, Meta's servers route the encrypted event to our signed webhook endpoints. Once received, our servers decrypt and render the message within your workspace team inbox. When an agent replies, the message is dispatched to Meta's Cloud API over TLS 1.3 encrypted connections.
5. How We Use Information & Legal Bases
We process personal data only when we have a legitimate legal basis under applicable law:
| Purpose of Processing | Data Elements | Legal Basis |
|---|---|---|
| Shared inbox & live team messaging | Phone numbers, message text, media, agent assignment notes | Performance of Contract |
| Template synchronization & approval | Template name, category, language, message variables | Performance of Contract |
| Workspace session security | IP addresses, login timestamps, device/browser information | Legitimate Interests |
| Subscription billing | Selected plan, seat count, company billing address | Legal Obligation / Contract |
6. Security Safeguards & Multi-Tenant Isolation
EngageOriga is architected for multi-tenancy. Every business workspace operates in its own isolated logical environment. There are no shared customer lists, credentials, or message records between distinct tenants.
Isolated by Design
Every SQL query and API route is strictly constrained by workspace ID at the database layer.
AES-256 Token Vault
WhatsApp Cloud API tokens and app secrets are encrypted at rest and never returned in UI responses.
Sanitized Logs
Server and operational telemetry logs are scrubbed to prevent message body or token leakage.
7. Third-Party Sub-Processors
To deliver our cloud services, we engage verified third-party infrastructure providers who adhere to rigorous data protection standards:
- Meta Platforms, Inc. (USA / Ireland): Provides the underlying WhatsApp Cloud API infrastructure, template moderation, and message dispatch.
- Cloud Hosting & Database Partners: Managed cloud instances providing encrypted storage, Redis caching, and automated backups.
- Transactional Email Service: Delivers workspace invitations, password resets, and system security alerts.
8. Data Retention & Automatic Purging
We retain personal data only for as long as necessary to fulfill the operational purposes described herein, or as required by applicable tax, commercial, and regulatory laws:
- Active Subscriptions: Workspace conversations, contact lists, and message templates remain stored as long as your workspace is active and in good standing.
- Disconnected Numbers: When you disconnect a WhatsApp number, access tokens are immediately revoked, and we stop listening to incoming webhooks.
- Workspace Deletion: If you request deletion of your workspace, all team inbox transcripts, contacts, and custom templates are verified and shredded within 30 days.
- Statutory Compliance: Invoices, transaction records, and tax filings are retained for up to 7 years in accordance with Indian commercial and GST requirements.
For complete instructions on requesting immediate data removal, refer to our dedicated Data Deletion Instructions.
9. Your Privacy Rights (GDPR, India DPDP, CCPA)
Depending on your location, you hold statutory rights regarding your personal information:
Request a copy of your personal data and export your contact records in machine-readable JSON or CSV format.
Correct inaccurate or incomplete profile data directly in your workspace settings.
Request deletion of your personal records and WhatsApp conversation history.
Object to processing based on legitimate interests or revoke marketing preferences at any time.
To exercise these rights, submit a request to privacy@engageoriga.com. We respond to all verified inquiries within 30 calendar days.
11. Contact & Data Protection Officer
If you have questions, feedback, or complaints regarding this Privacy Policy or our data protection safeguards, please contact our Data Protection Officer:
Origa Network LLP
Attn: Privacy & Data Protection Office
Product: EngageOriga (Origa Automation)
Email: privacy@engageoriga.com
General Legal: legal@engageoriga.com
First Floor, AAK Building, HMT Junction, Kalamassery, Kochi, Kerala 683104, India.
Committed to user privacy and enterprise-grade security
EngageOriga is proud to be built natively on Meta's WhatsApp Business Platform Cloud API. We adhere strictly to Meta's developer guidelines and international privacy standards.