Privacy Policy

Tabli is operated by Digital Nexus Media Pvt. Ltd. (“Tabli”, “we”, “us”). There are two different relationships to be clear about, because they carry different responsibilities.

When you are our customer — you sign up, run a business workspace and pay us — we are the data controller for your account information. This policy governs that directly.

When our customer messages their own customers through Tabli, we are a data processoracting on that business’s instructions. The business decides who to message and why; we only provide the software. If a business contacted you on WhatsApp and you want your data corrected or deleted, that business is your first point of contact, though we will always help them act on your request.

Account data

Your name, email address, password (stored only as a bcrypt hash — we never keep the plain text), optional phone number and profile picture link, your role and permissions, your team and availability status, and the business name, industry, country, timezone and currency you enter.

WhatsApp data, processed for the business

When a business connects its WhatsApp Business number, we process the messages sent and received on that number: message content, media (images, video, audio, documents), timestamps, delivery and read status, and the phone number, WhatsApp profile name and profile picture of the people messaging. We also store contact records the business creates or imports — names, phone numbers, email addresses, tags, custom attributes and opt-in status — and the CRM records linked to them, including lead status, notes, tasks, appointments and recorded payments.

Connection credentials

Access tokens issued by Meta, WhatsApp Business Account and phone number identifiers, and any two-step verification PIN used to register a number. These are encrypted at rest and are never displayed in full in the interface or sent to a browser.

Billing data

Prepaid wallet balance, message usage counts and costs, and transaction history. If you pay online, the payment itself is handled by our payment provider — we never see or store your full card number, UPI PIN or bank credentials.We keep only the provider’s payment and order references.

Technical data

API request logs (with credentials redacted), webhook events received from Meta, background job records, audit logs of significant actions, and IP addresses attached to those records.

We do not use advertising cookies or third-party tracking scripts. The only cookies we set are the ones that keep you signed in and remember which business workspace you are viewing.

• To run the service: deliver and receive WhatsApp messages, show your inbox, send broadcasts, run automations and produce reports.
• To authenticate you and enforce roles and permissions.
• To meter usage and bill you accurately, and to warn you before your balance runs out.
• To keep the platform secure and diagnose faults — this is what the audit, API and job logs are for.
• To notify you about things that need attention: a new message, a finished broadcast, a rejected template, a disconnected number.
• To support you when you contact us.

We do notsell personal data. We do not use your customers’ WhatsApp messages to build advertising profiles, and we do not use your business data to train machine learning models.

If a business turns on the optional AI assistant, the text of the relevant conversation is sent to the AI provider configured for that platform in order to draft a reply. That is a choice the business makes and can switch off at any time.

Tabli is built on the official WhatsApp Business Platform. When a business connects its number, message delivery is carried out by Meta, and Meta’s own terms and privacy policy apply to that processing in addition to ours.

Businesses using Tabli must have a lawful basis to message the people they contact, must honour opt-outs, and must comply with the WhatsApp Business Messaging Policy. Tabli automatically records opt-outs when someone replies STOP and excludes those contacts from future broadcasts, but the responsibility for lawful messaging rests with the business.

Tabli is not endorsed by, certified by, or affiliated with Meta Platforms, Inc.

We share data only with the providers needed to run the service:

• Meta Platforms — to send and receive WhatsApp messages and manage templates.
• Our hosting provider — the servers and database that run Tabli.
• Our payment provider — to process wallet top-ups. They receive the payment details you enter directly with them.
• Our email provider, where configured — to deliver notification and invitation emails.
• An AI provider, only if the business enables the AI assistant.

We may also disclose data where the law requires it, or to establish or defend legal claims. If Tabli is ever involved in a merger or acquisition, we will tell you before your data becomes subject to a different privacy policy.

• Conversations, contacts and CRM records — for as long as the business keeps its account, because they are the business’s working records. Disconnecting a WhatsApp number does not delete message history.
• Technical logs — API request logs, processed webhook events and completed background jobs are automatically deleted after 30 days.
• Billing records — retained as long as tax and accounting law requires.
• After account closure — we delete or anonymise account data within 90 days, except where we must keep records to meet a legal obligation.

• All traffic is served over HTTPS.
• Passwords are stored as bcrypt hashes and are never recoverable in plain text.
• Meta access tokens, webhook signing secrets and verification PINs are encrypted at rest with AES-256-GCM.
• API keys are stored only as hashes; the full key is shown once at creation and never again.
• Incoming webhooks are signature-verified before being processed, and unsigned requests are rejected.
• Access inside a workspace is limited by role and per-user permissions, and each business’s data is isolated — one business can never read another’s messages, contacts or billing.
• Significant actions are written to an audit log.

No system is perfectly secure. If a breach affects your personal data, we will notify you and the relevant authority as required by law.

Subject to the law that applies to you — including India’s Digital Personal Data Protection Act, 2023, and the GDPR where relevant — you can ask us to:

• access the personal data we hold about you;
• correct it if it is wrong or incomplete;
• delete it, where we have no overriding obligation to keep it;
• export it in a portable format;
• restrict or object to certain processing; and
• withdraw consent you previously gave, without affecting what was done beforehand.

Write to support@tabli.in and we will respond within 30 days. You also have the right to complain to your data protection authority.

If you received a WhatsApp message from a business that uses Tabli, that business — not Tabli — decided to contact you and controls your data. To stop receiving messages, reply STOPto the conversation. That is recorded immediately and the business’s future broadcasts will exclude you.

To have your data corrected or erased, contact the business directly. If you cannot reach them, write to us at support@tabli.in and we will pass the request on and support them in acting on it.

Tabli’s servers and database are hosted with our infrastructure provider, and data is stored there. Some of our providers — including Meta — operate globally, so data may be processed outside your country. Where that happens, we rely on the safeguards those providers offer for international transfers.

Tabli is a business tool and is not intended for children. We do not knowingly create accounts for anyone under 18. If you believe a child’s personal data has reached us, contact us and we will delete it.

We may update this policy as the product changes. The date at the top always reflects the current version. If a change materially affects how we handle your data, we will tell you by email or with a notice inside the app before it takes effect.

Questions about this policy, or about the data we hold, go to support@tabli.in.

Digital Nexus Media Pvt. Ltd. · Bareilly, Uttar Pradesh, India