Privacy Policy

Bluemaru Inc. (“Bluemaru”, “we”, “us”, or “our”) operates a customer relationship management (CRM) platform that integrates with the WhatsApp Business Platform to help businesses manage conversations, contacts, sales pipelines, broadcasts, and automations. This Privacy Policy explains what information we collect, how we use and share it, and the choices and rights you have.

This policy applies to https://bluemaru.in and related services (the “Service”). By using the Service you agree to the practices described here.

Data controller: Bluemaru
Contact: connect@bluemaru.in

• Our customers — businesses and their team members who hold an account and use the Service.
• End customers — the people our customers communicate with over WhatsApp, whose messages and contact details flow through the Service. For end customers, our customer is the primary data controller; we act as a data processor on their behalf.

a. Account information. Name, email address, password (stored hashed), organization details, and preferences you provide when creating or managing an account.

b. WhatsApp Business data. When you connect a WhatsApp Business Account, we process, through Meta’s WhatsApp Business Platform (Cloud API):

• Phone numbers of your business and of the contacts you message;
• Message content (text, images, audio, video, documents, and other media) sent to and from your WhatsApp Business number;
• Message metadata (timestamps, delivery and read status, template identifiers);
• Contact profile information made available by WhatsApp (e.g. display name).

c. Integration credentials. WhatsApp Business Account IDs, Phone Number IDs, access tokens, verify tokens, and two-step verification PINs required to operate the integration. Secrets are stored encrypted.

d. Usage and technical data. Log data such as IP address, browser type, device information, and actions taken within the Service, used for security and reliability.

e. Cookies. We use strictly necessary cookies for authentication and session management. We do not use advertising or third-party tracking cookies. See Section 10.

We use the information to:

• Provide, operate, and maintain the Service, including sending and receiving WhatsApp messages on your behalf;
• Authenticate users and secure accounts;
• Enable features you configure, such as broadcasts, automations, and AI-assisted reply drafting;
• Provide support and respond to your requests;
• Monitor, debug, and improve reliability and security;
• Comply with legal obligations and enforce our terms.

We do not sell your personal data or your end customers’ personal data. We do not use WhatsApp message content for advertising.

If you enable AI-assisted features (reply drafting, auto-reply, playground), relevant message content may be sent to the AI provider whose API key you supply (e.g. OpenAI or Anthropic) to generate responses. Those providers process the data under their own terms; we do not retain a separate copy for model training, and we do not use your data to train our own models. You control whether these features are enabled.

We share information only as needed to run the Service:

• Meta Platforms / WhatsApp — message sending and receiving flows through the WhatsApp Business Platform, subject to Meta’s Privacy Policy and the WhatsApp Business Terms.
• Infrastructure and sub-processors — Hostinger (hosting) and Supabase (database and authentication), which store and process data on our behalf under contractual confidentiality and security obligations.
• AI providers — only when you enable AI features (Section 5).
• Legal and safety — when required by law, regulation, or valid legal process, or to protect rights, safety, and security.
• Business transfers — in connection with a merger, acquisition, or sale of assets, with notice to affected users.

A current list of sub-processors is available on request at connect@bluemaru.in.

We retain personal data for as long as your account is active or as needed to provide the Service. WhatsApp messages and contact records are retained until you delete them or close your account, after which we delete or anonymize them within 90 days, except where longer retention is required by law. Encrypted credentials are deleted when you disconnect an integration or close your account.

We implement technical and organizational measures including encryption of sensitive credentials at rest, encryption in transit (HTTPS/TLS), access controls, row-level security isolating each account’s data, and signed webhooks. No method of transmission or storage is completely secure, but we work to protect your information and to notify you of material breaches as required by law.

Your data may be processed in countries other than your own. Where applicable, we rely on appropriate safeguards (such as standard contractual clauses) for cross-border transfers. Primary hosting region: India.

We use only cookies that are strictly necessary for authentication and keeping you signed in. These cannot be disabled without breaking core functionality. We do not set advertising or cross-site tracking cookies.

Depending on your jurisdiction (e.g. India’s DPDP Act, the EU/UK GDPR), you may have the right to access, correct, delete, or export your personal data, to object to or restrict certain processing, and to withdraw consent. To exercise these rights, contact connect@bluemaru.in. End customers should contact the business they interact with (our customer); we will assist that business as processor.

You may also have the right to lodge a complaint with your local data protection authority.

The Service is intended for businesses and is not directed to children under 16. We do not knowingly collect personal data from children.

We may update this Privacy Policy from time to time. We will post the updated version here and revise the “Last updated” date. Material changes will be communicated through the Service or by email where appropriate.

Bluemaru
Email: connect@bluemaru.in