Privacy Policy

DigiTick is software that businesses use to talk to their own customers on WhatsApp. Two different roles matter here:

• The business using DigiTick decides which customers it messages and why. For those customer conversations, that business is the data controller and Digitoria only processes the data on its instructions.
• Digitoria Marketing Solutions is the controller for the accounts of the staff who sign in to DigiTick, and for the billing record of the subscription.

WhatsApp conversations.Messages sent to and from the business's WhatsApp number, including text, images, video, audio, documents, locations, shared contact cards, reactions and delivery status. Media files stay with Meta; we store the reference and stream them to signed-in staff.

Customer contact details. The WhatsApp phone number, the profile name WhatsApp supplies, any name the business types, tags, notes and custom fields the business chooses to record, and whether the customer has opted out.

Staff accounts. Name, email address and a hashed password. Passwords are stored only as bcrypt hashes and cannot be read back by anyone, including us.

Sign-in records. For each sign-in attempt: the IP address, the approximate city, region and country derived from it, the network operator, the browser user agent and whether the attempt succeeded. This exists so a business can see unauthorised access to its own inbox. It is not used for advertising or profiling.

Notification subscriptions. If a member turns on notifications, the push endpoint their browser issues, so new-message alerts can reach that device.

WhatsApp connection settings.The business's WhatsApp phone number ID, WhatsApp Business Account ID and access credentials, used solely to send and receive on that business's behalf.

• We do not sell or rent any data to anyone.
• We do not use customer conversations for advertising or to train models.
• We do not read one business's conversations from another's account — each business's data is separated and every request is checked against the signed-in user's own business.

• Meta Platforms— WhatsApp messages are delivered through the WhatsApp Business Platform and are subject to Meta's own terms and privacy policy.
• Hostinger — the server and database that run DigiTick.
• ip-api.com / ipwho.is — the IP address of a sign-in is sent to one of these to obtain an approximate city. No name, email or message content is sent.
• Hostinger email — used only to deliver password-reset codes.

Conversations, contacts and settings are kept for as long as the business keeps its DigiTick account, because that history is the product. Technical de-duplication records are discarded after seven days, and IP location lookups are refreshed after thirty days.

When an account is closed, everything belonging to it — conversations, contacts, staff logins, sign-in records and notification subscriptions — is deleted together with it.

• A WhatsApp customer can reply STOP at any time to stop automated messages, and START to resume. This is honoured automatically.
• A business can delete a conversation, a contact, or its entire account. Deletion is immediate and permanent.
• To request a copy of your data, or its deletion, see Data deletion.

All traffic is served over HTTPS. Passwords are hashed with bcrypt. Sign-in attempts are rate-limited per account and per network to frustrate guessing. Access inside a business is controlled by roles, so a member can be prevented from seeing customer phone numbers or conversations that are not theirs.

No government or public authority has ever asked us for user data. If one does, these are the rules we follow, and we follow them every time:

• We check that the request is lawful before we answer it. A request must arrive in writing, name the authority and the officer making it, and cite the law it is made under. A request that does not meet that bar is not acted on.
• We disclose the minimum the law requires.We answer only for the accounts and the time period named in the request. We do not hand over a whole database, a whole business's conversations, or anything the request did not ask for.
• We write every request down. Each one is recorded with its date, the authority, the legal basis cited, who at Digitoria handled it, what we decided and exactly what was disclosed. That record is kept permanently.
• We tell the business, unless we are forbidden to. If data belonging to a business using DigiTick is disclosed, we notify that business — except where the law or a court order prohibits it.

Digitoria Marketing Solutions, Ajmer, Rajasthan, India — digitoria.ajmer@gmail.com. We answer privacy requests within 30 days.