Privacy Policy
Last updated: 26 October 2026
1. Who we are
Jiviko (jiviko.com, the portal at cloud.jiviko.com, and the Jiviko Android app) is a service that lets businesses talk to their customers on WhatsApp. Jiviko is run from India.
Questions about this policy come straight to us. Email: jivikosupport@gmail.com.
2. Two kinds of people, two roles
- Our customers — the businesses that sign up, and the people they give a login to (owners, admins, agents). For the data about their account and their use of Jiviko, we decide how it is used.
- Their contacts — the people a business talks to on WhatsApp. That data belongs to the business. We hold and process it on the business's behalf, only to provide the service to that business, and follow the business's instructions about it. If you messaged a business that uses Jiviko, that business is the one to ask first about your data; we will help it answer you.
3. What we collect
About our customers and their team members
- Account: name, email address, role, whether the email address is confirmed, and when you last signed in.
- Password: never stored as you typed it — only a salted scrypt hash.
- Signing in with Google: if you choose “Continue with Google”, Google tells us your email address, your name, and that Google has verified the address. We store no Google password.
- Sessions: for each sign-in, the IP address and browser details (user agent) it came from, and when the session started and was last used. The same for password-reset requests (IP address).
- The business: its name, the country it signed up from (picked by you, or worked out from your IP address at sign-up — see section 7), its currency, and its WhatsApp Business account details (WhatsApp number, display name, business ID). The WhatsApp access token is stored encrypted.
- Billing: plan, subscription status, and every wallet entry (top-ups, charges, credits), with the payment provider's reference for each top-up. We never receive card or bank details — those are entered on Razorpay's or PayPal's own pages.
- Notifications: if you turn notifications on for a device, the push address your browser gives us for it.
- API keys and webhooks you create: the key's name and a one-way hash of it (we cannot show it again), and the web addresses you ask us to send events to.
- Records of actions: a log of important account actions — including every change made when a Jiviko operator opens your account to help you (section 10).
About the contacts our customers message (held for the business)
- Identity: WhatsApp phone number and WhatsApp ID, the name they show on WhatsApp, and language.
- Messages: what they send the business and what the business sends them — text, captions, pictures, videos, voice notes, documents, stickers, locations they share, contacts they share, reactions, button presses, form answers and orders — plus delivery and read status.
- What the business adds: names, notes, labels, custom fields, lead and pipeline details, appointments, and which team member a conversation is assigned to.
- Leads from other places: when a business connects a lead source (its website, a Google Form, a Google Sheet, a CRM or a marketplace), the details that source sends for each lead.
- Consent: a permanent record of each time the person agreed to or refused messages, by category, with how it was recorded.
- Link clicks: if a business sends a tracked link, when the person clicked it and their browser details. Not their IP address.
- Calls: if the business's number receives WhatsApp calls, the call log (number, direction, duration). We do not record call audio.
- Ads: if the person came from a click-to-WhatsApp ad, the ad's details that WhatsApp passes on.
- Voice-note transcripts, only where switched on (section 5).
- Imported history: if a business connects a number it also uses in the WhatsApp Business app, WhatsApp can share up to 180 days of that app's chat history and its contact list with us, so the conversations continue in Jiviko.
Technical data
- Cookies and browser storage: see section 8. No analytics, advertising or tracking tools are used on our site or app.
- Server logs: our servers log requests, which can include IP addresses and email addresses on sign-in and similar events, for security and troubleshooting.
4. What we use it for
- To run the service the business signed up for: receiving, showing, sending and organising messages; automations and campaigns; lead intake; notifications; reports.
- To follow WhatsApp's rules on the business's behalf — for example, never sending marketing to someone who has not agreed to it, and stopping when they opt out.
- Billing: plans, wallet top-ups, receipts, low-balance and renewal emails.
- Account emails: confirming your address, password resets, a welcome when you are added to a team, and replies to account-deletion requests.
- Security and abuse prevention: rate limits, fraud checks, investigating problems.
- Support, when you ask for it.
We do not sell personal data, use contacts' data for our own marketing, or show advertising.
5. Who else handles it
Data leaves our servers only to these, and only for the reason given:
| Who | What they receive | When |
|---|---|---|
| Meta (WhatsApp Business Platform) | Every message sent and received, media, templates, product catalogues, the business profile, read receipts and typing indicators | Always — WhatsApp is the service |
| Anthropic or OpenAI (or another OpenAI-compatible AI provider chosen by Jiviko) — AI replies | The business's own instructions for the AI, and up to the last 12 messages of that conversation from the last 24 hours. Not the person's phone number or name | Only when Jiviko switches AI replies on for that business, and not for contacts the business has excluded |
| OpenAI — voice transcripts | The whole voice note, to turn it into text | Only when Jiviko switches voice transcripts on for that business |
| Razorpay, PayPal | The amount, currency, a reference, and the business's name; payment details are entered on their pages, not ours | When you add money to your wallet |
| The business's own Razorpay account | The payer's name, phone and email, to create a payment link | Only if the business connects its own store and payments |
| See section 6 | Only if you sign in with Google or connect Google Sheets or Google Forms | |
| Storage for pictures and videos | Contacts' pictures and videos, compressed, and pictures a business uploads to send — kept on our own server or in Cloudflare R2 storage | When media storage is switched on |
| Our email-sending provider | Your email address and the email's content | For the account emails in section 4 |
| Browser push services (Google, Apple, Mozilla — whichever your browser uses) | An encrypted notification they cannot read | Only on devices where you turned notifications on |
| Services the business connects — CRMs, stores, Google Sheets and Forms, its own web addresses (webhooks), and its own apps using our API | Contact details, messages and events the business chose to send | Only what the business sets up; the business is responsible for those services |
| Our hosting provider | Everything, as the place it is stored | Always |
The browser also loads Meta's own code when a business presses “Connect WhatsApp” (Meta may set its cookies then), and Razorpay's checkout when you pay. Some of these providers process data outside India, including in the United States.
We may also disclose data when the law requires it, or to protect the safety of people or of the service.
6. Google user data
Jiviko uses Google in three optional ways, each only when you choose it:
- Continue with Google (sign-in): Google gives us your email address and name. We use them to create or open your account and nothing else.
- Google Sheets: with the permission to reach only the files you choose or create with Jiviko (Google's
drive.filepermission), we write a row for each lead your Automations save to the sheet you picked, and, if you ask, read the new rows of a tab you name so they become contacts. - Google Forms: with the same permission, we read the questions of a form you pick in Google's file picker, or create a form for you in your own Google Drive, and then read that form's new responses so each becomes a contact and a lead in your account.
We store a Google refresh token for your connection, encrypted. We cannot see any other file in your Google Drive. The data we read from Google is used only to provide these features to you: it is not sold, not used for advertising, not used to train AI models, and not shared with anyone except as section 5 describes. You can disconnect Google at any time from the Google Sheets or Google Forms panel in Jiviko, or at myaccount.google.com/permissions.
Jiviko's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
7. Your IP address and your country
To show prices in your currency, we look up the country of your IP address in a database file kept on our own server (from DB-IP). The IP address is not sent anywhere for this. At sign-up, if you do not pick a country, the country from this lookup is saved with your account and decides its currency.
When we have switched it on, we also count visits to jiviko.com and to our sign-in and sign-up pages, so we know how people find us. For each page we keep the page, the site that linked to it, the campaign tags on the link, your country (from the lookup above), the kind of device, browser and system, and how long the page was open. We keep no IP address and set no cookie: a visitor is a code made from your address and browser with a secret that changes every day and is deleted the day after, so a visit cannot be traced back to you, or linked to your visits on another day. If your browser asks not to be tracked (Do Not Track or Global Privacy Control), nothing is sent. Visit records are kept for 400 days.
8. Cookies and browser storage
We use only what the service needs to work. No analytics or advertising cookies.
| Name | Why | How long |
|---|---|---|
wa_portal_session | Keeps you signed in | 30 days after you last used Jiviko on that device (30 minutes when a Jiviko operator opens your account to help) |
wa_google_state | Protects “Continue with Google” and connecting Google from forgery | 10 minutes |
wa_google_signup | Carries the Google-verified address to the sign-up form | 15 minutes |
wa_admin_session | Keeps a Jiviko operator signed in to the console | 24 hours |
Your browser also remembers a few preferences on your device (for example whether the inbox sound is muted). The app saves its own files so it opens quickly and offline, but never your messages.
9. How long we keep data
- Messages, media, contacts, transcripts and records are kept for as long as the business's account exists.
- Consent records and wallet records are never changed or deleted — they are the proof of who agreed to receive messages and of every payment.
- Backups of the database are kept for 14 days.
- Messages waiting to be processed are held in a queue for up to 7 days (30 days for ones that failed).
- When a business deletes a contact, we remove the name, custom fields and labels, but keep the phone number, messages and consent record, so that a person who said “stop” is never messaged again by mistake.
- When an owner asks us to close the account and delete its data, we delete or anonymise it within 30 days of confirming the request, except payment and consent records the law requires us to keep, and backups, which age out within 14 days.
10. Jiviko staff and your account
A small number of Jiviko operators can see account details to run the service. When you ask for help, an operator may open your portal as you for up to 30 minutes. While they do, the portal shows a banner saying so, and every change they make is recorded in a log with their name.
11. Your choices and rights
- Team members can switch notifications off on each device, and change their name and password.
- Owners and admins can export contacts, delete contacts, switch AI replies and automations off for any contact, pause AI replies, switch a team member's login off, and disconnect any connected service.
- Closing your account: an owner can ask for the account and its data to be deleted at cloud.jiviko.com/delete-account. We confirm by email, then delete as section 9 says.
- Contacts of a business: please ask the business first; it controls your data in Jiviko. You can always stop marketing messages by replying STOP (or the words the business has set).
- Your rights: you can ask us to tell you what we hold about you, to correct it, to erase it, and to withdraw a consent you gave; and you can name someone to act for you. Write to us at the contact in section 1 — the person who answers there handles grievances. If you are not satisfied with our answer, you can complain to the Data Protection Board of India.
12. Security
- Everything travels over HTTPS.
- Passwords are stored only as scrypt hashes; session, reset and API keys only as one-way hashes.
- WhatsApp access tokens, connected-service credentials (including Google) and our own service keys are encrypted (AES-256-GCM) with a key kept outside the database.
- Each business's data is separated inside the database itself (row-level security), so one business's request cannot read another's.
- Messages from WhatsApp and payment notices are checked with a cryptographic signature before we accept them.
No system is perfectly secure. If a breach affects your data, we will tell the affected businesses and the authorities as the law requires.
13. Children
Jiviko is for businesses. You must be 18 or older to create an account.
14. Changes to this policy
We post every change on this page and update the date at the top. Before a significant change takes effect, we email the owners of every account.
15. Contact
Jiviko, India. Email: jivikosupport@gmail.com.