Last Updated: March 10, 2026 | Effective Date: March 10, 2026
App-ening ("we," "our," or "us"), operated by app-ening.com, provides a web and mobile application platform for managing WhatsApp Business conversations, customer relationships, and messaging automation. This Privacy Policy explains how we collect, use, disclose, and protect your information when you use the App-ening platform, including our web application at app.app-ening.com and the App-ening Business mobile application (collectively, the "Platform").
By using the Platform, you agree to the collection and use of information in accordance with this policy.
Registered Address: A3/245, Manna Farm, Padappai, Tamil Nadu, India 601301
When you create an account or log in, we collect:
The Platform accesses and stores:
To provide inbox functionality, we collect:
When you use appointment and calendar features:
When you connect Google integrations, we access:
See the dedicated "Google API Services" section below for full details.
When you subscribe to paid plans:
We collect:
We automatically collect:
We do NOT collect or track your precise location. Timezone is inferred from device settings for reminder scheduling only.
This section specifically addresses our use of Google API services, in compliance with the Google API Services User Data Policy.
Google API Disclosure: App-ening's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
| Scope | Purpose | When Requested |
|---|---|---|
userinfo.email |
Identify which Google account is connected | Google Sheets/Calendar connect |
userinfo.profile |
Display connected account name | Google Sheets/Calendar connect |
spreadsheets |
Read/write Google Sheets for contact sync | Google Sheets connector setup |
calendar |
Read/write Google Calendar for appointment sync | Google Calendar connector setup |
calendar.events |
Create/update/delete individual calendar events | Google Calendar connector setup |
Google Sheets data is used to:
Google Calendar data is used to:
Google Forms data is used to:
We do NOT share your Google data with any third parties.
We do NOT use your Google data for advertising.
We do NOT use your Google data for training AI/ML models.
Google data is only used to provide the specific integration features you connected.
You can revoke App-ening's access to your Google account at any time:
Your data is stored on:
We implement commercially reasonable security measures to protect your data, which may include encryption, hashing, access controls, monitoring, and other protective mechanisms. HOWEVER, NO METHOD OF TRANSMISSION OVER THE INTERNET OR ELECTRONIC STORAGE IS 100% SECURE. WE CANNOT AND DO NOT GUARANTEE THE ABSOLUTE SECURITY OF YOUR DATA. You acknowledge and accept the inherent risks of providing information online and agree that we shall not be liable for any unauthorized access, data breach, or security incident, except to the extent caused by our gross negligence. You are solely responsible for maintaining the security of your account credentials and devices.
We retain data for as long as reasonably necessary to provide the Platform and fulfill the purposes described in this policy, or as required by law. Approximate retention practices (which may change at any time without notice):
To meet our obligations under the Digital Personal Data Protection Act, 2023 (DPDPA), the General Data Protection Regulation (GDPR), and the Telecom Regulatory Authority of India (TRAI) rules, we maintain dedicated consent records with the following retention practices:
| Consent type | What we keep | Retention |
|---|---|---|
| WhatsApp messaging consent (opt-in / opt-out per contact) |
Current consent status and the time of each suppressed send (when a customer has opted out we record that we blocked the message, not the message itself) | For the life of the contact record. Deleted when the contact is hard-deleted by the tenant or when the account is closed. |
| Voice cloning consent (biometric — speaker's voice) |
The recorded audio of the speaker reading the consent statement; a cryptographic hash of the exact consent text shown; the timestamp, IP address, and browser user-agent at the moment consent was captured; and the version of the consent text in force at that moment. | 7 years from the date consent was captured, in line with the DPDPA standard for sensitive personal data. Retained even after the voice clone itself is archived. |
| BYON (Bring Your Own Number) terms | Timestamp, app version, and the version of the BYON terms accepted by the tenant. | Permanent. Versioned — when terms change we ask the tenant to re-accept and a new record is added. |
| Audit and lead-capture consent (public forms on our marketing site) |
The consent checkbox state, the email address provided, and the marketing attribution at submission. | Until the lead record is deleted on request or as part of a periodic clean-up of stale leads. |
You may at any time exercise your right under the DPDPA (Section 11) and the GDPR (Articles 15 and 17) to request a copy of your consent history or to withdraw consent. Send a request to contact@app-ening.com with the email address associated with your account and we will respond within statutory timelines.
We make no guarantees regarding specific deletion timelines for backup and cache systems and shall not be liable for data retained in backup systems, cached data, or data held by third-party services.
We share limited data with the following service providers, solely to operate the Platform:
| Service | Data Shared | Purpose |
|---|---|---|
| WhatsApp Business API (via Gupshup) | Messages, phone numbers | Message delivery |
| Google Sheets API | Contact data you choose to sync | Spreadsheet sync |
| Google Calendar API | Appointment details | Calendar sync |
| Google Forms API | Form response data | Lead capture |
| Firebase (Google) | Device tokens | Push notifications |
| AWS | All app data | Cloud hosting & storage |
| Razorpay | Payment transactions | Payment processing |
| Sentry | Error/crash data (no PII) | Error tracking |
| PostHog | Usage analytics (anonymized) | Product analytics |
We do NOT sell, rent, or trade your personal information to third parties for marketing purposes.
We may disclose your information if required to:
You can access all your data through:
You can:
You can control notifications via:
Usage analytics can be disabled in Platform Settings > Privacy > Analytics (if available).
Note: Core functionality data (messages, contacts) cannot be disabled without losing Platform functionality.
App-ening is a technology platform and tool. You, the user, are solely and exclusively responsible for:
BY USING THE PLATFORM, YOU AGREE TO INDEMNIFY, DEFEND, AND HOLD HARMLESS APP-ENING.COM, ITS OWNERS, OFFICERS, DIRECTORS, EMPLOYEES, AGENTS, AND AFFILIATES FROM AND AGAINST ANY AND ALL CLAIMS, DAMAGES, LOSSES, LIABILITIES, COSTS, AND EXPENSES (INCLUDING REASONABLE LEGAL FEES) ARISING OUT OF OR RELATED TO:
TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW:
The Platform is not intended for children under 13 years of age (or 16 in the EU). We do not knowingly collect personal information from children. If we discover we have collected data from a child under the applicable age, we will delete it immediately.
Your data may be transferred to and processed in countries other than your own. By using the Platform, you consent to the transfer of your information to the United States and other countries where our servers are located.
We ensure appropriate safeguards are in place to protect your data in accordance with this Privacy Policy and applicable data protection laws (including GDPR for EU users).
If you are a California resident, you have the right to:
To exercise these rights, contact us at privacy@app-ening.com.
If you are in the European Economic Area (EEA), you have the right to:
Legal Basis for Processing: We process your data based on: (a) contractual necessity to provide the Platform, (b) your consent (for optional integrations like Google), and (c) legitimate interest (for analytics and service improvement).
To exercise these rights, contact us at privacy@app-ening.com.
If you are in India, you have the right to:
To exercise these rights, contact our Grievance Officer at privacy@app-ening.com.
We may update this Privacy Policy from time to time. We will notify you of changes by:
Your continued use of the Platform after changes indicates acceptance of the updated policy.
If you have questions or concerns about this Privacy Policy or our data practices, contact us:
| What We Collect | Why | Where Stored |
|---|---|---|
| Email, password | Authentication | AWS (encrypted) |
| WhatsApp messages | Inbox functionality | AWS + local cache |
| Contacts + phone numbers | CRM features | AWS (PII encrypted) |
| Device tokens | Push notifications | Firebase |
| Appointment data | Calendar sync | AWS + Google Calendar |
| Google Sheets data | Contact import/export | Accessed via API (not bulk-stored) |
| Payment info | Billing | Razorpay (not stored by us) |
| Usage analytics | Product improvement | PostHog (anonymized) |
| Error data | Bug fixing | Sentry (no PII) |
We do NOT:
You can:
You are responsible for:
By using App-ening, you acknowledge that you have read and understood this Privacy Policy.
app-ening.com
March 10, 2026
| Version | Date | Changes |
|---|---|---|
| 1.0 | January 31, 2026 | Initial version (mobile app) |
| 2.0 | March 3, 2026 | Expanded to cover web + mobile platform; added Google API Services section (Sheets, Calendar, Forms); added Razorpay, Sentry, PostHog disclosures; added India DPDPA section; strengthened indemnification and liability limitation; added business address |
| 2.1 | March 10, 2026 | Strengthened legal protections: replaced specific technology references with general terms for security measures; added security disclaimer (no absolute guarantee); updated data retention to use flexible timelines; lowered liability cap to lesser of 3 months' fees or INR 5,000; added "WITH ALL FAULTS" and gross negligence clauses; added backup/cache data retention disclaimer; consolidated duplicate policy files into single canonical version |