Privacy Policy

Last updated: August 2026

Vatli (“Vatli”, “we”, “us”, or “our”) is a WhatsApp Business messaging and CRM platform operated by Ixoric Technologies LLC, a company registered in the United States. This Privacy Policy explains what personal information we collect, how we use and protect it, and the rights you have. It applies to our website (vatli.co), our application (app.vatli.co), and related services (collectively, the “Service”).

We are committed to data minimization and transparency. We do not sell your personal information. We comply with the EU/UK General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA/CPRA).

1. Who is responsible for your data

The data controller is Ixoric Technologies LLC. For questions or to exercise your rights, contact support@vatli.co.

2. Information we collect

a) Information you provide

Account data — name, email, password (stored hashed), business name, and role.
Billing data — plan selection and payment details. Card details are handled by our payment processor (Stripe); we do not store full card numbers.
WhatsApp connection data — your WhatsApp Business phone number ID, WhatsApp Business Account ID, and access tokens you authorize, which are stored encrypted.

b) Customer messaging content (processed on your behalf)

When you connect a WhatsApp number, we process the messages, contacts, and media that flow through your account so we can display your inbox, build contact profiles, run automations, and provide analytics. For this content, you are the data controller and Vatli acts as a data processor on your behalf under our Terms.

c) Information collected automatically

Usage & device data — log data, IP address, browser type, and actions taken in the app, used for security and to improve the Service.
Cookies — strictly-necessary cookies for authentication and session security. We do not use advertising cookies.

3. How we use information

To provide, operate, and secure the Service.
To authenticate users and prevent fraud or abuse.
To process payments and manage subscriptions.
To provide support and respond to your requests.
To send essential service and account notifications.
To comply with legal obligations and enforce our Terms.

We do not use your customers’ message content for advertising, and we do not use it to train third-party AI models. Optional AI features run only on the data you explicitly send them, using a provider key you configure.

4. Sharing & sub-processors

We share data only with the following categories of service providers, strictly to run the Service:

Meta Platforms, Inc. — to send and receive messages via the official WhatsApp Business Platform (Cloud API).
Stripe, Inc. — to securely process payments.
Supabase — managed database and authentication infrastructure.
Oracle Cloud Infrastructure — secure cloud hosting of the application.
AI providers (only if you enable AI features with your own key).

We may also disclose information if required by law, to protect our rights, or in connection with a business transfer. We never sell personal information to third parties.

5. Data security

Security is central to how we operate:

Hosted on Oracle Cloud Infrastructure, a leading enterprise cloud provider.
Encryption in transit (HTTPS/TLS) across all connections, enforced with HSTS.
Sensitive tokens are encrypted at rest using AES-256-GCM.
Row-level security isolates each customer’s data (multi-tenant isolation).
Role-based access control and least-privilege service credentials.
Regular updates and security hardening.

No method of transmission or storage is 100% secure, but we work continuously to protect your information.

6. Data retention

We retain account and message data for as long as your account is active. When you delete data or close your account, we delete or anonymize associated personal data within a reasonable period, except where retention is required by law (e.g., financial records).

7. International transfers

We are based in the United States and use infrastructure that may process data in the United States and other regions. Where required, we rely on appropriate safeguards (such as Standard Contractual Clauses) for cross-border transfers.

8. Your rights (GDPR)

If you are in the EU/UK, you have the right to access, correct, delete, restrict, or port your personal data, and to object to certain processing. You may also withdraw consent at any time and lodge a complaint with your supervisory authority. To exercise these rights, email support@vatli.co.

9. Your rights (California / CCPA)

California residents have the right to know what personal information we collect, to request deletion, to correct it, and to opt out of “sale” or “sharing” of personal information. Vatli does not sell or share personal information. See our Do Not Sell My Personal Information page. We will not discriminate against you for exercising your rights.

10. Children’s privacy

The Service is intended for businesses and is not directed to individuals under 18. We do not knowingly collect personal information from children.

11. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be posted here with an updated “Last updated” date.

12. Contact us

Ixoric Technologies LLC
Email: support@vatli.co
Phone / WhatsApp: +91 72809 57078
Address: 30 N Gould St, Ste R, Sheridan, WY 82801, USA.