Privacy Policy

1. Introduction

CognitiveSys AI ("we," "our," or "us") operates the WhatsApp Business API management platform accessible at cognitivesysai-app.web.app (the "Service"). This Privacy Policy informs you about our policies regarding the collection, use, and disclosure of personal information when you use our Service.

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

• Email address
• Business name and display name
• Password (encrypted and hashed)
• Account creation and last login timestamps

2.2 WhatsApp Business Account Information

When you connect your WhatsApp Business Account via Embedded Signup, we collect:

• WhatsApp Business Account ID (WABA ID)
• Phone Number ID
• Business phone number
• Display phone number
• Verified business name
• Account quality rating
• Messaging limit tier
• Account status (connected/disconnected)

2.3 Contact Information

When you upload or create contacts:

• Contact names
• Phone numbers
• Contact categories/tags
• Custom metadata you assign

2.4 Usage Data

We automatically collect:

• Campaign creation and status
• Message templates and usage
• Message delivery statistics
• Subscription plan and billing information

3. How We Use Your Information

We use the collected information for:

• Service Provision: To provide and maintain our WhatsApp messaging service
• Account Management: To manage your account and authenticate your identity
• WhatsApp Integration: To connect and configure your WhatsApp Business Account
• Message Delivery: To send bulk messages to your contacts via WhatsApp API
• Analytics: To analyze service usage and improve functionality
• Billing: To process subscription payments via Stripe
• Support: To provide customer support and respond to inquiries
• Compliance: To comply with legal obligations and prevent fraud

4. Data Storage and Security

4.1 Storage Location

Your data is stored using:

• Firebase Firestore: User accounts, WhatsApp configurations, contacts, campaigns
• Firebase Authentication: Login credentials and session management
• Firebase Hosting: Application hosting and static assets

4.2 Security Measures

We implement industry-standard security measures:

• Password encryption using bcrypt hashing
• Secure HTTPS connections (SSL/TLS)
• Server-side API key storage (WhatsApp access tokens never exposed to clients)
• Role-based access control
• Regular security audits and updates
• Firebase security rules for database access control

4.3 Data Retention

We retain your data for as long as your account is active. Upon account deletion, we delete all associated data within 30 days, except where required by law to retain certain information.

5. Data Sharing and Third Parties

5.1 Service Providers

We share data with the following third-party services:

• Meta (WhatsApp): To send messages via WhatsApp Business API
• Google Firebase: For hosting, authentication, and database services
• Stripe: For payment processing (we do not store credit card information)

5.2 Legal Requirements

We may disclose your information if required by law, court order, or government request, or to protect our rights, property, or safety.

5.3 No Sale of Data

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

6. Your Rights and Choices

You have the following rights regarding your data:

• Access: Request a copy of your personal data
• Correction: Update or correct inaccurate information
• Deletion: Request deletion of your account and data (see Data Deletion page)
• Portability: Export your data in a machine-readable format
• Opt-out: Unsubscribe from marketing emails
• Restriction: Request limitation of data processing

To exercise these rights, contact us at: privacy@cognitivesysai.com

7. Cookies and Tracking

We use essential cookies and session tokens to:

• Maintain your logged-in session
• Remember your preferences
• Analyze website traffic and usage patterns

You can disable cookies in your browser settings, but this may affect functionality.

8. Children's Privacy

Our Service is intended for business use only. We do not knowingly collect information from individuals under 18 years of age. If you believe we have collected data from a minor, please contact us immediately.

9. International Data Transfers

Your data may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place to protect your data in accordance with this Privacy Policy and applicable data protection laws.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the new policy on this page and updating the "Last updated" date. Your continued use of the Service after changes constitutes acceptance of the updated policy.

11. Contact Us

If you have questions about this Privacy Policy or our data practices, contact us at: