Privacy Policy

When you register for or use Pingly:

• Identity: Full name, email address, password (bcrypt-hashed, never stored in plaintext), role
• Organisation: Company name, workspace name, business hours, timezone
• Integration credentials: WhatsApp Business API keys (Gupshup), AI API keys (Anthropic Claude, OpenAI GPT) — all stored AES-256 encrypted
• Billing profile: Company name, billing address, GST number, contact email (for invoice delivery)

When businesses use Pingly to communicate with their customers, we process:

• Contact profiles: Name, phone number, email, tags, opt-in/opt-out status, custom attributes, WhatsApp profile picture URL (if fetched), WhatsApp Business profile data (category, website, description — if applicable)
• Conversation messages: Text content, images, documents, audio/voice notes, videos, stickers, locations, contact cards (vCards), message timestamps, delivery/read receipts
• WhatsApp status: Delivery ticks (sent/delivered/read) and message status updates from WhatsApp
• CSAT ratings: 1–5 star ratings and optional text feedback submitted by end-users
• Web Chat sessions: Visitor name, email, phone (from pre-chat form); chat messages; session identifiers; browser user-agent (for display only)
• Support tickets: Ticket subject, description, status, priority, linked conversation data
• Sales leads: Lead name, phone, email, requirement, budget, pipeline status, notes

If you upload documents (PDFs, Word files, text) to the Pingly Knowledge Base for AI bot training, those documents are stored in our infrastructure and may be processed by the AI provider you select (Anthropic or OpenAI) when the AI bot generates responses. You are responsible for ensuring you have the right to upload and process any documents you provide.

When you submit the Enterprise Plan enquiry form at /enterprise, we collect: company name, contact name, work email, phone, team size, use case description, payment preference, and net payment terms. This data is used solely to respond to your enquiry and is visible only to Samcom Technologies's sales team and Super Admin users.

• Server logs: IP addresses, browser type, OS, pages visited, timestamps, HTTP response codes
• Session tokens: JWT authentication tokens stored in browser localStorage (see Section 12)
• Usage metrics: Feature usage patterns, API call volumes, error rates — aggregated, not individually identifiable
• WebSocket connection data: Real-time event delivery for inbox, notifications, and presence features

If you connect external systems via Contact Sync or API webhooks, we may receive data from those sources. You are responsible for ensuring lawful transfer of that data into Pingly.

A Workspace Administrator may create keyword rules that watch the WhatsApp groups their workspace already receives — for example, flagging a message containing "looking for" or "quotation" as a possible sales enquiry. This feature is off unless a rule is created; no group is scanned by default, and only groups the workspace has already opted to receive messages from are ever considered.

When a message matches a rule we record:

• A short excerpt of the matching message (capped at 300 characters) — not the conversation
• The keyword that matched, and which group it was seen in
• A reference to the sender, where WhatsApp has made that identity available to the workspace
• The time it was recorded

Where this feature is used, the Workspace Administrator is the Data Fiduciary for the people whose messages are flagged, and is responsible for having a lawful basis to contact them and for honouring their rights. Samcom Technologies acts as a data processor. If you believe a business has flagged your message from a WhatsApp group and you want it removed, contact that business, or write to us at support@samcomtechnologies.com and we will assist them in acting on your request.

When you use the WhatsApp Business API integration, messages are delivered through Gupshup(an authorised Meta Business Solution Provider). In this model:

• Message content passes through Gupshup's infrastructure on its way to and from WhatsApp
• Inbound WhatsApp voice calls are detected and can be routed to your VOIP PBX or AI Voice Agent
• Template messages sent to contacts are subject to Meta's WhatsApp Business Policy
• Gupshup's Privacy Policy applies: gupshup.io/privacy-policy

WhatsApp Direct connects your personal WhatsApp number to Pingly using an open-source library (Baileys). This is a non-official integration and is not affiliated with or endorsed by Meta Platforms, Inc.

In this model, Pingly processes:

• Session credentials: Encrypted WhatsApp session keys stored in our database, required to maintain the connection
• Message content: All inbound and outbound messages on the connected number, stored in your workspace's conversation inbox
• LID (Linked Device) map: A mapping of WhatsApp's internal identifiers to phone numbers, stored per workspace for privacy-mode resolution
• Historical chat sync: When you first connect via QR, WhatsApp may deliver recent message history (typically last 50–100 chats). Pingly ingests these into your inbox and stores them as conversation records
• Contact profile pictures: Fetched from WhatsApp and cached (refreshed every 7 days) as profilePictureUrl on Contact records
• Call notifications: When a customer calls your WhatsApp number, Pingly records the call event (caller JID, timestamp, duration if available) in the conversation timeline. Note: WhatsApp Direct does not route or connect voice calls — it shows notifications only.
• WhatsApp Groups (if enabled): Group JID, group name, participant list, and group messages — stored only if the "Receive group messages" setting is enabled by the workspace admin

Data for WhatsApp Direct sessions is stored only within your workspace and is not shared with Gupshup or any BSP. It is transmitted between your linked phone and our server using WhatsApp's own end-to-end encryption (E2EE).

• Call event log: Caller phone number, timestamp, call duration, call status (answered / missed / rejected), and agent who answered
• VOIP routing records: Which SIP trunk or extension the call was routed to, and the outcome
• AI Voice Agent transcripts: If an AI Voice Agent handles the call, the transcript of the conversation is stored in the conversation timeline — linked to the caller's Contact record
• Missed-call auto-reply log: A record of the WhatsApp message automatically sent to a caller who was not answered

Pingly itself does not record voice calls. Recording, if any, is performed by your VOIP PBX or SIP provider and is governed by that provider's policies. You are responsible for informing callers of any recording in accordance with applicable law (e.g., Indian Telegraph Act, TRAI regulations).

When agents use the browser-based SIP WebPhone feature, the browser establishes a WebRTC/SIP connection directly to your configured SIP server. Pingly does not proxy or record audio streams; it only manages the signalling (call state, routing instructions).

For WhatsApp Direct workspaces, Pingly stores only the call notification event (caller, timestamp, missed/answered status). No audio, no routing, no AI agent is involved. The notification appears in the conversation timeline so agents are aware a call was attempted.

When the AI chatbot feature is enabled, Pingly sends the following to your chosen AI provider (Anthropic Claude or OpenAI GPT) to generate a response:

• The last 20 messages of the conversation (as context window)
• Relevant excerpts from your Knowledge Base documents (vector-matched to the query)
• The system prompt you configured
• The incoming customer message

• Anthropic (Claude): anthropic.com/privacy
• OpenAI (GPT-4o): openai.com/policies/privacy-policy

Pingly does not use your conversation data to train its own AI models, and we never use a shared platform key that could mingle your data with other customers — the AI features run on API keys you supply from your own account with the provider.

Before you enable AI features, and again before you add or switch a provider, please read that provider's own privacy and data-processing terms — including whether the specific plan or tier you are on permits training on your data. Anthropic and OpenAI API tiers, which Pingly supports today, do not by default use your data for model training; other providers you may connect in future may take a different position.

Because the provider, the plan and the key are yours, you are responsible for that choice and for the lawfulness of sending your contacts' data to that provider. Samcom Technologies transmits the data on your instruction as your processor and does not control, and cannot be responsible for, how a third-party AI provider subsequently handles, retains or trains on it. If that matters for your business, use a paid tier with contractual assurances, or leave AI features switched off.

The AI reply suggestion feature (agent assist) sends the current conversation context to the AI provider to generate suggested replies shown only to the agent. Suggestions are not sent to customers unless the agent chooses to send them.

The following sub-processors may receive personal data as part of service delivery. All are bound by Data Processing Agreements:

We may disclose information if required by law, court order, regulation, or a government authority — or when we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

In the event of a merger, acquisition, or sale of assets, personal data may be transferred to the successor entity. We will notify affected Workspace Administrators via email at least 30 days before data becomes subject to a different privacy policy.

We may share data with third parties only when you have explicitly consented to that sharing.

Each workspace's data is logically isolated. Workspace A cannot access Workspace B's contacts, conversations, or configuration. Super Admin users (Samcom Technologies staff) can access any workspace's data only for support, compliance, or abuse-prevention purposes, and such access is logged.