Privacy Policy

When you register for or use Pingly:

• Identity: Full name, email address, password (bcrypt-hashed, never stored in plaintext), role
• Organisation: Company name, workspace name, business hours, timezone
• Integration credentials: WhatsApp Business API keys (Gupshup), AI API keys (Anthropic Claude, OpenAI GPT) — all stored AES-256 encrypted
• Billing profile: Company name, billing address, GST number, contact email (for invoice delivery)

When businesses use Pingly to communicate with their customers, we process:

• Contact profiles: Name, phone number, email, tags, opt-in/opt-out status, custom attributes, WhatsApp profile picture URL (if fetched), WhatsApp Business profile data (category, website, description — if applicable)
• Conversation messages: Text content, images, documents, audio/voice notes, videos, stickers, locations, contact cards (vCards), message timestamps, delivery/read receipts
• WhatsApp status: Delivery ticks (sent/delivered/read) and message status updates from WhatsApp
• CSAT ratings: 1–5 star ratings and optional text feedback submitted by end-users
• Web Chat sessions: Visitor name, email, phone (from pre-chat form); chat messages; session identifiers; browser user-agent (for display only)
• Support tickets: Ticket subject, description, status, priority, linked conversation data
• Sales leads: Lead name, phone, email, requirement, budget, pipeline status, notes

If you upload documents (PDFs, Word files, text) to the Pingly Knowledge Base for AI bot training, those documents are stored in our infrastructure and may be processed by the AI provider you select (Anthropic or OpenAI) when the AI bot generates responses. You are responsible for ensuring you have the right to upload and process any documents you provide.

When you submit the Enterprise Plan enquiry form at /enterprise, we collect: company name, contact name, work email, phone, team size, use case description, payment preference, and net payment terms. This data is used solely to respond to your enquiry and is visible only to Samcom Technologies's sales team and Super Admin users.

• Server logs: IP addresses, browser type, OS, pages visited, timestamps, HTTP response codes
• Session tokens: JWT authentication tokens stored in browser localStorage (see Section 12)
• Usage metrics: Feature usage patterns, API call volumes, error rates — aggregated, not individually identifiable
• WebSocket connection data: Real-time event delivery for inbox, notifications, and presence features

If you connect external systems via Contact Sync or API webhooks, we may receive data from those sources. You are responsible for ensuring lawful transfer of that data into Pingly.

When you use the WhatsApp Business API integration, messages are delivered through Gupshup(an authorised Meta Business Solution Provider). In this model:

• Message content passes through Gupshup's infrastructure on its way to and from WhatsApp
• Inbound WhatsApp voice calls are detected and can be routed to your VOIP PBX or AI Voice Agent
• Template messages sent to contacts are subject to Meta's WhatsApp Business Policy
• Gupshup's Privacy Policy applies: gupshup.io/privacy-policy

WhatsApp Direct connects your personal WhatsApp number to Pingly using an open-source library (Baileys). This is a non-official integration and is not affiliated with or endorsed by Meta Platforms, Inc.

In this model, Pingly processes:

• Session credentials: Encrypted WhatsApp session keys stored in our database, required to maintain the connection
• Message content: All inbound and outbound messages on the connected number, stored in your workspace's conversation inbox
• LID (Linked Device) map: A mapping of WhatsApp's internal identifiers to phone numbers, stored per workspace for privacy-mode resolution
• Historical chat sync: When you first connect via QR, WhatsApp may deliver recent message history (typically last 50–100 chats). Pingly ingests these into your inbox and stores them as conversation records
• Contact profile pictures: Fetched from WhatsApp and cached (refreshed every 7 days) as profilePictureUrl on Contact records
• Call notifications: When a customer calls your WhatsApp number, Pingly records the call event (caller JID, timestamp, duration if available) in the conversation timeline. Note: WhatsApp Direct does not route or connect voice calls — it shows notifications only.
• WhatsApp Groups (if enabled): Group JID, group name, participant list, and group messages — stored only if the "Receive group messages" setting is enabled by the workspace admin

Data for WhatsApp Direct sessions is stored only within your workspace and is not shared with Gupshup or any BSP. It is transmitted between your linked phone and our server using WhatsApp's own end-to-end encryption (E2EE).

• Call event log: Caller phone number, timestamp, call duration, call status (answered / missed / rejected), and agent who answered
• VOIP routing records: Which SIP trunk or extension the call was routed to, and the outcome
• AI Voice Agent transcripts: If an AI Voice Agent handles the call, the transcript of the conversation is stored in the conversation timeline — linked to the caller's Contact record
• Missed-call auto-reply log: A record of the WhatsApp message automatically sent to a caller who was not answered

Pingly itself does not record voice calls. Recording, if any, is performed by your VOIP PBX or SIP provider and is governed by that provider's policies. You are responsible for informing callers of any recording in accordance with applicable law (e.g., Indian Telegraph Act, TRAI regulations).

When agents use the browser-based SIP WebPhone feature, the browser establishes a WebRTC/SIP connection directly to your configured SIP server. Pingly does not proxy or record audio streams; it only manages the signalling (call state, routing instructions).

For WhatsApp Direct workspaces, Pingly stores only the call notification event (caller, timestamp, missed/answered status). No audio, no routing, no AI agent is involved. The notification appears in the conversation timeline so agents are aware a call was attempted.

When the AI chatbot feature is enabled, Pingly sends the following to your chosen AI provider (Anthropic Claude or OpenAI GPT) to generate a response:

• The last 20 messages of the conversation (as context window)
• Relevant excerpts from your Knowledge Base documents (vector-matched to the query)
• The system prompt you configured
• The incoming customer message

• Anthropic (Claude): anthropic.com/privacy
• OpenAI (GPT-4o): openai.com/policies/privacy-policy

Pingly does not use your conversation data to train its own AI models. API calls to Anthropic and OpenAI are made under their API (enterprise-tier) terms, which by default do not use your data for model training. Your API keys are used — we never use a shared platform key that could mingle your data with other customers.

The AI reply suggestion feature (agent assist) sends the current conversation context to the AI provider to generate suggested replies shown only to the agent. Suggestions are not sent to customers unless the agent chooses to send them.

The following sub-processors may receive personal data as part of service delivery. All are bound by Data Processing Agreements:

We may disclose information if required by law, court order, regulation, or a government authority — or when we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

In the event of a merger, acquisition, or sale of assets, personal data may be transferred to the successor entity. We will notify affected Workspace Administrators via email at least 30 days before data becomes subject to a different privacy policy.

We may share data with third parties only when you have explicitly consented to that sharing.

Each workspace's data is logically isolated. Workspace A cannot access Workspace B's contacts, conversations, or configuration. Super Admin users (Samcom Technologies staff) can access any workspace's data only for support, compliance, or abuse-prevention purposes, and such access is logged.