Privacy Policy

1. Data controller

The party responsible for processing your personal data is:

2. Scope

This policy covers:

• The Vavibra website (vavibra.com) and marketing pages
• The Vavibra web panel / SaaS account
• The Vavibra mobile app (Android package com.vavibra.app, and the iOS app)
• Messaging and catalog features delivered via WhatsApp Business API / Meta integrations

3. Data we collect

3.1 Account and identity

• Name / display name
• Email address
• Phone number (account or business contact)
• Company / business name, profile or company logo / avatar
• Password (stored hashed / encrypted)
• Session / authentication tokens (e.g. Sanctum API tokens)

3.2 Messaging and customer communication data

• Inbound and outbound WhatsApp message content (text, images, documents, voice notes, etc.)
• Contact name, phone number, language preference, country
• Conversation metadata (timestamps, delivery/read status, labels)
• Meta catalog product data (when connected) and product cards sent in chat

This data is processed so your business can communicate with customers. As a business user you manage parts of this data in the panel.

3.3 Media and uploads

• Profile photos / avatars
• Images, documents and audio uploaded in chat

3.4 Device and notification data

• Mobile push notification tokens (e.g. Expo push token)
• App preferences (theme, UI language) — may be stored locally on device
• Technical logs: IP address, browser/device type, error logs (for security and reliability)

3.5 Location

The app package may include location permissions. Location is processed only when a related feature is used and device permission is granted. Core chat messaging does not require location.

3.6 Payments and subscriptions (web panel)

• Subscription plan and billing status
• Payments may be processed by third-party providers (e.g. Stripe); we do not store full card numbers

3.7 What we do not do

• We do not sell your personal data
• We do not use advertising tracking SDKs to profile users for ads

4. How we use data

• Account creation, authentication and session management
• Receiving, displaying and sending messages via WhatsApp / Meta
• Sending push and in-app notifications
• Providing profile and business settings
• Responding to support requests
• Security, abuse prevention and legal compliance
• Improving the service and fixing technical issues

5. Legal bases

Depending on applicable law (including KVKK), we process data based on:

• Performance of a contract (providing the service)
• Legal obligations
• Legitimate interests (security and service continuity, balanced against your rights)
• Consent where required (e.g. optional marketing or device permissions)

6. Sharing with third parties

• Meta Platforms / WhatsApp: for WhatsApp Business API, webhooks, catalog and message delivery. Meta’s own policies also apply.
• Hosting and storage: servers, databases, media storage
• Notification infrastructure: push delivery (e.g. Expo / related services)
• Payment providers: subscription billing on the web panel
• Realtime infrastructure: optional WebSocket / Pusher-like services
• Legal requirements: valid requests from competent authorities

7. Device permissions (mobile app)

• Microphone: voice messages
• Photos / media / files: sharing images and documents, uploading avatars
• Notifications: new message and system alerts
• Location (optional / feature-based): only when the related feature is used

You can revoke permissions in device settings; related features may stop working.

8. Retention

• Account data: while the account is active and as required by law
• Messaging / media: according to your subscription and business needs, deletion requests, and legal requirements
• Security and technical logs: for limited reasonable periods
• After account closure, data is deleted or anonymized subject to legal exceptions

9. Security

We apply technical and organizational measures such as HTTPS, access controls, hashed passwords, auth tokens and server hardening. No method is 100% secure; contact us if you suspect an issue.

10. Your rights

Subject to applicable law, you may request access, correction, deletion, restriction, objection, and information about recipients. Contact info@vavibra.com. Where available, you may also use in-app or panel account deletion options.

11. Children’s privacy

Vavibra is not directed at children under 13 (or a higher age required in your country). We do not knowingly collect children’s data. Contact us to delete any such data found.

12. International transfers

Infrastructure and vendors may be located in other countries. Where data is transferred, we take steps consistent with applicable law to protect it.

13. Cookies and similar technologies

Our website and panel may use cookies / local storage for sessions, language preference, security and core functionality. You can manage cookies in your browser; some features may be affected.

14. Changes

We may update this policy. The current version is published on this page; material changes may be communicated by email or in-app notice. The “Last updated” date appears at the top.

15. Contact