Skip to main content
O
ONO WhatsApp SaaS
Get Access
⚠️ DRAFT — Pending Formal Legal Review Last Updated: October 23, 2026

Privacy Policy

This Privacy Policy explains how ONO India Private Limited ("Company", "we", "us", or "our") collects, uses, processes, and safeguards information when you register for and use the ONO platform located at flexing.in and its dashboard at https://app.flexing.in.

1. Data Controller and Entity

The data controller responsible for personal data processed under this policy is:
ONO India Private Limited
Noida, Uttar Pradesh, India
Contact email: tinkal.nitmz@gmail.com

2. Information We Collect

We collect information strictly necessary to provide the messaging platform service:

  • Account Registration Data: Your name, business name, email address, password hash, and two-factor authentication credentials.
  • Billing Information: Payment transaction references processed via authorized payment gateways (e.g., Razorpay / Stripe). We never store raw credit/debit card numbers on our servers.
  • WhatsApp Business Account Metadata: WhatsApp Business Account ID (WABA ID), phone number ID, and authorization tokens issued by Meta during Embedded Signup.
  • Customer Contact Lists: Contacts uploaded by you via CSV, including phone numbers, names, consent source labels, and tags.
  • Message Content and Logs: Text of customer inquiries, outbound template messages, delivery status timestamps (sent, delivered, read, failed), and incoming replies.

3. How Data is Processed (Direct Meta Integration)

ONO connects directly to the official Meta WhatsApp Cloud API. When you send or receive WhatsApp messages, message payloads transit directly between our servers and Meta's infrastructure. We do not sell, rent, or monetize your contact records or message content to any third parties.

4. No Third-Party Tracking or Ad Pixels

The marketing website (flexing.in) does not load Google Analytics, Meta tracking pixels, or third-party behavioral trackers. As a result, no intrusive cookie banners or cross-site tracking scripts are deployed.

5. Customer Consent & Data Protection Obligations

You (the business customer) act as the primary data controller for the individual end-user phone numbers uploaded to your workspace. You warrant that you have obtained all necessary, explicit opt-in consents under applicable privacy laws (such as GDPR, DPDP Act 2023, and Meta Business Terms) before importing contacts or triggering broadcast campaigns.

6. Data Retention, Export, and Deletion

You retain full ownership of your data at all times:

  • You may export full CSV archives of contact records and campaign analytics from your dashboard.
  • You may delete individual contact records, message threads, or your entire workspace at any time.
  • Upon account deletion, all associated workspace tokens, contacts, and logs are permanently purged from active databases within 30 days.

7. Contact Information

If you have questions or data protection requests regarding this policy, please write to our privacy officer at tinkal.nitmz@gmail.com.