Privacy Policy

1. Introduction & Scope

Tomio Technologies Inc. (“Tomio”, “we”, “us”, or “our”) provides an enterprise B2B platform that facilitates WhatsApp business messaging, high-throughput verification OTP dispatch, collaborative team inboxes, and campaign management built exclusively on the official WhatsApp Business Platform.

This Privacy Policy explains how we collect, process, store, and protect information when you visit our website, use our software-as-a-service application, or integrate our Developer REST APIs.

2. Meta Business Platform & End-to-End Encryption

Tomio operates strictly in compliance with the Meta WhatsApp Business Terms of Service and Developer Policies:

• Official Infrastructure: We transmit messages solely via Meta Platforms Inc.'s official Cloud API servers. We never deploy unofficial scrapers, reverse-engineered protocols, or unauthorized client emulators.
• Payload Processing: WhatsApp messages are encrypted in transit via TLS 1.3 between our application and Meta's API endpoints. Message bodies received via inbound webhooks are retained only as necessary to display conversation histories within your workspace team inbox.
• No Monetization of Customer Data: We do not sell, rent, or monetize your end users' phone numbers, message content, or transactional metadata to third-party data brokers or advertisers.

3. Information We Collect

We process the following categories of data:

• Account Credentials: Work email, user name, organization name, and billing details necessary to administer your multi-tenant workspace.
• API Keys & Meta Credentials: Meta WhatsApp Business Account (WABA) IDs, Phone Number IDs, and access tokens stored encrypted using AES-256. Tomio API keys are hashed with SHA-256.
• Messaging Metadata: E.164 formatted recipient phone numbers, verification codes, template names, timestamps, message delivery statuses (queued, sent, delivered, read), and latency metrics.
• Payment Information: Transaction identifiers, billing addresses, and payment records handled via our certified payment processor (Razorpay). We do not store raw credit card numbers.

4. How We Use Information

Your information is used solely to:

• Authenticate your requests and verify API credentials via SHA-256 matching.
• Execute two-phase credit ledger transactions and prevent duplicate billing.
• Deliver WhatsApp messages and forward Meta delivery receipts (DLRs).
• Prevent fraud, abuse, and violations of WhatsApp Business messaging policies.
• Provide 24/7 technical assistance and respond to customer support tickets.

5. Sub-Processors & Data Transfer

Tomio engages certified third-party service providers to deliver cloud hosting, queueing, and messaging services:

6. Data Retention & Erasure (GDPR / CCPA)

We retain transactional logs and OTP dispatch records for 30 days to facilitate latency diagnostics, idempotency checks, and credit auditing. Workspace administrators can request permanent erasure of contact records and message logs at any time via the Settings panel or by emailing privacy@gettomio.com.

7. Contact the Data Protection Officer (DPO)

If you have questions regarding this Privacy Policy, your rights under GDPR/CCPA, or wish to exercise data portability, please contact our Data Protection Officer at: