Privacy Policy

Last updated: 27 October 2026

Hastado (“we”, “us”) provides software that lets businesses send and receive WhatsApp and Instagram messages with their customers using the official Meta APIs. Hastado is operated by Anand Mishra, Ahmedabad, India. This policy explains what data we handle and how.

1. Who this covers

Business users who sign up for Hastado, and end customers who message those businesses on WhatsApp or Instagram. For end-customer data, the business is the data controller and Hastado processes it on the business’s behalf.

2. Data we collect

• Account data: business name, your email, a hashed password.
• Meta account data: WhatsApp Business Account IDs, phone number IDs, Instagram account IDs and usernames, and access tokens granted by you through Meta (stored encrypted).
• Messaging data: phone numbers or Instagram IDs, profile names, message content, media references, delivery and read statuses, and comments that trigger automations.
• Contacts you upload: phone numbers, names, tags and opt-in status.
• Technical data: server logs (IP address, timestamps) kept for security and debugging.

3. How we use data

Only to provide the service: delivering and displaying messages, running campaigns and automations you configure, showing analytics, securing accounts and meeting legal obligations. We do not sell data, use it for advertising, or use message content to train AI models.

4. Data from Meta Platforms

Data received through WhatsApp Business Platform and Instagram APIs is used only to provide features requested by the business that connected the account, in line with Meta’s Platform Terms and Developer Policies. It is not shared with third parties except as needed to run the service (hosting) or when required by law.

5. Sharing

Messages are sent through Meta (WhatsApp/Instagram). Data is hosted on Oracle Cloud infrastructure. We may disclose data if required by Indian law or a valid legal request.

6. Storage and security

Data is stored on servers with encrypted connections (HTTPS). Access tokens are encrypted at rest (AES-256). Access is limited to the operator.

7. Retention

We keep data while the business account is active. When an account is deleted, its data is deleted within 30 days, except where law requires us to keep records longer.

8. Data deletion

To delete your Hastado account and all associated data, or to remove data about you as an end customer, email questionhourin@gmail.com with the subject “Data deletion” and the phone number, Instagram username or account email concerned. We confirm and complete deletion within 30 days. Disconnecting Hastado from your Meta account also stops all further data access.

9. Your rights

You can request access to, correction of, or deletion of your personal data under India’s Digital Personal Data Protection Act, 2023, by contacting us at the email below.

10. Changes

We will update this page when the policy changes and revise the date above.

11. Contact / Grievance officer

Anand Mishra — questionhourin@gmail.com