Get Your Project Plan
LEGAL INFORMATION & COMPLIANCE

Privacy Policy

Last Updated: September 15, 2026

This Privacy Policy describes how Keninsula Software (“Keninsula”, “we”, “us”, or “our”) collects, uses, discloses, and safeguards personal data when you visit our website (https://keninsula.in), use our software products, engage our software engineering and technical consulting services, or interact with systems and applications we develop as a technology provider, including integrations with Meta Platforms, Inc. (such as WhatsApp Business Platform, Meta Graph API, and Facebook Login).

Keninsula is committed to protecting user privacy, ensuring transparency in data processing, and maintaining strict adherence to the Meta Platform Terms, Meta Developer Policies, WhatsApp Business Terms of Service, the European Union General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA/CPRA), and India’s Digital Personal Data Protection Act, 2023 (DPDP Act).

1. Data Controller vs. Data Processor Roles

Depending on your relationship with us, Keninsula may act as either a Data Controller or a Data Processor:

  • Keninsula as Data Controller: When you visit our website, schedule a discovery consultation, submit an inquiry form, or enter into a commercial contract with us, we act as the Data Controller of the contact and business information you provide.
  • Keninsula as Data Processor (Tech Provider): When we provide custom software, CRM solutions, middleware, or automated messaging pipelines integrated with the WhatsApp Business Platform or Meta Graph APIs on behalf of our business clients, our client is the Data Controller of their end-users’ data, and Keninsula acts as a Data Processor(or Service Provider). We process messaging content and customer telemetry strictly in accordance with our client’s instructions, Master Services Agreements, and Meta’s compliance policies.

2. Information We Collect

We collect only the minimum amount of data required to deliver reliable, secure software and technical services. The categories of information we handle include:

A. Information You Voluntarily Provide

  • Contact Details: Your name, business email address, phone number, company name, and job title when submitting inquiries or booking discovery calls.
  • Project Briefs: Architectural specifications, technical requirements, business use cases, and budget estimates shared during discovery sessions.
  • Billing & Contractual Data: Corporate address, tax identification numbers (e.g., GST/VAT), invoices, and payment confirmation details.

B. Meta Platform Data & WhatsApp Business API Data

When deploying or operating software integrated with Meta technologies (as a Meta Tech Provider or technology integration partner), our systems may process:

  • Account & Business Identifiers: Meta User IDs (App-Scoped User IDs), WhatsApp Business Account IDs (WABA ID), Phone Number IDs, Business Portfolio IDs, and verified phone numbers.
  • Access Credentials: Securely encrypted short-term and long-term access tokens, system user tokens, and OAuth authorization grants obtained with explicit user consent.
  • Messaging Telemetry & Metadata: Message delivery receipts, read receipts, message timestamps, delivery error codes, and webhook event payloads delivered by the Meta Cloud API or On-Premises API.
  • Conversational Payloads: Incoming and outgoing text messages, template button interactions, interactive replies, and user-submitted media (images, audio notes, PDFs) processed solely to facilitate automated responses, customer support routing, and CRM synchronization requested by our clients.

C. Technical & Diagnostic Telemetry

  • Device & Network Data: Anonymized IP addresses, browser user-agent strings, operating system, and HTTP request headers used for security monitoring and DDoS mitigation.
  • API Request Logs: Webhook receipt timestamps, HTTP response codes, and cryptographic signature headers (X-Hub-Signature-256) used to verify authentic communications from Meta servers.

3. How We Use Information & Legal Bases for Processing

We process personal and platform data strictly under lawful bases, including contractual necessity, legitimate business interests, and compliance with statutory obligations:

  • Delivering Software Engineering & API Services: Operating webhook listeners, executing automated messaging logic, connecting Meta APIs with business backends, and maintaining system availability.
  • Facilitating Business Communication: Responding to client inquiries, scheduling video discovery calls, and providing technical customer support.
  • Security, Fraud Prevention & Signature Verification: Authenticating webhook events against Meta application secrets, detecting unauthorized access, and defending against malicious cyber activity.
  • Compliance & Recordkeeping: Meeting financial, tax, and contractual obligations under applicable law.

4. Strict Non-Sale & Non-Monetization of Meta Platform Data

In strict compliance with Section 4 of the Meta Platform Terms and Meta Developer Policies:

  • We never sell, rent, lease, trade, or transfer personal data or Meta Platform Data to third-party data brokers, advertising networks, or analytics aggregators.
  • We do not use Meta Platform Data for cross-app profiling, targeted advertising, behavioral surveillance, or unauthorized machine learning model training.
  • We only share platform data with authorized sub-processors (such as cloud hosting providers) to the extent strictly required to operate the service contracted by our clients.

5. Data Retention & Automatic Purge Schedule

We maintain rigorous retention and disposal policies to minimize data footprint:

  • Ephemeral Webhook Payloads: In-transit messaging webhook payloads received from Meta are retained in operational processing queues only for the duration required to guarantee delivery and retry resilience (maximum 7 to 30 days), after which they are permanently flushed.
  • Media Files: Inbound and outbound media assets (images, documents, voice notes) processed via WhatsApp APIs are cached temporarily for transmission and are systematically purged in accordance with client CRM retention configurations.
  • Access Tokens & Credentials: Meta access tokens, system user credentials, and API keys are stored encrypted and are permanently deleted within 30 days upon client contract termination, offboarding, or application disconnection.
  • Diagnostic Logs: System server logs containing IP headers and error traces are automatically rotated and permanently purged every 90 days.

6. User Data Deletion Instructions (Meta Platform & WhatsApp)

Pursuant to Meta Developer Policy requirements, users and businesses whose data has been processed through our applications or Meta-integrated platforms have the absolute right to request the complete deletion of their personal data and associated Meta Platform Data.

You can request data deletion using any of the following verified methods:

Method 1: Direct Deletion Request via Email (Recommended)

To initiate a permanent data deletion request across our databases, webhook storage, and active backups:

  1. Send an email to our dedicated data compliance desk at: help@keninsula.in
  2. Subject Line:“Data Deletion Request - Meta Platform / WhatsApp”
  3. Required Details to Include:
    • Your Full Name and Company Name (if applicable).
    • The Phone Number or WhatsApp Business Account ID (WABA ID) associated with the service.
    • Your Facebook/Meta App-Scoped User ID (ASUID) or the email address used to authenticate, if known.
  4. Verification & Timeline: Our security team will verify your request within 48 business hours. Once confirmed, all associated data, tokens, message records, and identifiers will be permanently deleted from active systems within 14 to 30 business days.
  5. Confirmation: Upon completion, you will receive an official confirmation email containing a unique Data Deletion Confirmation Code for your compliance records.

Method 2: Revoking Permissions via Facebook Settings

If you have authorized a Keninsula-developed application via Facebook Login or WhatsApp Business Embedded Signup, you can revoke application permissions directly through Meta:

  1. Log into your Facebook account and navigate to Settings & Privacy > Settings.
  2. In the left sidebar, click on Apps and Websites.
  3. Locate the application developed by Keninsula Software (or your company’s custom solution name).
  4. Click Remove to immediately revoke all data access tokens and permissions.
  5. Optionally, click on “View removed apps and websites” and select “Send Request” to notify us to delete all past data collected through the integration.

Method 3: WhatsApp End-User Opt-Out

End customers interacting with WhatsApp Business numbers automated by our software can instantly revoke messaging consent by replying with standard keywords such as STOP, UNSUBSCRIBE, or CANCEL. Upon receipt, automated messaging is halted immediately, and your contact is marked as opted-out in accordance with WhatsApp Business Messaging Policies.

You may also visit our dedicated Data Deletion Instructions Page at any time.

7. Data Security Safeguards

We implement administrative, technical, and organizational measures designed to protect information from unauthorized access, alteration, disclosure, or destruction:

  • Encryption in Transit: All HTTP traffic and API communications are encrypted using modern Transport Layer Security (TLS 1.3 / HTTPS).
  • Encryption at Rest: Database tables, persistent tokens, and secret configurations are encrypted using AES-256 standard encryption.
  • Cryptographic Signature Validation: All webhook notifications arriving from Meta servers are validated by calculating and comparing SHA-256 HMAC digests against the registered Meta App Secret.
  • Role-Based Access Control (RBAC): Access to production databases and cloud hosting environments is restricted strictly to authorized engineering personnel using multi-factor authentication (MFA) and least-privilege principles.

8. Third-Party Sub-processors & Infrastructure

We rely on enterprise-grade infrastructure providers that adhere to world-class security certifications (SOC 2, ISO 27001):

  • Meta Platforms, Inc.: Provider of Meta Graph APIs, WhatsApp Business Platform, and cloud infrastructure for messaging orchestration.
  • Google Cloud Platform & Firebase: Secure enterprise hosting, managed database storage, and cloud computing infrastructure.
  • Cloudflare: DNS management, edge caching, and DDoS mitigation protection.

9. International Data Transfers & Global Privacy Rights

Depending on your jurisdiction, you possess statutory rights regarding your personal data:

  • European Union (GDPR): You have the right to access, rectify, erase, restrict processing of, port, or object to the processing of your personal data.
  • California Residents (CCPA/CPRA): You have the right to know what personal data is collected, request its deletion, and opt out of the sale or sharing of personal data (we do not sell your data).
  • India (DPDP Act, 2023): You have the right to obtain a summary of personal data processed, request correction or erasure, and nominate a representative in the event of incapacity.

To exercise any of these statutory rights, please contact us at help@keninsula.in.

10. Updates to This Privacy Policy

We may periodically revise this Privacy Policy to reflect modifications in our software services, regulatory standards, or Meta Platform guidelines. When revisions occur, we will update the “Last Updated” date at the top of this page. We encourage you to review this policy periodically.

11. Contact & Data Protection Inquiries

If you have questions, feedback, or grievance requests concerning this Privacy Policy, our role as a technology provider, or our data handling practices, please contact our compliance desk:

Keninsula Software
Attention: Privacy & Data Protection Officer
Email: help@keninsula.in
Phone: +91 88492 04223
Operating Address: Ahmedabad, Gujarat, India