Privacy Policy

1. Introduction

Champions Hi Tech Private Limited (“Champions Hi Tech”, “we”, “our” or “us”) is a software company registered in India. We build and operate a website, multiple Software-as-a-Service (SaaS) applications and custom software products for businesses and organisations.

This Privacy Policy explains how we handle information across:

• our company website at https://championshitech.com and its sub-pages;
• the SaaS applications and software products we operate, including their web, mobile and administrative interfaces;
• the software services, APIs and back-end platforms that support those products;
• third-party integrations we offer, including our integration with the WhatsApp Business Platform provided by Meta; and
• support, sales and business communications connected with the above.

We refer to all of the above together as the “Services”. Individual products may also have their own product-specific privacy notice; where a product notice and this policy differ, the product-specific notice governs that product.

Champions Hi Tech is an independent technology provider. We are not Meta Platforms, Inc. or WhatsApp, and we are not affiliated with, sponsored by or endorsed by them. Meta and WhatsApp are third-party platforms we integrate with under their terms.

This document is written to be read by our customers and by the people they communicate with. It is not a contract on its own and it is not legal advice.

2. Our Role in Handling Information

We handle information in two distinct roles, and it matters which one applies.

In the second situation the business customer determines why the information is being processed; our platform supplies the technical means to do it. In plain language: when a business uses our software to store its records or to message its own customers, that data belongs to the business, not to us. We do not claim ownership of our customers' customer, contact, employee or student data. We do not sell it, and we do not use it for our own unrelated purposes.

Being a processor does not make us a bystander. We remain responsible for keeping the platform secure, for restricting access to data, for honouring deletion and access requests we receive or are asked to action, for our subprocessors, and for the practices described in this policy.

3. Information We Collect

What we collect depends on which of our Services you use and how you use them. Not every category below applies to every product or every person.

3.1 Account and Business Information

When you register for an account, request a quote, contact us, or are added as a user by your organisation, we may collect:

• name;
• company or business name;
• email address;
• phone number;
• billing and contact information;
• account information, such as username and account status;
• organisation information, such as business type and settings;
• branch or location information, where a product supports multiple sites;
• user roles and permissions within the account.

3.2 Technical Information

Our systems record technical information automatically when the Services are used. This may include:

• IP address;
• browser and device information;
• operating system;
• application logs;
• authentication and sign-in logs;
• timestamps;
• diagnostic and error information;
• security events, such as failed sign-in attempts;
• usage information, such as which features were used and when.

We use this information to operate the Services, keep them available and secure, investigate problems and detect abuse.

3.3 Information Processed Through Our Software

Our SaaS applications are business tools. Depending on which application a customer uses, that customer may enter, import or process information relating to:

• their customers;
• their employees;
• their vendors and suppliers;
• students;
• parents or guardians;
• leads and enquiries;
• contacts;
• transactions;
• invoices and payments;
• inventory;
• service requests and tickets;
• other business records relevant to that product.

The exact information varies according to the software product used and according to what the customer chooses to put into it. We process this information to provide the product to that customer, as described in section 2.

4. WhatsApp Business Platform and Meta Integration

Some of our products integrate with services provided by Meta Platforms, Inc. and WhatsApp, including the WhatsApp Business Platform (WhatsApp Cloud API). Champions Hi Tech operates as an independent technology provider on that platform: we build software that lets our business customers send and receive WhatsApp messages as part of their own workflows.

Depending on the product and the features enabled, our platform may process:

4.1 Account and integration identifiers

• WhatsApp Business Account ID (WABA ID);
• Meta Business Account / Business Portfolio identifiers;
• WhatsApp Phone Number ID;
• the connected business phone number;
• WhatsApp display name;
• business profile information, such as address, description, category and website;
• integration and connection status.

4.2 Message template information

• message template names, categories and languages;
• template content and variables submitted for approval;
• template approval, rejection and quality statuses.

4.3 Message and conversation data

• message identifiers;
• sender and recipient phone numbers;
• message timestamps;
• message type (for example text, template, media or interactive);
• message delivery status, including sent, delivered, read and failed;
• error and failure reasons returned by the platform;
• webhook events delivered to us by Meta;
• conversation and message metadata, including conversation categories used for platform charging;
• message content, where processing it is required to deliver the service — for example to send a message a customer has configured, to display an incoming reply in the customer's inbox, or to trigger an automated response;
• media and files transmitted through supported messaging functionality, such as images, documents or audio attached to a message;
• customer and contact information supplied by the business customer, such as the recipient list and the values merged into a template;
• API authorisation information and integration credentials (see section 6).

4.4 What we use this information for

We access WhatsApp and Meta information only as necessary to:

• connect a customer's WhatsApp Business Account to our software;
• provide messaging functionality within the product;
• send messages requested or configured by our customers;
• receive relevant incoming messages and events;
• process delivery, read and failure notifications;
• create, submit and manage message templates where the product supports it;
• maintain and display integration status;
• troubleshoot problems reported by customers or detected by our systems;
• prevent spam, abuse and misuse of the integration;
• maintain the security and integrity of the platform; and
• comply with WhatsApp Business Platform requirements, Meta platform terms and applicable law.

5. WhatsApp Embedded Signup

Business customers may choose to connect their own WhatsApp Business Account and business phone number to our software using Meta's WhatsApp Embedded Signup flow. Connecting is optional; a customer may instead use messaging features that run on our company's own WhatsApp Business number, where a product offers that.

At a high level, the Embedded Signup process works as follows:

1. The customer starts the connection from within our software and is taken to a window hosted and controlled by Meta.
2. Authentication and authorisation happen entirely on Meta's side. The customer signs in to Meta and confirms the permissions being granted.
3. The customer chooses which eligible WhatsApp assets — such as which WhatsApp Business Account and which business phone number — to connect.
4. Meta returns to our application the authorisation required to operate the integration on the customer's behalf, together with the identifiers of the connected assets.

The connected business remains responsible for its own WhatsApp Business Account, its phone number, its business verification status, its message templates and the communications it sends. A customer can request disconnection of the integration at any time — see section 14 — and can also review or remove our application's access from within its own Meta Business settings.

6. Authentication Tokens and API Credentials

To operate an authorised integration, our platform processes and stores credentials and authorisation tokens issued by Meta or configured by the customer — for example access tokens, system user tokens, application identifiers and webhook verification secrets. Similar credentials may exist for other integrations a product offers.

• Credentials are used only to provide and maintain the integrations the customer has authorised. They are not used for any other purpose.
• Access to stored credentials is restricted to the systems that need them to operate the integration, and to authorised personnel only where necessary for operation, support or security investigation.
• We apply reasonable technical and organisational controls to protect credentials, including access restrictions, separation from ordinary application data, and monitoring of the systems that hold them.
• Credentials are not displayed in full in ordinary product interfaces, are not included in routine reports, and should never be shared publicly.
• When an integration is disconnected or an account is closed, the associated credentials are invalidated or removed from active use in accordance with section 11.

7. How We Use Information

We use information for the following purposes:

• Providing the Services — delivering the SaaS applications and software services our customers have subscribed to.
• Accounts and users — creating and maintaining user accounts, organisations, branches, roles and permissions.
• WhatsApp and other integrations — establishing, operating and maintaining authorised integrations.
• Delivering messages — sending the transactional, service, notification, authentication and other permitted messages our customers configure.
• Processing webhook events — receiving and acting on incoming messages, delivery receipts, status changes and platform notifications.
• Customer support — responding to enquiries, diagnosing issues and assisting with configuration.
• Service reliability — monitoring availability, capacity and performance.
• Authentication and authorisation — verifying who is signing in and what they are permitted to do.
• Security and abuse prevention — detecting, investigating and preventing fraud, spam, unauthorised access and misuse of the platform.
• Troubleshooting — reproducing and fixing faults, including reviewing logs and, where necessary, specific records identified in a support request.
• Analytics and product improvement — understanding how the Services are used so we can improve them. We use aggregated or de-identified information for this wherever it is sufficient.
• Billing — invoicing, collecting payments, measuring usage-based charges and maintaining financial records.
• Service communications — notifying customers of changes, incidents, maintenance, security matters and policy updates.
• Legal compliance — meeting obligations under applicable law, regulation and platform requirements.
• Enforcing agreements — applying our terms of service and acceptable-use requirements, and establishing or defending legal claims.

We do not use customer data for unrelated purposes without an appropriate legal basis or the customer's authorisation. In particular, information a business customer processes through our software is used to provide that customer's service — not repurposed by us for marketing, resale, advertising or profiling of that customer's contacts.

8. Customer-Controlled Communications

Business customers using our SaaS products configure communications to their own customers and end users — for example order updates, appointment reminders, invoices, service notifications, authentication codes and support replies, sent over WhatsApp, email or SMS.

The business customer chooses the recipients, the content and the timing. Accordingly, the business customer is responsible for ensuring that:

• recipients are appropriate people to contact for that purpose;
• any required permissions, opt-ins or consents have been obtained and can be evidenced;
• applicable WhatsApp and Meta rules are followed, including the WhatsApp Business Messaging Policy, template and opt-in requirements, and quality standards;
• applicable laws and regulations are followed, including those governing electronic communications, marketing and data protection;
• message templates and message content are lawful, accurate and appropriate; and
• opt-out and stop requests received from recipients are honoured.

Our responsibilities are separate and we take them seriously. We are responsible for operating the platform securely and reliably, for handling data as described in this policy, for restricting who can access data, for our own subprocessors, for providing the controls that let customers meet their obligations, and for acting on valid deletion and access requests. Where we become aware of misuse of our platform, we may suspend or restrict the relevant account or integration and, where required, report it in line with platform and legal obligations.

9. How Information Is Shared

We do not sell personal information. Delivering the Services does, however, necessarily involve other parties — a WhatsApp message cannot reach its recipient without Meta, and software cannot run without infrastructure. Information may be shared in the following circumstances:

• Meta Platforms and WhatsApp — where a customer uses WhatsApp functionality, message content, recipient numbers, templates and related metadata are transmitted to and from Meta's WhatsApp Business Platform so the messages can be delivered.
• Cloud infrastructure and hosting providers — who run the servers and networks the Services operate on.
• Database and storage providers — who store application data, files, media and backups.
• Email, SMS and messaging infrastructure providers — who transmit notifications and communications sent through the Services.
• Payment processors — who handle subscription and invoice payments. Card details are handled by the processor, not stored by us.
• Analytics and monitoring providers — who help us understand usage and detect errors and outages.
• Security providers — who help us protect the Services against attack, abuse and unauthorised access.
• Professional advisers — such as accountants, auditors, insurers and lawyers, where reasonably necessary.
• Government, regulatory and law-enforcement authorities — where we are legally required to disclose information, or where disclosure is necessary to establish, exercise or defend legal claims.
• In a business transfer — if the company or a product is involved in a merger, acquisition or transfer of assets, information may transfer as part of that transaction, subject to this policy continuing to apply.
• At your direction — where a customer instructs us to share information, for example by enabling an integration with another system they use.

Service providers receive only the information reasonably necessary to perform their function, are required to protect it, and are not permitted to use it for their own unrelated purposes.

We do not sell, licence or transfer information obtained through Meta's platforms in a manner inconsistent with the Meta Platform Terms and the WhatsApp Business Platform requirements that apply to us as an independent technology provider. In particular, we do not transfer that information to data brokers, advertising networks or monetisation services.

A current list of the categories of service providers used by a specific product can be requested from contact@championshitech.com.

10. Meta and WhatsApp as Third-Party Services

Meta and WhatsApp operate their own platforms and process information under their own terms and privacy policies. Their handling of information is not governed by this policy, and we do not control it. When you use WhatsApp functionality through our software, Meta's policies apply to Meta's processing in addition to ours.

Please review their policies directly:

• Meta Privacy Policy
• WhatsApp Privacy Policy
• WhatsApp Business Terms of Service
• WhatsApp Business Messaging Policy
• WhatsApp Business Data Processing Terms

We reproduce none of those documents here; they are maintained by Meta and may change. Our Services may also link to other third-party websites, which have their own privacy practices.

11. Data Retention

We retain information only for as long as is reasonably necessary for the purposes it was collected for, including:

• providing the contracted services for the duration of the subscription or engagement;
• maintaining accounts, organisations and user access;
• resolving disputes and handling complaints;
• maintaining the security and integrity of the platform, including investigating abuse;
• legitimate business requirements such as accounting, invoicing and internal record-keeping;
• legal, tax and regulatory requirements; and
• backups and disaster recovery.

Retention periods differ by product, by data type and by the agreement in place with a business customer, so we do not publish a single universal deletion timeframe. Where a business customer controls the data, retention is generally governed by that customer's configuration and its agreement with us, and the customer can delete records within the product where the product provides that function.

When information is deleted from our live systems, copies may remain in routine encrypted backups and disaster-recovery snapshots for a period afterwards. Those copies are not used for ordinary operations and are overwritten or expire as the normal backup retention cycle completes.

We may retain information for longer where we are legally required to, where it is needed to establish or defend legal claims, or where it has been aggregated or de-identified so that it no longer identifies anyone.

12. Data Security

We apply reasonable technical and organisational safeguards designed to protect information against unauthorised access, alteration, disclosure and loss. These include:

• access controls, so that data is reachable only by accounts that need it;
• authentication requirements for users and administrators;
• authorisation checks based on roles and permissions within each product;
• least-privilege access for our personnel, granted for a purpose and reviewed as roles change;
• secure hosting infrastructure operated by established providers;
• encryption in transit for connections to our Services and to the platform APIs we integrate with;
• monitoring of systems and services for errors, outages and suspicious activity;
• logging of authentication and significant administrative actions;
• protection and restriction of integration credentials, as described in section 6;
• regular backups, with restoration procedures;
• internal security reviews when we make significant changes to the platform.

No online service can be completely secure, and we do not claim that ours is. We also do not currently claim any specific external security certification. If we obtain one, we will say so here.

Security incidents

If we become aware of a security incident that affects personal information we hold, we will investigate it, take reasonable steps to contain and remediate it, and notify affected business customers without undue delay so that they can meet their own obligations to the people affected. Where the law requires us to notify a regulator or affected individuals directly, we will do so. Where an incident originates on a third-party platform such as Meta's, that platform's own notification processes also apply.

Security is shared work. Customers should use strong, unique passwords, keep user accounts and roles up to date, remove access promptly when someone leaves, and never share credentials or tokens. If you believe your account or an integration has been compromised, contact contact@championshitech.com immediately.

13. Requesting Deletion of Your Data

You may request deletion of information associated with our Services. This applies to business customers, to individual users of our products, and to individuals whose information may be held in our systems. Full standalone instructions are also published at championshitech.com/data-deletion, which can be used as a direct data-deletion instructions link.

How we handle a deletion request

1. Receive the request by email or through the application.
2. Verify the requester where reasonably necessary, so that we do not delete someone's data on an unverified instruction. Verification is normally done through the registered email address on the account.
3. Identify the information covered by the request across the relevant systems, including any connected integrations.
4. Delete or anonymise the information where appropriate, and invalidate related integration credentials.
5. Retain only what must legitimately remain — for example records we are required to keep for tax, accounting, legal or security reasons, and backup copies until the normal backup cycle expires (see section 11).
6. Confirm completion to you where appropriate, and tell you what was retained and why.

We aim to acknowledge requests promptly and to complete verified requests within a reasonable period. If a request is complex or we need more time, we will let you know.

14. Disconnecting WhatsApp

A business customer can end its WhatsApp integration with our software at any time.

• In the product, where this is available: Settings → Integrations → WhatsApp → Disconnect. Not every product currently offers a self-service disconnect screen; if yours does not, use the email route below.
• By email: write to contact@championshitech.com with the subject WhatsApp Disconnection Request, giving the account name and the connected business phone number or WABA ID.
• From your own Meta settings: you can review and remove our application's access to your WhatsApp Business Account from within your Meta Business settings, independently of us.

Once an integration is disconnected:

• our platform stops using the authorisation to provide further WhatsApp functionality for that account, and the related credentials are invalidated or removed from active use;
• new messages will not be sent from, and incoming events will not be processed for, that connection;
• this takes effect once the disconnection completes technically on both our side and Meta's side; brief propagation delays and already in-flight messages are possible.

Disconnecting stops the integration; it does not by itself delete the business records already stored in the product — for example past conversations, contact lists or reports. Deletion of those records is a separate request; use section 13. Retention obligations described in section 11 continue to apply, and information held by Meta in its own systems remains subject to Meta's policies.

15. User Privacy Rights

Depending on where you are located and applicable law, you may have certain privacy rights in relation to information about you. These may include the right to request:

• access to the information we hold about you;
• correction of information that is inaccurate or incomplete;
• deletion of information, subject to the limits described in section 11;
• restriction of certain processing;
• objection to certain processing;
• withdrawal of consent, where processing is based on consent, without affecting processing already carried out;
• information about processing, including what categories of data are held and who they are shared with;
• a copy of your information in a usable format, where applicable.

To make a request, email contact@championshitech.com. We may need to verify your identity before acting, and we may need to explain where a right does not apply — for example where we must retain information by law, or where the information belongs to a business customer's account and that customer is the appropriate party to decide.

Which specific rights apply, and how they apply, depends on the laws of your jurisdiction and on the contractual relationship involved. We describe these rights generally rather than claiming compliance with any particular statute.

16. Children's and Students' Data

Our Services are designed for and provided to businesses and organisations. We do not offer our products directly to children, and accounts are intended to be held by adults acting for an organisation.

Some of our software may, however, be used by schools, colleges, coaching centres and similar institutions. In those cases the institution may enter information relating to students, some of whom are minors, and to their parents or guardians. Where that happens:

• the organisation is responsible for having the appropriate authority, consent or legal basis to process that information;
• the organisation determines what information is entered and why;
• we process the information only to provide the software service to that organisation, and for no other purpose;
• requests from a parent or guardian about a student's records should normally be directed to the institution, which controls those records. We will support the institution in acting on such requests.

If you believe a child's information has been provided to us outside of an authorised organisational use, contact contact@championshitech.com and we will look into it.

17. International Data Processing

Champions Hi Tech is based in India. Our infrastructure providers, service providers and integration partners — including Meta — operate globally. As a result, information processed through the Services may be stored or processed in a country other than the one you are in, and may cross borders in the course of delivering the Services.

Where information is transferred internationally, we take reasonable steps to ensure it continues to be protected in line with this policy and applicable law, including through the contractual terms we have with our service providers. We do not claim adherence to any specific international transfer framework or certification scheme.

Business customers with specific data-location requirements should raise them with us before onboarding, so that we can confirm whether they can be met for the product concerned.

18. Cookies and Website Analytics

Our website and applications use cookies and similar technologies for the following purposes:

• Strictly necessary cookies — required for the site and applications to function, including load balancing and basic operation.
• Authentication and session cookies — to keep you signed in to a product and to associate requests with your session.
• Preference cookies — to remember choices such as language or interface settings.
• Security cookies — to help detect and prevent abuse, such as automated sign-in attempts.
• Analytics — we use PostHog on our company website to understand how visitors use the site, such as which pages are viewed and where visitors encounter problems, so that we can improve it.

We do not use advertising cookies or third-party advertising trackers on our company website, and we do not sell website analytics data.

Most browsers let you block or delete cookies through their settings. Blocking strictly necessary or authentication cookies will prevent parts of the Services from working. Many browsers also offer a “Do Not Track” signal; there is no common standard for responding to it, and we do not currently respond to it.

19. Business Customers and End Users

A business using our software may hold customer or contact information and use our platform to communicate with those individuals — for example to send an order update or an appointment reminder over WhatsApp.

If you received a message from a business through our platform:

• that business decided to contact you and determined the purpose and content of the message;
• our platform provided the technical service that delivered it, acting on that business's instructions;
• questions about why you were contacted — where the business got your number, what it holds about you, or asking it to stop — are best directed to that business, which controls those records. The business is normally identified in the message itself and in the WhatsApp sender profile;
• you can also contact us at contact@championshitech.com with questions about our own processing or our platform practices, or if you cannot reach the business. We will help where we can and will pass valid requests to the relevant business.

You can also stop receiving WhatsApp messages from a business directly in WhatsApp, by replying to opt out where the business offers it, or by blocking or reporting the sender.

20. Changes to This Policy

We may update this Privacy Policy as our services, technologies, integrations, business practices or legal and platform requirements change. The current version is always published at championshitech.com/privacy-policy.

When we make changes, we will update the “Last updated” date below. Where changes are significant, we will take reasonable steps to notify affected customers, for example by email or an in-product notice. Continuing to use the Services after an update takes effect means the updated policy applies.

• Last Updated: 17 August 2026