Legal

Privacy Policy

How InstaMessage collects, uses and protects your information — in plain language.

Last updated: September 24, 2026 13 sections DPDP Act, 2023 (India)
What we collect Your account details, the WhatsApp numbers you connect, and the messages sent and received through them — only what's needed to run the service.
What we never do We don't sell your data, show ads, or use tracking or analytics cookies. We never store your card or UPI details.
You're in control Disconnect a number, revoke an API token, or delete your whole account yourself, at any time — deletion removes your data from our systems.

1Who we are

InstaMessage (the "Service") is operated by BriskBrain Technologies ("we", "us", "our"), based in India. This policy explains what personal information we handle when you visit our website, create an account, or use the Service, and the choices you have. It should be read together with our Terms of Service.

InstaMessage is an independent service and is not affiliated with WhatsApp or Meta Platforms, Inc. WhatsApp's own privacy policy applies separately to your use of WhatsApp.

2What we collect

We only collect what we need to run the Service:

Account
Your name, email address, and password. Your password is stored only as a secure one-way hash — we can never see it.
Connected WhatsApp numbers
The name you give each instance, the connected phone number, its connection status, and the technical session keys needed to keep it connected.
Messages
The text of messages you send or receive through the Service, media files you receive (photos, videos, voice notes, documents, stickers), the sender/recipient phone numbers, delivery status, and timestamps. View-once photos and videos are never downloaded.
API & webhooks
API tokens (stored only as a secure hash plus their first few characters, so you can recognise them), the webhook URL you set, and a log of webhook deliveries (time, status, error — not the message content).
Billing
Your plan, subscription status, renewal date, and the subscription reference from our payment processor. We never receive or store your card, UPI, or bank details — Cashfree handles those directly.
Technical
Your IP address and browser type while you're logged in (to keep your session secure), and basic server error logs.
We don't use analytics tools, advertising networks, or tracking pixels.

3How we use it

We use your information only to:

  • create and secure your account, and verify your email address;
  • connect your WhatsApp number and send or receive messages when you (or your API calls) ask us to;
  • forward incoming messages to the webhook URL you configured;
  • show you your message history, API logs, and usage against your plan's limits;
  • process your subscription and payments;
  • send you service emails — email verification, password resets, and important account notices;
  • prevent abuse (for example rate limiting, and suspending accounts that break our Terms), and fix problems;
  • meet our legal obligations.
We do not read your messages for marketing, use them to train AI models, or send you marketing emails without your consent.

4WhatsApp sessions & messages

When you scan the QR code, WhatsApp creates a linked-device session for our server — the same way WhatsApp Web works. We store that session's keys on our servers, outside the public web directory, one isolated folder per instance, so the connection survives restarts.

  • Each instance's session and messages are only accessible to the account that owns it.
  • You can disconnect at any time from the instance page, or remove the linked device from WhatsApp on your phone (Settings → Linked devices).
  • Our staff only access message content when needed to investigate a problem you reported, or when required by law.

5Who we share it with

We don't sell or rent your personal information. We share it only with:

WhatsApp
Messages you send go to WhatsApp for delivery, as with any WhatsApp message.
Cashfree Payments
Our payment processor, for paid subscriptions.
Email provider
Used to deliver verification, password-reset and account emails (currently Google).
Hosting providers
The servers that run the Service and store its data.

We also send data to your own webhook URL when you configure one, and may disclose information if required by law, to protect our rights or users' safety, or as part of a merger or sale of our business (in which case this policy would continue to apply).

6Cookies

We use only strictly necessary cookies:

  • Session cookie — keeps you logged in.
  • Security (CSRF) cookie — protects your forms from being submitted by other websites.
  • "Remember me" cookie — only if you tick that box when logging in.

No advertising, analytics or third-party tracking cookies. Because these cookies are essential, the Service doesn't work without them.

7How long we keep it

  • While your account is open, we keep your data so the Service keeps working, including your message history.
  • When you delete your account, we delete your account, instances, WhatsApp session data, API tokens, messages, webhook logs and subscription record.
  • Some records are kept longer where needed: records of administrative actions on an account (which include its name and email) are kept for security and accountability, and payment records are kept by Cashfree and by us as tax and accounting law requires.
  • Server error logs are used only to diagnose and fix problems, and are cleared periodically.

8How we protect it

Passwords stored as one-way hashes
API tokens stored hashed, shown only once, revocable
Strict separation between customer accounts
Signed webhooks and protected internal services
Rate limiting and login lockout against abuse
Email verification for new accounts

No system is 100% secure, so please keep your password and API tokens safe. If we become aware of a breach affecting your personal data, we'll notify you and the relevant authorities as the law requires.

9Your rights

Under applicable law, including India's Digital Personal Data Protection Act, 2023, you can:

  • Access the personal data we hold about you;
  • Correct inaccurate or incomplete data;
  • Delete your data — you can delete your account yourself from the Account page;
  • Withdraw consent and stop using the Service at any time;
  • Raise a grievance with us, and if unresolved, with the Data Protection Board of India;
  • Nominate someone to exercise these rights on your behalf in case of death or incapacity.

To use any of these rights, email us (see Contact us). We'll respond within 30 days.

10Your own customers' data

When you message your own customers or contacts through the Service, you decide what to send and to whom, and we process their phone numbers and messages on your behalf. You're responsible for having their permission to contact them on WhatsApp and for handling their data lawfully — including on any webhook endpoint you connect.

11Children

The Service is for businesses and adults. You must be at least 18 years old to create an account, and we don't knowingly collect data from children. If you believe a child has given us personal data, contact us and we'll delete it.

12Changes to this policy

We may update this policy as the Service changes. We'll update the "Last updated" date at the top, and for significant changes we'll also notify you by email or in the dashboard before they take effect.

13Contact us

Questions, requests, or a privacy complaint? Our grievance contact is:

BriskBrain Technologies — Privacy & Grievances
[email protected]
or use our contact form (topic: Privacy / data request)

See also our Terms of Service.