1. Scope and roles
This Privacy Policy applies to the SoraFabric website, to enquiries submitted to SoraFabric Labs Pvt Ltd (“SoraFabric”, “we”, “us”, or “our”), and to the messaging services we operate for our business clients. It does not apply to third-party websites, services, or customer systems that may be linked from our website.
We handle information in two distinct capacities, and which one applies changes your rights and who you should approach:
- As a controller, for this website and for people who contact us. We decide what is collected and why, and this policy is the full account of it.
- As a processor, for the messages we send and receive on behalf of a business client. Our client decides who is contacted and what is said; we act on their documented instructions. If you received a WhatsApp message operated through SoraFabric, the business that messaged you is the controller, and their own privacy notice governs it. We will always pass a request on to them, and we say how in Deleting your data.
2. Information we collect
From visitors to this website.
Information you choose to provide when you contact us, including your name, work email address, company, area of interest, and the content of your message. Our contact form composes an email in your own mail application rather than submitting to us, so we receive only what you choose to send.
We may also receive limited technical information needed to operate and secure the website, such as browser type, device type, referring page, approximate location derived from an IP address, and diagnostic or security logs. This site sets no advertising or analytics cookies. If we introduce analytics or non-essential cookies, we will update this policy and provide any consent controls required by applicable law.
From our clients, and on their behalf.
To provide the platform we process account and configuration data for the client — business name, contact details, WhatsApp Business Account identifiers, phone numbers, message templates and settings — and, on their instructions, data about the people they communicate with: phone numbers, message content, delivery and read status, and any information a customer includes in a reply.
3. WhatsApp Business Platform
SoraFabric is an independent Tech Provider on the WhatsApp Business Platform. We hold advanced access to the whatsapp_business_messaging and whatsapp_business_management permissions, which let us send messages for our clients and administer the WhatsApp Business Accounts they authorise us to manage. We do this only for clients who have connected their account to us, and only within what they have configured.
What this means for the people our clients message:
- The business is the controller. They chose to message you and are responsible for holding a valid opt-in. We do not message anyone on our own behalf, and we do not use our clients' customer lists for our own marketing.
- Messages are end-to-end encrypted in transit using the Signal protocol, between the WhatsApp client and the Cloud API endpoint that receives them.
- Meta acts as a processor for the business, not as an independent controller of these conversations, and does not automatically use the content of business messages to target advertising.
- Meta retains message data for at most 30 days on the Cloud API to provide the service — retransmission and similar — and deletes user identifiers within 30 days of the last message status update. That period is Meta's and we cannot shorten it.
- You can stop the messages. Replying to stop, or blocking the business in WhatsApp, ends them. You can also ask us directly and we will pass it to the business responsible.
Meta's processing is governed by the WhatsApp Business Data Processing Terms and the Meta Hosting Terms for the Cloud API, which apply to every business using the platform, including through us.
4. How we use information
As a controller, we use information to:
- respond to enquiries and discuss our products or services;
- operate, maintain, troubleshoot, and secure the website and the platform;
- administer client accounts, billing and support;
- understand interest in SoraCommerce and improve our communications;
- comply with legal obligations and protect our legitimate business interests.
As a processor, we use a client's data only to provide the service they have asked for and to meet our legal obligations. We do not sell it, we do not use it to train models, and we do not use it for our own marketing or profiling.
6. Retention
We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including responding to an enquiry, maintaining appropriate business records, resolving disputes, and meeting legal requirements.
Message content and delivery records processed for a client are retained for 90 days on our systems, unless the client has configured a shorter period or we are required to keep them longer. Deleting a client account removes the data associated with it within a reasonable period, subject to backups expiring on their normal cycle. Meta's own retention on the Cloud API is described in WhatsApp Business Platform above and is not ours to change.
7. Your choices and rights
Depending on where you live, you may have rights to request access to, correction of, deletion of, or restriction of the use of your personal information. You may also have the right to object to certain processing, to data portability, or to withdraw consent where processing relies on it, and to complain to your data protection authority.
To make a request, email privacy@sorafabric.com. We may need to verify your identity before completing a request, and we will respond within the period your law requires.
If your request concerns messages you received from a business using our platform, we act on that business's instructions and will forward your request to them without delay, telling you that we have done so.
8. Deleting your data
You can ask us to delete the personal information we hold about you at any time, and we have a page that says exactly how, what happens next, and how long it takes:
How to request deletion of your data →
The short version: email privacy@sorafabric.com from the address concerned, or include the phone number the messages were sent to, and say what you want deleted. There is no charge.
9. Security and international processing
We use reasonable administrative, technical, and organisational measures designed to protect information, including encryption in transit, access control, and least-privilege access to client data by our staff. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a breach affects a client's data, we will notify them without undue delay so they can meet their own obligations.
Our service providers may process information in countries other than your own, including the United States. Where required, we rely on appropriate safeguards for such transfers, including the standard contractual clauses and the regional data transfer addenda that form part of the WhatsApp Business Data Processing Terms.
10. Children’s privacy
Our website and our platform are intended for business audiences and are not directed to children. We do not knowingly collect personal information from children.
11. Changes to this policy
We may update this policy to reflect changes in our practices, services, or legal obligations. We will post the revised policy here and update the date at the top of the page. Where a change materially affects clients, we will also notify them directly.
12. Contact us
For privacy questions and requests, contact SoraFabric Labs Pvt Ltd at privacy@sorafabric.com. For anything else, write to contact@sorafabric.com.