IdeoraTechnologies

WhatsApp Acceptable Use Policy

Effective 11 November 2026 · Last updated 12 November 2026

Ideora Technologies (“Ideora”, “we”, “our”, or “us”) is an India-based technology business that develops and operates software products, digital platforms, mobile applications, artificial intelligence solutions, and business automation services. Ideora is the parent business for Digital Gullak, Digital Mala, SI Contact, AI Designer – CorelDRAW Plugin (published on this website as AI Plugin for Designers), and Jain Gyan AI.

Ideora uses one official Meta WhatsApp Business Platform Cloud API integration for its own products and its own business communication: Digital Gullak, Digital Mala, SI Contact, AI Designer – CorelDRAW Plugin, and Jain Gyan AI. A person who uses one of those products may receive the product messages described here.

This Acceptable Use Policy (“AUP”) is an internal operational rule for Ideora’s administrators, developers, and authorised employees, and for the systems that send WhatsApp messages for Ideora’s products. It is published so people who use those products can see the limits.

Related documents: Privacy Policy, Terms & Conditions, WhatsApp Acceptable Use Policy, and Data Deletion Policy.

Company

Business name: Ideora Technologies
Business type: Proprietorship Firm
Proprietor and grievance contact: Shikha Paras Lohade
Place of business: 1, Space Cosmos, Beside Canara Bank, Old Agra Road, Ashok Stambh, Nashik 422002, Maharashtra, India
Websites: https://ideora.in and https://ideoratechnologies.com
Privacy, support, legal, and deletion: contact@ideora.in

Use one of these subjects so the message is reviewed for the right purpose: “Privacy request”, “Support”, “Legal”, or “Data Deletion Request – Ideora Technologies”.

Ideora Technologies is a proprietorship firm. Shikha Paras Lohade is the proprietor and the grievance contact. Messages to contact@ideora.in are the channel for privacy, support, legal, and deletion requests.

1. Purpose

This AUP establishes mandatory rules for use of the official WhatsApp Business Platform Cloud API by Ideora Technologies. WhatsApp communications must be authorised, necessary, relevant, secure, non-promotional, compliant with applicable law, and consistent with Meta’s platform policies.

WhatsApp notifications for a product stay switched off until that product’s consent flow, approved templates, opt-out handling, and retention behaviour have been tested against the production configuration. A control described in this policy is a requirement for going live. Describing it here does not mean that every product integration is already enabled.

2. Authorised platform

Ideora permits WhatsApp integration only through the official Meta WhatsApp Business Platform Cloud API and its authorised technical components.

The following are prohibited: unofficial WhatsApp APIs, reverse-engineered API clients, modified WhatsApp applications, unauthorised browser automation, unauthorised session-based messaging, unapproved bulk messaging tools, scripts designed to bypass platform restrictions, and services that impersonate the official WhatsApp API.

3. Permitted business purposes

3.1 Authentication

  • OTP delivery.
  • Account verification.
  • Login confirmation.
  • Important security alerts.

3.2 Transactional communication

  • Donation confirmation.
  • Payment acknowledgement.
  • Transaction receipts and digital receipts.
  • Order confirmation.
  • Service-completion notifications.
  • Important account updates.

3.3 Service communication

  • Responses to user enquiries.
  • Customer support replies.
  • Technical notifications.
  • Requested service information.
  • Operational alerts.

Every outgoing message must comply with Meta’s applicable template, opt-in, and messaging-window requirements.

4. Prohibited messaging activities

Ideora prohibits promotional campaigns, product advertising, marketing broadcasts, unsolicited bulk messages, purchased contact lists, scraped contact databases, repeated unwanted notifications, misleading communication, fake payment requests, phishing, impersonation, fraudulent donation requests, unauthorised message forwarding, and messages intended to manipulate users.

No employee or system administrator may enable promotional messaging without a formally approved change to company policy, a legal review, and an appropriate consent framework.

5. Recipient permission

Before initiating WhatsApp communication, the responsible system must verify that the recipient has provided the necessary permission. An acceptable permission record identifies the recipient phone number, the business or product identity, the communication purpose, the consent wording, the consent source, the timestamp, and the consent status.

A phone number stored in a database is not unlimited authorisation to contact that person.

6. Message classification

Every outgoing WhatsApp message must be assigned an appropriate business purpose. Permitted categories are authentication, utility or transactional, and customer service. Marketing classification is disabled under the current policy. The system must not classify advertising, sales offers, or promotional content as utility communication.

7. Template management

All required templates must be approved by Meta before use. The following controls are mandatory:

  1. Maintain a template registry.
  2. Record template identifiers.
  3. Record template categories.
  4. Maintain approval status.
  5. Restrict template modification.
  6. Monitor rejected or paused templates.
  7. Prevent unauthorised template use.
  8. Review message content against its approved purpose.

8. Messaging-window enforcement

The platform’s applicable customer-service window must be respected. A free-form reply may be sent during the permitted customer-service window. Outside that window, an approved template must be used where required. No employee or developer may bypass this requirement.

9. Opt-out enforcement

An opt-out request must be respected whether it arrives through WhatsApp or another appropriate channel. The following requests must be recognised according to their context: STOP, UNSUBSCRIBE, “do not message me”, “please stop WhatsApp messages”, and any other clear withdrawal.

The system must record the request, identify the relevant communication category, update suppression status, block prohibited future messages, record the time of withdrawal, and prevent accidental reactivation. A user must not be required to explain why they are withdrawing optional communication permission.

10. Ideora’s own API credentials

Ideora’s Cloud API credentials are confidential security information used only for Ideora’s own integration. Mandatory requirements:

  • Store access tokens securely.
  • Use backend-only API access.
  • Keep permanent tokens out of frontend code, public repositories, and this website.
  • Restrict production credential access.
  • Maintain access logs.
  • Rotate or revoke compromised credentials.
  • Protect application secrets.
  • Keep authentication secrets out of application logs.
  • Use separate credentials and configurations for development and production where the platform supports it.

Sharing credentials through unsecured chat, a public repository, or an unprotected file is prohibited. Production secrets are stored outside source code and version control.

11. Webhook security

Every WhatsApp webhook endpoint must implement appropriate security checks, including verification of webhook subscription requests, signature validation using the configured Meta application secret, payload validation, duplicate-event protection, idempotent processing, rate limiting, access monitoring, error logging, and protection against replay and unauthorised requests.

An invalid webhook event must not trigger outgoing communication or a privileged operation.

12. Database and information security

Access to WhatsApp data is limited to authorised Ideora systems and personnel. Phone numbers, message content, message IDs, consent records, Ideora’s API credentials, business identifiers, delivery status, and support records require appropriate protection. Production data is not copied into a development environment without an approved and secure process. One product user’s records are kept separate from another product user’s records.

13. Data minimisation

The WhatsApp integration collects and retains only information necessary for its authorised purpose. OTP values are not stored in plaintext. Message logs omit personal information that the workflow does not need. Authentication secrets are not written to application logs. Old communication data is deleted according to the retention schedule. Access to historical conversations is restricted.

14. International data processing

WhatsApp-related data may be processed by authorised infrastructure providers in India and in other countries. International hosting and service-provider arrangements require an appropriate security and legal review before production use. Unauthorised copying or transfer of production data is prohibited. International hosting is not permission for an unrestricted transfer.

15. Access management

Access follows least privilege. Only authorised personnel may access Meta Business Manager, WhatsApp Business Account settings, Cloud API credentials, webhook configuration, message logs, and production databases. Access is revoked promptly when it is no longer required.

16. Monitoring and audit

Ideora may monitor API activity for unauthorised access, unusual message volume, repeated failed requests, suspicious webhook events, unexpected message categories, consent violations, unauthorised template usage, and credential misuse. Audit logs record relevant administrative and security actions. Logging covers message IDs and security events. Message content is logged only to the extent the authorised purpose requires.

17. Incident reporting

Employees and authorised service providers must immediately report a leaked API token, suspicious WhatsApp activity, an unauthorised message, a compromised account, database exposure, webhook manipulation, or a suspected personal-data breach. The security team may immediately disable outgoing messaging while an incident is investigated.

18. Emergency kill switch

Ideora must maintain the technical ability to suspend outgoing WhatsApp communication before that communication is enabled for a product. The kill switch may be activated in response to credential compromise, unauthorised messaging, a security incident, consent-system failure, unexpected message volume, a Meta account restriction, or a legal or regulatory instruction. Only authorised personnel may reactivate messaging after appropriate verification.

19. Enforcement

Violation of this policy may result in suspension of system access, revocation of API credentials, disciplinary action, removal of an unauthorised integration, suspension of the affected product feature, and legal action where appropriate.

20. Review and updates

This policy is reviewed when Meta updates its policies, WhatsApp API functionality changes, a new product integrates WhatsApp, a new category of data is processed, a hosting arrangement changes, or applicable law changes.

21. Policy ownership

Policy owner: Ideora Technologies
Legal owner: Shikha Paras Lohade, proprietor, reachable at contact@ideora.in

Questions about this policy can be sent to the legal owner with the subject “Legal”.