Privacy

Privacy notice

Effective 17 October 2026

Soulful operates Chatloaf from B9, C223, Street 15, Chhatarpur Enclave Phase 2, New Delhi, India 110074. This notice explains how we handle personal information on the Chatloaf website and service. Contact [email protected] with privacy questions.

Information we handle

We receive registration and account information such as a user's name, email address, business name, role and sign-in activity. We use an email confirmation link to establish a new workspace. A business using Chatloaf may add customer names, phone numbers, tags, consent records, messages, templates and campaign records to its workspace. When a WhatsApp connection is authorized, related message and delivery data can come from Meta's WhatsApp Business Platform. We also process service logs, device and network information, including browser and IP address details for account sessions, needed to operate and protect the service.

How we use it

We use this information to run workspaces, show conversations and customer context, route messages, maintain consent and audit records, secure the service, send account verification and recovery emails, troubleshoot incidents and respond to support requests. Chatloaf does not use customer message content to train a general-purpose AI model. Optional features process information only when enabled for your workspace.

Business customer data

Each business decides which customers to contact and what information to place in its workspace. We process that workspace information to provide Chatloaf to the business. If you are an end customer of a business using Chatloaf, contact that business first about a message, consent choice or access request. We will assist the business with requests involving its workspace.

Sharing and service providers

We do not sell personal information. Authorized workspace members can see information according to their roles. We use hosting, network and email delivery providers to run the service. When a business connects WhatsApp, Meta receives data needed to deliver messages and return delivery events under its own terms and policies. We may disclose information when legally required or to protect the service from misuse.

Software subscription payments

If you subscribe to a paid Chatloaf plan, the selected payment provider (Razorpay or Stripe) processes your payment authorization and relevant billing information. Chatloaf stores provider customer and subscription references, billing details, payment status and invoice records to manage your plan and support billing requests. Full payment-card details are handled by the payment provider. Meta bills your business separately for WhatsApp usage.

Optional advertising and conversion services

Businesses may separately connect their own Meta ad accounts and Pages, enroll in optimized marketing delivery, or enable conversion sharing. When a business enables conversion sharing and records an authorized outcome, Chatloaf sends Meta the ad click identifier, WhatsApp business account identifier, event type and time, event identifier and, for purchases, the actual order reference, value and currency. Businesses must provide appropriate privacy information and obtain the necessary permission from their customers. Conversion sharing is off by default and can be disabled in Growth. Disabling it cancels pending events; information already delivered is subject to Meta's terms and policies. Marketing activity sharing is a separate preference. Meta controls ad review, delivery, attribution and advertising charges.

Cookies and security

Chatloaf uses an essential sign-in cookie to keep a user authenticated. The service does not use advertising cookies. We use encrypted connections, access controls and audit records. No online service can guarantee absolute security, so please report suspected misuse promptly.

Retention and deletion

We retain workspace information while the pilot workspace is active and as needed to operate the service, investigate security events and meet legal obligations. Some records, including consent and suppression history, may need to remain to honor a person's communication choice. Backup copies can remain after active records are deleted; we will explain the applicable backup handling in our response. To request deletion or export, follow the data deletion instructions. We will verify the request and explain any information that must be retained.

Updates and contact

We will update this notice when the service or data practices materially change. The date above shows the current version. Email [email protected] for privacy requests or questions.