Privacy Policy — WhatsApp Max

Interscale Marketing(“we,” “us,” or “our”) operates WhatsApp Max, a customer relationship management (CRM) platform that helps businesses manage customer conversations, capture leads, and automate workflows.

This Privacy Policy explains what personal and business information WhatsApp Max collects, what Google account and spreadsheet data each Google integration accesses, the exact purposes for reading, writing, importing, and synchronizing that data, how OAuth tokens and related data are stored and protected, with whom Google data may be shared, how long data is retained, and how users can disconnect integrations, revoke access, and request deletion.

WhatsApp Max provides two separate Google Sheets integrations, each with its own OAuth grant and separately stored connection: (A) the Flow Tables integration for CRM automation flows, and (B) the Meta Lead Ads → Google Sheets integration. Google user data is used only to provide the spreadsheet synchronization features an authorized workspace user explicitly configures and enables.

We process information only as described in this policy and as necessary to provide, maintain, secure, and improve the features users choose to use.

Depending on the features you enable, WhatsApp Max processes the following categories of personal and business data:

• Account information: Name, email address, authentication credentials, organisation name, team membership, role assignments, and account and workspace settings, provided during registration, invitation, and administration.
• CRM information: Customer names, phone numbers, contact details, tags, notes, pipeline and deal records, lead records (including Meta lead identifiers, names, phone numbers, email addresses, form names, campaign and advertisement attribution, assignment and stage data, and configured form answers), and other business information entered or imported by workspace users.
• Messaging information: WhatsApp conversations, message content, attachments, delivery status, and related metadata required to provide messaging features.
• Automation information: Workflow and flow definitions, node configurations, collected form responses, submission timestamps, run identifiers, and synchronization settings and field mappings configured for spreadsheet sync.
• Google integration information: Google account email addresses; spreadsheet identifiers, titles, URLs, and worksheet identifiers and titles; per-table spreadsheet, tab, column, and automatic-sync configuration; sync status, error messages, and row-mapping records used for delivery and retries; OAuth access tokens and refresh tokens; token expiry timestamps and granted scope records; and technical logs required to diagnose errors and maintain security. Each integration (Flow Tables and Meta Lead Ads → Google Sheets) has its own separately stored connection and configuration.
• Technical information: Security logs, error information, session data, and limited usage information necessary to operate and protect the Service.

The information processed depends on the features enabled by the user and the permissions granted. Google data is accessed only when an authorized user connects a Google account and configures a spreadsheet sync.

When you connect a Google account to WhatsApp Max, we access only the Google information required for the specific Google Sheets integration you choose to enable, and only within the permissions you authorize. The two integrations request different scopes:

• Flow Tables integration scopes: https://www.googleapis.com/auth/drive.file and https://www.googleapis.com/auth/userinfo.email.
• Meta Lead Ads → Google Sheets integration scopes: https://www.googleapis.com/auth/spreadsheets and https://www.googleapis.com/auth/userinfo.email.

A. Flow Tables integration (CRM automation flows). This integration uses the non-sensitive drive.file and userinfo.email scopes only. It creates new spreadsheets on request and operates only on the linked application-created file. It does not enumerate, list, or discover every spreadsheet in the connected account, and the application does not call Drive file-listing APIs for this integration.

For this integration we access:

• Your Google account email address, to identify the connected account and display which account is linked in the workspace.
• Google Drive files created by the application and made accessible to the application under the granted drive.file scope.
• Spreadsheet and worksheet identifiers, titles, URLs, and sheet structure for those application-created files, as needed to link a spreadsheet to a flow and configure column synchronization.
• Spreadsheet header and row data in the linked application-created file, but only as required to append automation responses, import explicitly requested past responses, update assigned cells, and manage headers and columns for the linked flow.
• OAuth access tokens and refresh tokens issued by Google for this integration, used only to call Google APIs for the linked files.

B. Meta Lead Ads → Google Sheets integration. This separate integration uses the spreadsheets and userinfo.email scopes. It has its own OAuth callback, its own encrypted token storage, and its own per-table configuration, separate from the Flow Tables connection, so a grant for one integration cannot be used for the other.

When an authorized user configures this integration, we access:

• The connected Google account email address, to identify which account is connected for Meta lead synchronization.
• The spreadsheet the authorized user identifies by pasting a Google Sheets URL or spreadsheet ID: we validate that the application can access it and read its spreadsheet identifier, title, URL, and worksheet tab names before saving it as the table's configured target.
• Spreadsheets created by the application at the user's request, including the initial worksheet and managed header row.
• The configured spreadsheet's worksheets, header row, column configuration, and row data as needed to append new Meta lead records, update existing rows matched by the stable lead identifier, manage tabs and headers, and perform explicitly requested imports, sync-now runs, backfills, and retries.
• OAuth access tokens and refresh tokens issued by Google for this integration, used only to call Google APIs for the configured spreadsheets.

WhatsApp Max does not access Gmail, Google Calendar, Google Contacts, Google Photos, or Google Drive files beyond what is described above through either Google Sheets integration.

We use Google Sheets data exclusively to provide the spreadsheet synchronization features requested by authorized workspace users. All reading, writing, importing, and synchronizing is limited to the configured spreadsheets and to the functionality implemented by the application. Google data is never used for advertising, sale, credit decisions, or unrelated profiling or analytics.

A. Flow Tables integration (CRM automation flows) — purposes. For the spreadsheets linked to automation flows, this integration:

• Creates a new spreadsheet when the authorized user requests it, and links that newly created spreadsheet to the flow (or replaces the currently linked spreadsheet with a newly created one).
• Reads the linked spreadsheet's worksheet structure and column headings to configure synchronization and to align future appends with the stored column order.
• Appends information collected when a contact reaches a Google Sheets sync node as a new row — including the configured phone number, submission time, flow-captured answers, traveller details, destination preferences, and other fields selected in the flow configuration.
• Imports previously completed automation responses into the linked spreadsheet when the authorized user explicitly requests a date-range import.
• Writes header cells and data cells as needed to extend columns, rename headers, enrich an already-synced row (for example, assignment updates located by the stored run identifier), and maintain the stored synchronization configuration.
• Unlinks a spreadsheet on request, which stops future syncing.

B. Meta Lead Ads → Google Sheets integration — purposes. For the spreadsheets configured for Meta lead tables, this integration:

• Creates a new spreadsheet with a managed header row when the authorized user requests it.
• Validates a pasted spreadsheet URL or ID by reading its metadata (identifier, title, URL, worksheet names) and saves it as the table's configured target only after verifying access; reads and manages worksheet tabs and the header row required by the configured columns.
• Appends new Meta lead records as rows and updates existing rows matched by the stable Meta lead identifier, including automatic syncing of new leads when enabled and explicitly requested manual sync-now runs, historical imports, backfills, and retries.
• Applies the table's saved column selection, worksheet selection, and automatic-sync setting, and records sync status and errors so failures can be diagnosed and retried.

What Google data is written to spreadsheets. Depending on configuration, rows may include phone numbers, names, email addresses, form answers, lead identifiers, form and campaign attribution, submission timestamps, assignment and stage data, and other fields the workspace user selects. No other Google data is written anywhere else.

We do not use Google user data for advertising, selling personal information, creditworthiness assessments, lending decisions, or purposes unrelated to providing or improving the user-facing spreadsheet features described above.

We do not use Google Workspace API data to train or improve generalized or non-personalized artificial intelligence or machine-learning models.

To operate the integrations, we store the minimum Google-related information necessary:

• The email address associated with each connected Google account, used to display which account is linked.
• OAuth access tokens and refresh tokens for each connected integration, each grant stored as its own per-account record. Tokens are encrypted with AES-256-GCM before storage and are never returned to the browser: status and configuration APIs expose only connection state and the account email, never token values. Stored tokens are looked up scoped to the workspace account, refreshed before expiry, and the refreshed values are re-encrypted and persisted.
• Spreadsheet identifiers, titles, URLs, worksheet identifiers and titles, and token expiry and granted-scope records.
• Synchronization settings and field mappings, including per-flow sheet links and answer-column configuration for Flow Tables, and per-table spreadsheet, tab, column, and automatic-sync configuration for Meta Lead Ads.
• Durable sync records used for reliable delivery: per-flow header and row alignment state for Flow Tables, and a per-submission sync queue with spreadsheet row mapping, attempt counts, and status and error records for Meta Lead Ads delivery and retries.
• Technical logs and sync status records needed to diagnose errors, prevent duplicates, and maintain security.

Data is stored in our application database (Supabase) with account-scoped access controls so one workspace account's Google connection and sync records cannot be read or used by another account. Access to stored Google data is restricted to authorized personnel and automated processes that require it to operate, maintain, or secure the Service.

CRM information may also be stored in the WhatsApp Maxworkspace independently of the Google Sheets integrations (for example, lead submissions that are queued for sync). When information is sent to a Google spreadsheet, that spreadsheet is maintained by Google under the connected account's control.

We do not intentionally maintain a separate copy of an entire Google spreadsheet. The application stores identifiers, configuration, row-mapping references, and queued submission data needed for delivery — not a duplicate of the spreadsheet contents — unless retaining such data is necessary to perform an action the user requested (for example, completing a requested import or retry).

We do not sell, rent, or trade Google user data.

We disclose or transmit Google user data only to the following categories of recipients and only when necessary for the permitted purpose described:

• Google APIs, at your direction:when you enable a sync, the application calls Google Sheets (and, for token refresh, Google's OAuth token endpoint) to read or write only the configured spreadsheets for that integration. Each integration calls Google APIs only for its own configured spreadsheets using its own grant.
• Service providers (sub-processors): hosting, database, and infrastructure providers that store and process information to operate the Service on our behalf — including Supabase for application database and hosting infrastructure — under appropriate confidentiality and data-protection obligations. These providers do not receive direct Google API access; they store the encrypted records described in Section 5.
• User-authorized integrations: other services a workspace user explicitly connects (for example, WhatsApp for messaging delivery), as needed to perform the requested feature. Connecting one Google integration does not authorize data use by the other integration or by any other connected service.
• Legal and safety obligations: when disclosure is required by applicable law or valid legal process, or is necessary to protect the rights, safety, and security of users and the public.
• Business transfers:where permitted by applicable law and Google's policies, in connection with a merger, acquisition, or sale of assets, subject to applicable notice and consent requirements.

We do not disclose Google user data to advertisers, data brokers, or any third party for advertising, data brokerage, unrelated profiling, creditworthiness or lending decisions, or any other purpose prohibited by Google's policies.

WhatsApp Max’s use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements. These requirements apply equally to data from both the Flow Tables integration (using drive.file) and the Meta Lead Ads → Google Sheets integration (using spreadsheets).

Specifically, for Google user data:

• We use Google data only to provide or improve the user-facing spreadsheet synchronization features described in Section 4, which are prominent and relevant in the Service.
• We do not sell Google user data, and we do not use or transfer Google user data for targeted, personalized, or interest-based advertising.
• We do not transfer Google user data to any other party except as necessary to provide or improve the requested spreadsheet features (Section 6), to comply with applicable law, or in other circumstances expressly permitted by Google's policies (such as a business transfer with required notice and consent).
• We do not use or transfer Google user data to determine creditworthiness or for lending purposes.
• We do not use Google Workspace API data to develop, improve, or train generalized or non-personalized artificial intelligence or machine-learning models.
• Human access to Google user data is restricted and permitted only with the user's affirmative agreement for the specific data concerned, where necessary for security or abuse investigations, to comply with applicable law, or as otherwise expressly permitted by Google's policies.

Official policy: https://developers.google.com/terms/api-services-user-data-policy

We use administrative and technical safeguards designed to protect information against unauthorized access, alteration, disclosure, or destruction, including:

• Encrypted network connections (TLS) for data in transit.
• AES-256-GCM encryption of stored Google OAuth access and refresh tokens, with tokens never exposed to the browser and all stored token lookups scoped to the owning workspace account.
• Authentication, account-scoped authorization and row-level access controls, so one workspace cannot access another workspace's Google connection or sync records.
• Security monitoring, error logging limited to what is needed for diagnosis, and infrastructure maintenance.

No method of transmission or storage is completely secure. We cannot guarantee absolute security, but we work to maintain appropriate safeguards for the Service. Please keep account credentials confidential and notify us promptly of suspected unauthorized access.

We retain personal and business information for as long as reasonably necessary to provide the Service, maintain account functionality, satisfy legitimate operational requirements, comply with legal obligations, resolve disputes, and enforce agreements.

Google integration credentials and related configuration for each integration are retained only while that integration remains connected and as needed to operate it. When you disconnect an integration or request account deletion, we delete or invalidate that integration's OAuth credentials and remove its related connection and configuration records in accordance with our deletion procedures and applicable retention requirements, except where retention is required by law.

Disconnecting the Flow Tables connection stops future syncing; the per-flow sheet links are left intact but remain inactive until a Google account is reconnected. Disconnecting the Meta Lead Ads → Google Sheets connection removes that connection and disables automatic syncing; pending queued sync records may be retained so delivery can resume after a reconnect, but they are not processed while disconnected.

Information already written to your Google spreadsheet remains in that spreadsheet, under your Google account's control, until you or an authorized person deletes it directly in Google Sheets. Deleting credentials in WhatsApp Max does not delete spreadsheet contents in Google.

You may disconnect a Google Sheets integration at any time through the relevant WhatsApp Maxintegration or flow settings (flow settings for the Flow Tables integration, or Meta settings for the Meta Lead Ads → Google Sheets connection). Disconnecting one integration stops only that integration and does not affect the other integration's connection.

After disconnection, we immediately stop making new Google API requests for that integration and delete or invalidate its associated OAuth credentials in accordance with our procedures. Flow Tables sheet links are left intact but stop syncing until a Google account is reconnected; Meta automatic sync is disabled and existing spreadsheet contents are left untouched.

You may also revoke WhatsApp Max's access at any time — independently of in-app disconnection — through your Google Account permissions page, which stops all future API calls using that grant:

https://myaccount.google.com/permissions

Disconnecting or revoking access does not automatically delete information previously written to a Google spreadsheet. You can manage or delete that information directly in Google Sheets.

To request deletion of your WhatsApp Max account or associated information — including stored Google integration credentials, Google-related configuration and sync records for either or both integrations — contact:

Email: interscalemarketing2324@gmail.com

Please identify your workspace account and describe the information you want deleted (for example, the connected Google account email and which integration the request concerns). We may request reasonable information to verify your identity and your authority to make the request.

After verifying the request, we delete or anonymize the relevant information — including the applicable OAuth credentials, connection records, sync configurations, and queued sync records — subject to applicable legal obligations and legitimate retention requirements (for example, records we must retain for security, compliance, or dispute resolution).

Data already written to a Google spreadsheet must generally be deleted directly from that spreadsheet by the account holder or an authorized user, because WhatsApp Max cannot delete your Google Drive contents after its access has been removed.

WhatsApp Max may use cookies and similar technologies necessary for authentication, session management, security, and core application functionality.

Where analytics technologies are used, they are intended to help us understand Service performance and improve the product. Google user data is not used for advertising or unrelated analytics.

WhatsApp Max may connect to third-party services, including Google and WhatsApp, when you enable the relevant functionality.

Those services process information according to their own applicable terms and privacy policies. You should review the relevant third-party policies when connecting an integration.

Our use of Google APIs remains subject to Google's applicable API terms and data policies, including the Google API Services User Data Policy referenced in Section 7.

WhatsApp Maxis a business-oriented service and is not intended for children to use independently. We do not knowingly collect children's personal information in violation of applicable law.

We may update this policy when our services, data practices, or legal obligations change.

When material changes are made, we will update the effective date and provide additional notice where appropriate. Where required, we will obtain renewed consent before using Google user data for a new purpose.

The current version will remain available at:

https://interscalechat.co.in/privacy-policy

For questions, concerns, or requests relating to privacy, Google user data, or deletion, contact:

Interscale Marketing
Email: interscalemarketing2324@gmail.com
Website: https://interscalechat.co.in

WhatsApp Max is operated by Interscale Marketing.