1. Who we are
Magnusly is a WhatsApp automation platform operated by Adormax, a Udyam-registered micro enterprise in India. In this policy, “Magnusly”, “we”, “us” and “our” mean Adormax operating the Magnusly service.
| Operating entity | Adormax (Sole Proprietorship) |
|---|---|
| Udyam registration | UDYAM-UP-58-0102169 |
| Registered address | St. 19, Laddhawala, Muzaffarnagar, Uttar Pradesh 251002, India |
| support@adormax.com | |
| Phone | +91 81918 06038 |
For the purposes of India’s Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025, Adormax is the Data Fiduciary for the account data described in this policy. Under the EU and UK GDPR we are the controller for that same data.
2. Our two roles — this is the important part
Magnusly handles two very different kinds of data, and our responsibilities differ for each. Reading this section first will make the rest of the policy make sense.
a. Your account with us — we decide
When you sign up, we collect your name, email and workspace details so we can give you an account, bill you and support you. For this data we are the controller / Data Fiduciary: we decide why it is held and for how long.
b. Your customers’ data — you decide, we only act on your instructions
When you upload contacts and send WhatsApp messages, that data belongs to your business. You decide who to contact, what to say and on what basis. For that data you are the controller / Data Fiduciary and we are the processor / Data Processor. We store and transmit it because you told us to, and for no purpose of our own.
We do not sell personal data, and we never will. We do not use your contacts to build advertising profiles, we do not share your contact lists with other customers, and we do not train models on your message content.
c. What that means for your obligations
Because you are the controller of your contact data, you are responsible for having a lawful basis to message those people — consent under the DPDP Act, a lawful basis under GDPR, and opt-in as required by Meta’s own WhatsApp Business Messaging Policy. Magnusly gives you the tools to record and honour that consent, including an append-only consent record and automatic handling of opt-out replies. It cannot create consent you never obtained.
3. What we collect
| Category | What it includes | Where it comes from |
|---|---|---|
| Account data | Name, email address, hashed password or federated sign-in identifier, workspace name, role, last sign-in time | You, when you register |
| Meta API credentials | Your WhatsApp Business Account ID, Meta app ID, system-user access token and app secret | You, in the Connect step |
| Contact data | WhatsApp numbers, names, email addresses, tags, lifecycle stage and any custom fields you define | You, by import or API; or the person, when they message you |
| Message data | Content of messages sent and received, media identifiers, delivery and read receipts, failure reasons | Your sends, and Meta’s webhooks |
| Consent records | Opt-in and opt-out events with their source, wording and timestamp | Your imports, and inbound replies |
| Usage and cost records | Message counts by category and country, and the rate applied to each | Generated by the platform |
| Technical and security data | IP address, browser type, timestamps, audit log of credential and administrative actions | Automatically, when you use the service |
| Billing data | Plan, invoices, payment status. Card and bank details are handled by our payment processor and never reach our servers. | You, at checkout |
We do not intentionally collect sensitive personal data (health, biometrics, religious or political views, financial account numbers). If you place such data into a custom field or a message, you do so as controller and on your own lawful basis.
4. Why we process it, and on what legal basis
| Purpose | GDPR legal basis | DPDP basis |
|---|---|---|
| Providing the service you signed up for | Performance of a contract | Consent / certain legitimate uses |
| Sending and receiving messages on your instruction | Processing on behalf of the controller | Processing as Data Processor |
| Billing, invoicing and tax records | Legal obligation | Legal obligation |
| Security, abuse prevention and audit logging | Legitimate interests | Legitimate use — security |
| Support and service notices | Performance of a contract | Consent |
| Product marketing emails to you | Consent, withdrawable at any time | Consent |
5. If you sign in with Google
You may sign in to Magnusly using your Google account. When you do, Google shares only your name, email address, language preference and profile picture with us, under the openid, email and profile scopes. We request no other Google scopes. We do not read your Gmail, Drive, Calendar, Contacts or any other Google service.
We use that information solely to create and identify your Magnusly account.
Limited Use. Magnusly’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not transfer this data to others except as necessary to provide the service, comply with law, or as part of a merger or acquisition; we do not use it for advertising; and we do not allow humans to read it except with your explicit permission, for security purposes, to comply with law, or where the data is aggregated and anonymised.
6. WhatsApp, Meta and your own API account
Magnusly is not a WhatsApp Business Solution Provider and we do not resell WhatsApp messaging. You bring your own Meta developer app and your own WhatsApp Business Account, and Meta bills you directly for the messages you send. We never sit in that billing path.
To act on your behalf we store your Meta system-user access token and app secret. These are encrypted at rest with AES-256-GCM under a key held outside the database, are never shown back to you in full, are never written to logs, and every read of them is recorded in an audit log. You can rotate or delete them at any time from the Connect page.
Message content travels to and from Meta’s WhatsApp Business Cloud API. Meta’s own handling of that data is governed by the WhatsApp Business Data Transfer Addendum and Meta’s privacy terms, which apply between you and Meta directly.
7. How long we keep it
The DPDP Rules require specific periods rather than “as long as necessary”, so here they are.
| Data | Kept for |
|---|---|
| Account and workspace data | While your account is open, then 90 days after closure |
| Meta API credentials | Until you delete them, or 30 days after account closure |
| Contacts and custom fields | Until you delete them, or 90 days after account closure |
| Message content and delivery receipts | 24 months, unless you delete them sooner |
| Raw webhook payloads (for dispute evidence) | 90 days |
| Consent records | 7 years — these are the proof that a message was lawful, and outlive the contact record itself |
| Usage and cost ledger | 7 years |
| Invoices and tax records | 8 years, as required by Indian tax law |
| Security and audit logs | 12 months |
| Backups | Rolling 30 days, after which deleted data is gone from backups too |
When you close your account we delete or irreversibly anonymise your data on the schedule above, except where a law requires us to keep it longer.
8. Who else sees it — our sub-processors
We share data only with the providers below, only to run the service, and only under contracts that bind them to protect it. We will update this list before adding a new sub-processor that handles personal data.
| Provider | What it does | Where |
|---|---|---|
| Contabo GmbH | Servers, database and backups | Germany (EU) |
| Supabase | Authentication — passwords, resets, federated sign-in | See Supabase’s regions |
| Meta Platforms, Inc. | WhatsApp Business Cloud API — message delivery | Global |
| Google LLC | Optional sign-in with Google | Global |
Payments. Subscription billing is not yet live — no payment processor currently holds any of your data. When it goes live, payments will be handled by a PCI-DSS compliant provider, card details will never reach our servers, and we will name that provider in this list before the first charge is taken.
Beyond these, we disclose personal data only where the law compels us, to enforce our Terms, to protect the rights and safety of people, or to a successor entity in a merger or acquisition — in which case we will tell you before your data becomes subject to a different policy.
9. Where your data is stored
Our servers are located in Germany, within the European Union. If you are in India, your data is therefore transferred outside India. The DPDP Act permits such transfers except to countries the Government of India specifically restricts; Germany is not restricted. If you are in the EEA or UK, your data stays in the EEA for storage, and any onward transfer by our sub-processors is covered by Standard Contractual Clauses or an equivalent safeguard.
10. How we protect it
- All traffic is encrypted in transit with TLS 1.2 or higher.
- Your Meta credentials are encrypted at rest with AES-256-GCM, with the key held in the environment and never in the database.
- Passwords are hashed; we never store them in a readable form and cannot recover them for you.
- Every workspace is isolated at the query level, so one customer’s data cannot be reached from another’s session.
- Access to production systems is limited to the people who need it, and credential access is written to an audit log.
- Backups are encrypted and retained on a rolling 30-day cycle.
No system is perfectly secure. If a personal data breach occurs, we will notify the Data Protection Board of India and affected users without undue delay and within the timelines set by the DPDP Rules, and within 72 hours where the GDPR applies.
11. Your rights
If the DPDP Act applies to you (India)
- Access a summary of the personal data we process about you and who we have shared it with.
- Correct, complete, update or erase your personal data.
- Withdraw consent as easily as you gave it.
- Nominate another person to exercise your rights if you die or become incapacitated.
- Have your grievance heard through the mechanism in section 12, before approaching the Data Protection Board.
If the GDPR applies to you (EEA / UK)
- Access, rectification, erasure, restriction, portability and objection.
- Withdraw consent at any time, without affecting processing already carried out.
- Lodge a complaint with your supervisory authority.
If you are a California resident
- Know what we collect, why, and who we disclose it to.
- Delete and correct your personal information.
- Opt out of sale or sharing — though we do neither, so there is nothing to opt out of.
- Be free from discrimination for exercising these rights.
To exercise any of these, email support@adormax.com. We will respond within 30 days. We may ask you to verify your identity first, because handing your data to the wrong person would be the worse failure.
If your request concerns data held by one of our customers — for example, you received a WhatsApp message from a business using Magnusly — that business is the controller and we will refer you to them, and assist them in responding.
12. Grievance Officer
In accordance with the Information Technology Act, 2000, the rules made under it, and the DPDP Act, 2023:
| Name | Zafar Saifi |
|---|---|
| Designation | Grievance Officer, Adormax |
| support@adormax.com | |
| Address | St. 19, Laddhawala, Muzaffarnagar, Uttar Pradesh 251002, India |
| Response time | Acknowledged within 48 hours; resolved within 30 days |
13. Children
Magnusly is a business tool and is not directed at children. We do not knowingly create accounts for anyone under 18. If we learn that we hold a child’s personal data without verifiable parental consent, we will delete it. We also do not carry out behavioural advertising or tracking of children, which the DPDP Act prohibits outright.
14. Cookies and similar technologies
We keep this deliberately small. The marketing site at magnusly.com sets no advertising or analytics cookies. The application at app.magnusly.com uses browser storage strictly to keep you signed in and to remember your chosen workspace and theme. There are no third-party advertising trackers on either.
15. Changes to this policy
If we change this policy in a way that materially affects you, we will email account holders and update the date at the top at least 14 days before the change takes effect. Continuing to use Magnusly after that date means the updated policy applies. Previous versions are available on request.
16. Contact us
Questions about this policy, or about how we handle your data:
Adormax — operator of Magnusly
St. 19, Laddhawala, Muzaffarnagar, Uttar Pradesh 251002, India
support@adormax.com · +91 81918 06038