Privacy Policy

OTP Edge is a platform owned and operated by NKJ Group. Throughout this Privacy Policy, "we", "us", "our", and the "Company" refer to NKJ Group. We are committed to protecting your privacy and explaining transparently how we collect, use, and process your information.

1. Information We Collect

When you use our platform, we collect two categories of information:

• Account Information: Your name, email address, password, billing credentials, and workspace configuration preferences.
• API Request Payload Metadata: Masked phone numbers, message IDs, latency records, error reports, and dispatch statuses. To safeguard end-user privacy, we explicitly mask recipient phone numbers in request logs and never retain the unhashed OTP verification codes in permanent database records.
• Meta Platform Data: When you connect a WhatsApp Business Account (WABA) to OTP Edge by securely providing your integration credentials, we receive and store your WhatsApp Business Account ID (WABA ID), Phone Number ID, and an access token issued by Meta. This data is used exclusively to send WhatsApp messages on your behalf and is encrypted at rest as described in Section 4. You can disconnect this integration and delete this data at any time — see our Data Deletion Instructions.

2. How We Use Information

We process your personal information for the following business purposes:

• To initialize, provision, maintain, and upgrade your service access.
• To calculate billing tier compliance and usage quotas.
• To identify system latency bottleneck trends and prevent security threats or system abuse.
• To communicate crucial security alerts, API version updates, and billing notifications.

3. Data Sharing & Third-Parties

We do not sell your personal data. To deliver WhatsApp OTP notifications, we transmit target phone numbers and templates payload data to Meta Platforms, Inc. (WhatsApp Cloud API) in accordance with their business standards. All payments are processed securely through verified third-party payment gateways (Razorpay/Cashfree); we do not directly store complete credit/debit card numbers on our servers.

4. Data Security

We use advanced database practices to protect your data. All Meta Access Tokens are stored encrypted at rest using AES-256-GCM. OTP codes are hashed via SHA-256 immediately upon generation, preventing plain-text exposures inside database tables.

5. Data Retention

In compliance with applicable data protection frameworks including the Indian DPDP Act 2023, we retain identifiable API request metadata for a maximum period of 90 days for billing reconciliation and troubleshooting purposes. After 90 days, all personally identifiable information is automatically and permanently purged from our primary databases. However, fully anonymized and irreversibly masked data (where the individual can no longer be identified) may be retained indefinitely for aggregate analytics, historical billing records, and service improvement. Unhashed OTP codes are never retained. The SHA-256 hash generated for each OTP (see Section 4) is also destroyed or irreversibly invalidated immediately upon successful verification or expiration, whichever occurs first, and is not included in the 90-day API Request Payload Metadata retention described above.

6. User Rights & Data Deletion Instructions

You have the right to inspect, update, or request the deletion of your account personal information. Workspace administrators can request permanent account cancellation and database purging by visiting our Data Deletion Request Page or by contacting our Data Protection Officer at privacy@otpedge.com. You can permanently delete your data using the following methods:

• Meta Integration Data Deletion: If you have connected a WhatsApp Business Account, you can delete this connection by logging into the OTP Edge Dashboard, navigating to Integrations, and clicking Disconnect Meta Account & Delete Data. This immediately purges your Access Token, templates, and WABA metadata from our servers.
• Full Account Deletion: You can permanently delete your entire account, workspaces, and logs by navigating to Profile Settings > Danger Zone and clicking Initiate Deletion. After verifying your email, your data is scheduled for permanent purging.
• Support Request: You can also request data deletion by contacting our Data Protection Officer directly at privacy@otpedge.com or by visiting our dedicated Data Deletion Instructions Page.

7. Cookies & Tracking Technologies

We use essential cookies and local storage to maintain your active session (e.g., keeping you securely logged into the Dashboard). Additionally, we use anonymous performance tracking tools, such as Vercel Speed Insights, to monitor website speed and improve user experience. These tools do not collect personally identifiable information. By using our site, you consent to the use of these strictly necessary and performance-based tracking technologies.

8. Changes to This Policy

NKJ Group reserves the right to update this Privacy Policy to reflect changing security practices or legal obligations. We will notify users of major updates by changing the revised date at the top of this page.