Privacy Policy

At SarasConnect, we believe that your data is your property. This Privacy Policy details the strict boundaries regarding how information is handled when using our open-source, self-hosted WhatsApp Gateway.

1. Local Storage and Network Connections

Because SarasConnect is designed to be self-hosted, the database and media files are stored on the server you configure. Messaging requires connections to WhatsApp. Integrations you enable make the additional connections described below.

• No Centralized Telemetry: Automatic upstream update checks, remote fonts, framework telemetry and automatic link previews are disabled in this checkout.
• Absolute Data Ownership: Contacts, messages, schedules and automatic replies are stored in your configured database. Account owners and authorized server operators can access this data. Approved integrations may receive selected data.

2. Data We Process Locally

When you deploy the gateway, the application running on your server interacts with:

• Authentication Credentials: Passwords you create for the dashboard are securely hashed using bcrypt before being stored in your local database.
• WhatsApp Sessions: WhatsApp session keys are encrypted in the configured database using the server authentication secret. Messages and media require server and backup protection; they are not encrypted at rest by this application.
• Communication Logs: Messages sent and received via the gateway are logged within your local database to provide you with historical data and webhook functionality.

3. Protecting Your Information

While SarasConnect is built with modern security practices, the ultimate safety of your data depends on your hosting environment. We strongly recommend:

• Deploying the application behind a reverse proxy with enforced SSL/TLS encryption (HTTPS).
• Securing the host server with firewalls and SSH key authentication.
• Keeping the underlying operating system and Node.js environment constantly updated.

4. Third-Party Integrations

SarasConnect utilizes the @whiskeysockets/baileys library to communicate directly with WhatsApp's servers. By using this gateway, your server will establish a direct web-socket connection to WhatsApp. Please be aware that your use of WhatsApp is still subject to Meta's Privacy Policy.

• Webhooks: Disabled until the account owner explicitly approves a destination and selected events. Payloads may include message text, contact details and media references. Disable or delete the webhook to stop future deliveries. Previously delivered data cannot be recalled.
• API access: A client holding your API key can use the permissions of your account. Give keys only to trusted clients and rotate the key to revoke access.
• Payments: Recurring checkout shares an opaque subscription reference and the selected billing plan with Razorpay after your consent. Payment details and mandate authorization are entered on Razorpay, not in SarasConnect. Verified billing references and period-end dates are stored locally. Legacy KlikQRIS records are retained; previous payment-provider disclosures still apply to historical transactions. WhatsApp conversations and session keys are not included.
• Background removal: If the session owner enables remove.bg, an explicit background-removal bot command uploads that image to remove.bg. Other sticker conversions run locally.
• Media URLs: Fetching a media URL you provide contacts that host and reveals your server IP. Redirects and private network destinations are rejected.
• Network audit: The server records connection destinations and timestamps locally without recording request bodies, credentials or URL paths. Native dependencies and subprocesses require deployment-level network controls.