Privacy Policy

Dragon Care processes data strictly necessary to facilitate omnichannel customer messaging, CRM workflows, and automated support:

We process personal data strictly for legitimate operational purposes:

• Omnichannel Communication Delivery: To ingest, route, display, and respond to customer conversations across WhatsApp, Facebook Messenger, Instagram, and WebChat within a unified interface.
• Automated AI Customer Support: To generate contextual answers, answer product inquiries, and assist customers 24/7 through our automated conversational intelligence engine.
• Conversational Order Synchronization: To extract customer shipping details upon confirmation, synchronize order records with authorized Point of Sale (POS) systems, and generate courier delivery waybills with logistics partners upon user instruction.
• Security & Webhook Verification: To validate incoming webhook signatures using cryptographic HMAC verification, detect unauthorized access, prevent spam, and enforce data isolation.
• Platform Analytics & Reporting: To generate aggregated, non-identifying performance metrics regarding channel message volumes and response times.

Limited Use: Meta User Data is processed exclusively to provide the core customer service and communication functionalities requested by the business tenant and end-user.

Credential Isolation: Page Access Tokens and webhook verification secrets are encrypted in private, access-restricted database vaults and never exposed to unauthorized parties or public client bundles.

Dragon Care utilizes automated conversational artificial intelligence to assist customer support:

• Real-Time Inference Only: Customer conversation data transmitted to our automated AI processors is evaluated strictly in real time for conversational reasoning and response generation.
• Zero Public Model Training: Customer conversational data is NEVER used, stored, or retained to train public foundational artificial intelligence models.
• Strict Confidentiality: Data processed by automated AI tools is handled under enterprise confidentiality standards with zero unauthorized third-party leakage.

To operate a secure and reliable platform, Dragon Care collaborates with trusted enterprise technology providers under strict data protection standards:

• Meta Platforms, Inc.: Provides cloud messaging APIs for WhatsApp Business, Facebook Messenger, and Instagram Direct.
• Enterprise Cloud Infrastructure: Encrypted cloud hosting and private database vaults maintain system persistence under strict multi-tenant isolation.
• Encrypted Cloud Object Storage: Stores media attachments (images, voice notes, documents) using industry-standard AES-256 encryption, accessible only through temporary, time-expiring signed URLs.
• Authorized Logistics Partners: Transmits delivery recipient details (name, address, contact number) solely upon explicit order dispatch confirmation by the business.

• Encryption in Transit: All traffic across client browsers, Meta webhooks, and backend systems is encrypted using TLS 1.3 / HTTPS.
• Encryption at Rest: Sensitive credentials, database records, and media attachments are encrypted using industry-standard AES-256.
• Strict Multi-Tenant Isolation: Database queries enforce strict company-level cryptographic boundaries. No user or tenant can access or view another tenant's customer records or messaging channels.
• Multi-Factor Authentication (MFA): Administrative access is protected with time-based multi-factor authentication with secrets encrypted at rest.
• Role-Based Access Control: Strict permission tiers ensure only authorized support personnel can view conversation streams within their assigned organization.

Live Conversation Records: Retained for the duration of the business account's active subscription to provide continuous customer relationship history.

Temporary Media Files: Media attachments stored in encrypted cloud storage are subject to lifecycle management and can be purged upon request.

Archived & Purged Data: Inactive customer records marked for deletion are permanently scrubbed from active systems.

Statutory Compliance: Historical fiscal invoices and courier waybill records are retained strictly as required by applicable statutory accounting regulations.

Any user (whether an end-customer communicating via WhatsApp, Messenger, or Instagram, or a platform account holder) possesses full rights over their personal data, including the right to access, rectify, restrict, or permanently delete their data.

Dragon Care uses essential, HttpOnly session cookies solely to authenticate logged-in users and protect against Cross-Site Request Forgery (CSRF). We do not deploy third-party advertising cookies or cross-site tracking pixels on our application dashboards.

We may update this Privacy Policy periodically to reflect platform enhancements or regulatory requirements. Significant modifications will be notified via our platform dashboard or email.