Privacy Policy

Effective date: 20 October 2026

Who we are

WebPakka ("we", "us") is a sole proprietorship of Abid Ali, a software engineer in Rawalpindi, Pakistan. We build business websites for small businesses and talk to our customers on WhatsApp. This policy covers our WhatsApp chats, our website webpakka.com, the free demo websites we send in the chat, and the websites we build and host for our clients. Our contact details are at the end of this page.

What we collect

  • WhatsApp details: your WhatsApp profile name, your phone number or WhatsApp user ID (and username, if you use one), and the time and delivery status of messages.
  • Messages and media you send us: texts, button replies, photos, documents, voice notes and shared locations.
  • Business details: your business name, type and city, and your answers to our short questions (whether your content is ready, your budget and your timing).
  • Ad click information: if you message us from a Click-to-WhatsApp ad on Facebook or Instagram, Meta tells us which ad it was (its ID, headline, text, link and media type) and gives us a click ID. If you come from our website or a friend's referral link, a short code in the pre-filled message (for example "(H1)" or "REF-…") tells us where you came from.
  • Payment information: the payment screenshots and transaction IDs (TIDs) you send us, the amounts, and the sender name or account details that our bank shows for your payment. We never ask for your card number, bank login, PIN or one-time code.
  • Website content: your logo, photos, products or services, prices, text, address, timings, the WhatsApp number that should receive orders and your social media links, and, to register your domain in your name, the registrant's full name, email, phone number and address.
  • Our own website: webpakka.com sets no cookies and uses no analytics, advertising pixels or JavaScript. Cloudflare, our host, processes technical request data such as your IP address to deliver and protect the site.

How we use it

  • To reply to you, send your free demo website, answer your questions and hand your chat to Abid Ali when needed.
  • To decide which chats need a personal reply first (your answers about budget and timing give a simple score).
  • To build, host, update and renew your website, and to register your domain in your name.
  • To check payments in our bank account, issue receipts and keep business and tax records.
  • To send service messages about your project: payment receipts, content reminders, the "work started" message with your draft's due time, your draft link and draft reminders, notices that your project is paused or closed, and balance, renewal and care plan invoices.
  • To send marketing messages only if you said yes: at most 2 reminders about your demo in the 3 days after it, then at most 2 offers a month. You can send STOP at any time.
  • To learn which ads bring real customers (see "Meta: ads and conversion events" below), to filter spam, and to meet our legal and tax duties.

Automated replies and AI

Our first replies on WhatsApp are automated (set messages and buttons). You can ask for a person at any time by writing Aap se baat. We may use AI writing tools to help draft website text (for example an "About us" section) from the details you give us; a person reviews and approves every output before it is used. We do not use your chats to train AI models.

Who we share it with

We do not sell or rent your information, and we do not share it for other companies' advertising. These service providers process it for us:

  • Meta Platforms: WhatsApp Business Platform. Every WhatsApp message between us passes through Meta's WhatsApp Cloud API. WhatsApp's own terms and privacy policy also apply to your use of WhatsApp.
  • Meta: ads and conversion events. If you started the chat from one of our ads, we may report up to three events back to Meta through its Conversions API for Business Messaging, so that Meta can show our ads to people more likely to become customers: LeadSubmitted (your answers show a running business within budget, sent when your demo is created), QualifiedLead (our system rates you as ready to start) and Purchase (we verified your deposit). Each event contains only the event name and time, an event ID (the event name with a one-way code made from our contact record for you, or with our payment record number for a purchase), our WhatsApp Business Account ID, the ad click ID that Meta gave us, the currency (PKR) and a value (the package price for a qualified lead, the deposit amount for a purchase, otherwise 0). It never contains your name, phone number or messages. Nothing is reported for chats that did not start from an ad, and no lead events are reported for chats we mark as not being a business enquiry (for example job requests).
  • Cloudflare. Hosts webpakka.com, our WhatsApp system and the websites we build, and stores our database, photos, website files and payment screenshots (Cloudflare D1, R2 and Queues). Cloudflare Email Routing forwards email sent to help@webpakka.com.
  • Alerts to Abid Ali (WhatsApp or email). To answer you quickly, our system sends Abid Ali short alerts. Urgent ones (for example when you ask to talk to a person, are ready to start, or send a payment) go as a WhatsApp message from our business number to Abid Ali's own WhatsApp, sent through Meta's WhatsApp Business Platform. When that is not possible, and for routine summaries, they go as alert emails: Cloudflare sends them from our domain to our Gmail inbox, which Google hosts. An alert can contain your WhatsApp profile name (or your username, number or WhatsApp user ID), your business name, type and city, your answers to our short questions (budget, content and timing) and the score they give, up to the first 200 characters of the message that triggered it and, for payments, the amount expected and the TID you sent, with a link to our private admin page. Your photos and screenshots are never put in an alert. If we turn on Telegram as a second alert channel, an alert sent by email also goes to our Telegram chat.
  • Google. Email forwarded from help@webpakka.com and our alert emails arrive in our Gmail inbox. The websites we build, and our demo websites, embed Google Maps, which loads from Google when a visitor opens the page. When we set up a Google Business Profile for you, Google receives your business name, address, phone number and timings.
  • Domain registrars. To register your domain in your name, the registrar receives the registrant's name, email, phone number and address: PKNIC for .pk domains, and a registrar such as Nameslink or Cloudflare Registrar for .com domains. Registrars may show some of these details in public domain records (WHOIS) under their own rules.
  • Banks (Raast). Payments move between your bank or wallet and ours through Raast, the State Bank of Pakistan's instant payment system. Your bank and ours process the payment details.
  • Our backup storage. A private cloud drive keeps a copy of our weekly backups (see "How long we keep it").
  • The law. We may disclose information when Pakistani law or a valid order from a competent authority requires it.

Meta, Cloudflare, Google, Telegram (if we use it for alerts) and our backup storage provider may process information on servers outside Pakistan.

How long we keep it

  • Payment screenshots: deleted 12 months after the payment is verified (for a payment we could not confirm, 12 months after you sent it). We keep the payment record and receipt number for our accounts and tax.
  • Free demo websites: stop working after 7 days and are deleted 30 days after that.
  • Chats and contact details: kept while you are a lead or a client. If you do not become a client, we anonymise them after 24 months without contact. We delete them sooner if you ask, except records we must keep for tax.
  • Alert emails and WhatsApp alerts: we delete them from our Gmail, from Abid Ali's own WhatsApp chat with our business number and from our system's message log (and the alerts in our Telegram chat, if we used it) 24 months after they were sent, or sooner if you ask us to delete your data.
  • Your website content: kept while we build and host your website, and for 90 days after the service ends or your project closes, then deleted. You can ask for a copy of the content you sent at any time.
  • Backups: we keep weekly backups of our database and files on our own computer and in a private cloud drive for up to 90 days. Information we delete disappears from the backups as they are replaced, within 90 days.
  • Who can see it: only Abid Ali sees chats and payments. Anyone who helps build websites sees only the content needed for the website.

Your choices and rights

  • Stop messages: send STOP (or "unsubscribe", "band karo", "messages band karo", "بند کریں") and we stop every WhatsApp message we would start: no reminders, offers, receipts or invoices. Send START to receive them again. While STOP is on, we send notices about your project (such as an invoice, or a notice before we suspend anything) by call or SMS to your number, or by email if you gave us one. Marketing messages also need your separate "Haan, bhejein" (yes), and they stay off after START.
  • Access, correction and deletion: ask us on WhatsApp or by email for a copy of your information, to correct it, or to delete it. We reply within 30 days. To delete your data, see Data deletion.
  • Your domain and website: your domain is registered in your name, and we never hold back its transfer code or registrar access. We return the content you sent us whenever you ask, and once you have paid the package in full we give you a copy of your website files (see our terms, section 6).

How to ask us to delete your data

  1. On WhatsApp: send DELETE MY DATA to +92 314 9181300 from the same WhatsApp number you used to chat with us, so we know the request really comes from you. We reply to confirm that we received it, and Abid Ali handles it personally.
  2. By email: write to help@webpakka.com with the subject "DELETE MY DATA", and include the WhatsApp number you used and your business name. We may ask you to confirm the request from that WhatsApp number.

Full details: Data deletion instructions.

Security

We use HTTPS on every page. Messages from WhatsApp are accepted only with Meta's valid signature. Payment screenshots are stored privately and are never served on a public link, and our admin pages need a login. No method of storing or sending information is completely secure, but we work to protect yours.

Children

Our service is for businesses and is not meant for children under 18. If you believe a child has sent us personal information, contact us and we will delete it.

Changes to this policy

We may update this policy. We will post the new version on this page with a new effective date.

Contact us

WebPakka (sole proprietorship of Abid Ali)
Phase 8, Bahria Town, Rawalpindi
WhatsApp: +92 314 9181300
Email: help@webpakka.com

FBR-registered individual taxpayer · NTN shared on request