Privacy policy

What we collect, why, who else sees it, and how long we keep it.

This document is not written yet, and nothing on it is in force.

The headings below are the shape it will take. Each one says what it needs before it can be published. It is not indexed by search engines while it says this.

1. Who we are

Copy owed. Nothing here is written yet.

  • The registered legal name of the company, its registration number and its registered address.
  • The country and state it is incorporated in.
  • Whether the policy covers the website, the WhatsApp number and the app as one service or separately.

2. What we collect

The product touches a name, an email address, a phone number, WhatsApp messages, files somebody sends in (bills, bank statements), and whatever a connected accounting system returns about a company and its customers.

Copy owed. Nothing here is written yet.

  • Which of those the policy names, and in what words.
  • Whether a customer contact of the business counts as personal data here, and how that is described to them.
  • What is collected automatically: IP address, device, pages opened.
  • Anything collected that is not in the list above.

3. Why we use it

Copy owed. Nothing here is written yet.

  • The purpose for each kind of data, in the words the policy uses.
  • The lawful basis, in the framing you want: consent under the DPDP Act, contract, legitimate use.
  • Whether anything is used to improve the product or train anything, and if so what is excluded.

4. Who else sees it

The product sends data to other companies to do its work. What follows is what the code talks to today, and it has to be confirmed and completed rather than published as it stands.

Copy owed. Nothing here is written yet.

  • The processors, by name, country, and what each one receives: WhatsApp messages go to Meta, payments to Razorpay, AI tasks to OpenAI, email to Resend.
  • Who hosts the servers, the database and the queue, and in which region.
  • Any error tracking or analytics, and what it receives.
  • Whether a sub-processor list is published and how a customer is told when it changes.
  • The statement about not selling personal data, if that is the position.

5. How long we keep it

Two periods are already decided inside the product: the audit trail is kept for eight years, because books of account must be, and operational telemetry is kept for thirty days.

Copy owed. Nothing here is written yet.

  • Retention for everything else: WhatsApp messages, uploaded files, AI usage records, a closed account.
  • What happens to a company that leaves, and how soon.
  • Whether a customer can ask for something to go sooner than that, and what cannot.

6. Where it is processed

Copy owed. Nothing here is written yet.

  • The position on data leaving India. At least the AI provider and WhatsApp process outside it.
  • The mechanism relied on for those transfers.

7. How we protect it

What is true today is on the security page, and every claim there points at something in the code. This section is the shorter version of it, in policy language.

Copy owed. Nothing here is written yet.

  • How much of the security page the policy repeats, and in what words.
  • What we commit to when something goes wrong, and in how many hours somebody is told.

8. Your rights, and how to use them

Copy owed. Nothing here is written yet.

  • The rights listed, under the law you are naming.
  • The address to write to, and how long we take to answer.
  • What proof of identity is asked for before anything is handed over or deleted.
  • The name and contact of the Grievance Officer, which the DPDP Act asks for, or a decision that one is not required.

9. Cookies and anything else set in a browser

Copy owed. Nothing here is written yet.

  • What is set, by us and by anybody else, and what each one is for.
  • Whether there is any analytics at all. If there is none, say so.

10. Children

Copy owed. Nothing here is written yet.

  • The minimum age, and what happens if somebody under it signs up.

11. Changes to this policy

Copy owed. Nothing here is written yet.

  • How a change is notified, and whether continued use counts as agreement.
  • The effective date to print at the top, and who signs it off.

12. Contact

Copy owed. Nothing here is written yet.

  • The address for privacy questions.
  • The postal address, if one has to be published.