Privacy Policy

1. Introduction

Responseify ("we," "us," "our") is a WhatsApp-based Customer Relationship Management (CRM) platform. Responseify is a service operated by Aurevia Solutions, a sole proprietorship registered in Uttar Pradesh, India (GSTIN 09BUNPA6850N1Z1). This Privacy Policy describes how we collect, use, store, and protect your personal data when you use our website, platform, and services (collectively, the "Services").

For instructions on deleting your account and data, see our Data Deletion page.

This policy is designed to support the Digital Personal Data Protection Act, 2023 (DPDP Act) of India and applicable rules thereunder. By using our Services, you acknowledge that you have read and understood this Privacy Policy.

2. Definitions

• Data Principal: The individual to whom the personal data relates — this includes you, your contacts, and your end users.
• Data Fiduciary: Responseify, as the entity that determines the purpose and means of processing personal data.
• Personal Data: Any data that relates to a natural person, including name, email, phone number, usage data, and communication content.
• Processing: Any operation performed on personal data, including collection, storage, retrieval, use, disclosure, and deletion.

3. Data We Collect

We collect the following categories of personal data:

3.1 Account Data

• Full name and email address (from signup or SSO)
• If you choose "Continue with Google", we receive your name, email address and profile picture from your Google account. We do not receive your Google password, and we get no access to your Gmail, Drive or other Google data.
• Phone number (optional, for account recovery)
• Profile avatar (optional)
• Account role (owner, admin, agent, viewer)

3.2 Contact Data (CRM)

• Contact names, phone numbers, email addresses, and company names
• Custom fields and tags you assign to contacts
• Lead scores and segment memberships

3.3 Communication Data

• WhatsApp messages sent and received through the platform
• Message templates and their content
• Broadcast campaign details and recipient lists
• Support ticket content, comments, and attachments

3.4 Transactional Data

• Wallet balance and top-up history
• Invoice and billing records
• Subscription and plan details
• Message delivery costs (conversation type, cost per message)

3.5 Usage Data

• Login timestamps and session activity
• Feature usage patterns and navigation paths
• IP address and browser/device metadata
• Automation and flow execution logs

3.6 AI Processing Data

• Messages processed by AI auto-reply (OpenCode/DeepSeek, OpenRouter, Google Gemini, Groq, OpenAI, or rule-based)
• AI response content and accuracy metrics
• Usage counts per AI provider

3.7 Facebook / Meta Data (only if you connect it)

If you choose “Connect with Facebook” to use Click-to-WhatsApp ads or Meta Lead Ads, you grant Responseify limited access to your Meta account. We then receive and store:

• Your Meta user ID, and the names and IDs of the Facebook Pages, Business accounts and ad accounts you select
• An access token for the Page or ad account you select, stored encrypted
• Ad campaigns, ad sets, ads and their performance numbers (impressions, clicks, spend, conversations) for the ad account you select
• Lead form definitions and the answers people submit on your Lead Ad forms (for example name, phone number and email), which become Contacts in your CRM

We use this data only to show and manage your ads, bring your leads into your CRM and report results to you. We do not sell it, use it for advertising to others, or share it with anyone except the service providers listed in section 6. You can withdraw our access at any time by removing Responseify under Facebook Settings → Business Integrations (we are then notified and can no longer use the token), or by deleting your Responseify account, which deletes the stored tokens and all the data above once the 30-day account-deletion period ends. To ask us to delete data, see /data-deletion.

4. How We Use Your Data

We process your personal data for the following purposes:

• Service Delivery: To provide, maintain, and improve the Responseify CRM platform and its features.
• WhatsApp Messaging: To send and receive WhatsApp messages on your behalf through the Meta Business Platform, including template submissions, message delivery, and webhook processing.
• Billing & Payments: To process wallet top-ups via Razorpay, manage subscriptions, generate invoices, and maintain financial records.
• AI Auto-Reply: To process incoming messages through AI providers (OpenCode/DeepSeek, OpenRouter, Google Gemini, Groq, OpenAI) for automated responses, subject to your configuration.
• Analytics & Reporting: To generate usage analytics, campaign performance metrics, and business intelligence dashboards.
• Support: To manage support tickets, provide customer service, and track issue resolution.
• Security: To detect fraud, prevent abuse, enforce rate limits, and maintain platform security. For the referral and affiliate programs we store only salted one-way hashes of your email address, phone number, sign-up IP address, device information and the phone number linked to your payment, never the raw values, to spot duplicate or self-referral accounts and to protect genuine referrers and referees.
• Legal Compliance: To comply with applicable laws, regulations, and legal processes.

5. Legal Basis for Processing

Under the DPDP Act, we process personal data based on the following legal bases:

• Consent: You provide explicit consent when creating an account and using our Services. You may withdraw consent at any time.
• Contractual Necessity: Processing necessary to perform our contract with you (providing the CRM service).
• Legal Obligation: Processing required under applicable Indian law, including tax regulations and financial record-keeping requirements.
• Legitimate Interest: Processing for platform security, fraud prevention, and service improvement, where such interests are not overridden by your rights.

6. Data Sharing & Third Parties

We share personal data with the following categories of third parties:

• Meta Platforms (WhatsApp Business API, Facebook Login, Marketing API and Lead Ads): Contact phone numbers and message content are shared with Meta for message delivery, and the ad and lead data in section 3.7 is exchanged with Meta on your instruction. Meta processes this data under their Privacy Policy.
• Oracle Cloud Infrastructure: Our application servers are hosted on Oracle Cloud Infrastructure, so the data the platform processes (including data we receive from Meta) passes through and is processed on servers run by Oracle on our behalf.
• Supabase: Our database and authentication infrastructure provider. Your messages, contacts and conversations are stored in a hosted Postgres database that is encrypted at rest by the hosting provider. We do not add our own encryption layer to message text.
• Razorpay: Payment processing for wallet top-ups and subscriptions. Financial data is processed under Razorpay's PCI-DSS compliant infrastructure.
• AI providers (OpenCode/DeepSeek, OpenRouter, Google Gemini, Groq, OpenAI): Message content may be sent to these providers for auto-reply processing, only when AI auto-reply is enabled on your account. Before a message is sent, email addresses, phone numbers, PAN, Aadhaar, card numbers, UPI IDs and IP addresses in it are masked. Other personal details in the message text, such as names or health information, are not masked. Each provider handles the data under its own terms.
• Sentry: Error/crash reports, which may include limited technical context about the request that failed, are sent to Sentry to help us diagnose and fix bugs.
• PostHog: Product usage analytics (feature usage, navigation paths) are sent to PostHog to help us understand and improve the platform.
• Google Analytics 4: On our public marketing website (not inside the logged-in app, and not on login or password pages), Google Analytics records page views and general traffic sources with IP anonymisation, so we can see which pages help people find us.

We do not sell, rent, or trade your personal data to third parties for their marketing purposes.

7. Data Retention

We retain personal data for as long as necessary to provide our Services:

• Account Data: Retained for the duration of your account. Deleting your account starts a 30-day grace period, after which the data is permanently deleted.
• Contact & Communication Data: Retained while your account is active. Deleted permanently after the 30-day grace period that follows account deletion.
• Billing Records: Kept after account deletion for tax and financial record-keeping requirements.
• Support Tickets: Retained for 2 years after resolution for quality assurance and dispute resolution.
• Audit Logs: Retained for 1 year for security and compliance purposes.
• AI Processing Logs: Retained for 30 days, then purged. Only anonymized usage counts are retained longer.

8. Data Security

We implement appropriate technical and organizational measures to protect your data:

• HTTPS is enforced, with an HSTS header on responses from the app
• WhatsApp, Razorpay, Meta and AI provider credentials are encrypted with AES-256-GCM before they are stored
• Messages, contacts and conversations are stored in a hosted Postgres database that is encrypted at rest by the hosting provider. We do not add our own encryption layer on message text.
• Row-level security (RLS) in the database separates each account's data from other accounts
• Roles (owner, admin, agent, viewer) limit what each team member can do inside an account
• API key authentication with scoped permissions for programmatic access
• Our staff admin panel does not list message content. Authorised staff can, however, sign in as an account owner for support. Every such sign-in is written to an audit log and alerts the founder.

9. Your Rights Under the DPDP Act

As a Data Principal, you have the following rights:

• Right to Access (Section 11): You may request a copy of all personal data we hold about you. To make a request, contact us using the details below.
• Right to Correction (Section 12): You may request correction of inaccurate or incomplete personal data. You can update most data directly from your account settings.
• Right to Erasure (Section 13): You may request deletion of your personal data. Deleting your account starts a 30-day grace period, after which your account data is permanently deleted. Billing records are kept for tax reasons. See our Data Deletion page.
• Right to Nominate (Section 14): You may nominate a person to exercise your rights in the event of your death or incapacity.
• Right to Withdraw Consent (Section 6): You may withdraw consent at any time. Withdrawal will not affect the lawfulness of processing conducted prior to withdrawal.
• Right to Grievance Redressal (Section 8): You may file a complaint with our Data Protection Officer if you believe your rights have been violated.

10. Data Breach Notification

Indian law requires personal data breaches to be reported to the Data Protection Board of India and to affected Data Principals. If a personal data breach affects data we hold, we will follow those legal requirements.

11. Cross-Border Data Transfer

Your data may be transferred to and processed in countries other than India. Our database is hosted in Singapore (Supabase, region ap-southeast-1), and other infrastructure and service providers may process data in the United States and elsewhere. Such transfers are subject to the DPDP Act.

12. Children's Data

Our Services are not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child, we will delete it promptly. If you believe a child has provided us with personal data, please contact our Data Protection Officer immediately.

13. Cookies & Tracking

We use the following types of cookies:

• Essential Cookies: Required for authentication, session management, and security. These cannot be disabled.
• Preference Cookies: Store your theme, language, and display preferences.
• Analytics Cookies: Help us understand how the platform is used to improve our services.

You can manage cookie preferences through your browser settings. Disabling essential cookies may prevent the platform from functioning correctly.

14. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or in-platform notification at least 7 days before they take effect. The "Last updated" date at the top of this page indicates when this policy was last revised.

15. Contact & Grievances

For any questions, requests, or grievances related to this Privacy Policy or your personal data, contact our Data Protection Officer:

If you are not satisfied with our response, you have the right to file a complaint with the Data Protection Board of India established under the DPDP Act, 2023.