Privacy Policy

1. Who We Are

1MarketingSolution is a software-as-a-service ("SaaS") platform owned and operated by MinaTech Labs Private Limited, a company incorporated under the Companies Act, 2013, with its registered office at WARD NO. 14, BALDEV BAG, Rajnandgaon, Chhattisgarh 491441, India (GSTIN: 22AATCM1540R1ZZ; PAN: AATCM1540R).

The Service enables our customers to send updates, reminders, and marketing/transactional communications to their own end-recipients through channels including voice calls, SMS, email, and WhatsApp.

We offer WhatsApp through two distinct paths, and this Policy covers both. The first is outbound campaign sending, routed through our messaging aggregator (Fast2SMS), where we transmit the messages you compose to the recipients you select. The second is our optional WhatsApp chatbot add-on, described in Section 3.5, which holds two-way conversations with your customers on a WhatsApp number you connect and control, routed through the Meta WhatsApp Cloud API directly. The two paths collect and store different data; where this Policy distinguishes them, the distinction is deliberate.

2. Our Two Roles

Depending on the data in question, we act in one of two capacities:

• Data Fiduciary — for personal data of our subscribers and their authorised users (account holders) that we collect directly when you sign up, configure, pay for, or use the Service.
• Data Processor — for personal data that our subscribers upload, import, or transmit through the Service relating to their own end-customers, leads, students, members, employees, or other recipients ("Customer Data"). The subscriber is the Data Fiduciary for that data; we process it only on their documented instructions, as set out in our Terms of Service.

Where this Policy refers to "you," it primarily refers to the subscriber and their authorised users. Recipients of communications sent through the Service should contact the subscriber (the sender) for any privacy-related queries about their personal data; we will assist the subscriber in responding.

3. Information We Collect

3.1 Information you provide when you register and use the Service

• Identity and contact data — name, business name, designation, email address, mobile number, GSTIN / business identifiers where applicable.
• Authentication data — password (hashed), one-time passwords, login timestamps, IP addresses, and device/browser identifiers used to access the Service.
• Billing data — billing address, plan selection, invoice and tax information. Card and bank details for payments are collected and processed directly by our payment gateway (Razorpay); we do not store full card numbers, CVV, UPI PINs, or net-banking credentials on our servers.
• Communications you send to us — support tickets, sales enquiries, contact-form submissions, feedback, and any attachments you choose to share.
• KYC and verification documents — business registration, GST, address proof, sender-ID / DLT registration documents, and similar materials that you upload to enable regulated communication channels.

3.2 Customer Data you upload or transmit

• Recipient lists you upload (typically as spreadsheets) containing recipient name, mobile number, email address, and other fields you choose to include.
• Message content, templates, variables, scheduled jobs, and media (images, audio, PDFs) attached to communications.
• Delivery, read, reply, and failure status returned by upstream carriers and platforms, including timestamps and provider message identifiers.
• Inbound replies and conversations from your recipients on channels such as WhatsApp and SMS where applicable.

3.3 Information collected automatically

• Usage data — pages visited, features used, actions performed, time spent, referring URL, error logs.
• Device and network data — IP address, browser type and version, operating system, device type, language preferences, time-zone setting.
• Cookies and similar technologies — see our Cookie Policy for full details.

3.4 Information from third parties

• Payment confirmation, refund, and dispute information from our payment gateway.
• Delivery reports, error codes, and provider-side identifiers from upstream operators (e.g., Fast2SMS, Meta/WhatsApp, Twilio, AWS SES).
• Identity verification outcomes from KYC providers, where applicable.

3.5 WhatsApp chatbot add-on

If you enable our WhatsApp chatbot add-on, the Service holds two-way conversations with your customers on your own WhatsApp Business number. This section describes that processing specifically. You remain the Data Fiduciary for those conversations; we act as your processor, as set out in Section 2.

How your number is connected. You authorise us to act on your behalf through Meta's Embedded Signup flow, under which we operate as a Meta Tech Provider. You connect a WhatsApp Business Account that you own and control, and you may revoke that authorisation at any time through your Meta account or by contacting us. Messages sent through the chatbot are routed through the Meta WhatsApp Cloud API directly, rather than through our SMS aggregator. We never share or expose a WhatsApp number, conversation, or contact between subscribers.

What we collect and store. For the chatbot we process:

• Conversation history — the messages your customers send to your number and the replies sent back, including timestamps, delivery and read receipts, and any media exchanged. We store this history so that you can read, search, and continue your own customer conversations from your dashboard.
• Content you upload to the knowledge base — documents (PDF, Word, Excel, PowerPoint, text), web page URLs, notes, and question-and-answer pairs that you provide so the chatbot can answer from them. We extract the text, divide it into passages, and index those passages so they can be matched to a customer's question.
• Registration form submissions — where you configure a form, the answers your customers give the chatbot, stored against the form you defined.
• Your WhatsApp access credentials — the access token issued when you connect your account. These are encrypted at rest and are never written to our logs.
• Raw inbound webhook records — the unprocessed delivery payloads Meta sends us, retained briefly for debugging and reconciliation (see Section 7).

Deleting a document removes its indexed content immediately, so the chatbot stops using it at once. You can delete individual documents, FAQs, form submissions, or the whole knowledge base from your dashboard at any time.

4. Purposes and Legal Bases for Processing

We process personal data for the following purposes. Under the DPDP Act, our principal legal bases are (i) the certain legitimate uses recognised by law (such as performance of a contract you have entered into with us), and (ii) your consent, which we collect at the point you provide the data or activate a feature.

• To create and operate your account, authenticate you, and maintain the security of the Service.
• To deliver the Service you have subscribed to — including transmitting your communications through the channels you have configured, returning delivery and reply data, and storing communication history for audit and reporting.
• To process payments, generate invoices, and meet our tax, accounting, and statutory record-keeping obligations.
• To provide customer support, respond to your queries, and investigate and resolve incidents.
• To monitor, debug, and improve the Service, including capacity planning, fraud detection, abuse prevention, and security analytics.
• To send service announcements, billing notifications, security alerts, and other transactional communications you cannot opt out of while you remain a subscriber.
• To send marketing communications about new features, plans, and offers — only where you have given consent or where applicable law permits us to do so on a soft opt-in basis. You may withdraw consent at any time.
• To comply with legal and regulatory requirements, respond to lawful requests from public authorities, and enforce our agreements.
• To exercise or defend legal claims.

5. Sub-processors and Third-Party Service Providers

To run the Service we use carefully selected third-party providers ("sub-processors"). We share only the personal data each sub-processor needs to perform its function, and we require each to maintain appropriate safeguards. The principal sub-processors as of the date of this Policy are:

A qualification on Groq. Groq is used only by the WhatsApp chatbot add-on (Section 3.5), and only for the subset of questions your FAQs and knowledge base do not already answer. Groq receives only the customer's question and the relevant extract of the subscriber's own uploaded content. It does not receive phone numbers, recipient names, or conversation history. The semantic matching that answers most questions runs on our own servers and does not involve Groq or any other external AI provider. If you do not enable the chatbot add-on, no data of yours reaches Groq at all.

We may update this list from time to time. A current list of sub-processors is available on request from the contact below. We do not sell or rent personal data to third parties for their own marketing purposes. We do not use your Customer Data, your conversations, or your uploaded documents to train any AI model.

6. International Transfers

Personal data is processed primarily within India. Some of our sub-processors (notably Twilio, Meta, Groq and certain AWS services) may process data outside India. In particular, where the WhatsApp chatbot add-on calls Groq to compose a reply (Section 3.5), the customer's question and the relevant extract of your uploaded content are processed in the United States. Where such a transfer happens, it is performed only to the extent permitted under the DPDP Act and we rely on the data-protection commitments these providers have published (including standard contractual terms and certifications such as ISO 27001 and SOC 2).

7. How Long We Keep Information

We retain personal data only for as long as needed for the purposes set out in this Policy or as required by law.

• Account data — for the duration of your subscription and for up to twenty-four (24) months after termination, unless a longer period is required by law (for example, GST and income-tax records: minimum 8 years).
• Customer Data and communication history — for the duration of your subscription and for a grace period (typically 30 days) after termination, after which the data is deleted or anonymised. You can request earlier deletion at any time, subject to legal hold requirements.
• Billing and tax records — for the period required under the Companies Act, 2013, the Goods and Services Tax Act, 2017, and the Income Tax Act, 1961 — currently a minimum of 8 financial years.
• Logs and security records — typically retained for up to 12 months for security and abuse-prevention purposes.
• WhatsApp chatbot conversation history and knowledge base (Section 3.5) — for the duration of your subscription, on the same basis as other Customer Data above. You may delete individual conversations, documents, FAQs, or submissions at any time from your dashboard. Deleting a document removes its indexed content immediately, so the chatbot stops using it at once.
• Raw inbound webhook records — the unprocessed payloads received from Meta are automatically deleted after 30 days.

8. Security

We implement reasonable security practices and procedures as required by Indian law, including encryption of data in transit using TLS, encryption of sensitive data at rest, role-based access controls, audit logging, secret rotation, regular dependency updates, and least-privilege access for our staff. Our infrastructure providers maintain certifications such as ISO 27001 and SOC 2.

Two safeguards are worth stating specifically, because they protect data belonging to your customers:

• Isolation between subscribers is enforced by the database itself, not only by application code. One subscriber cannot access another subscriber's conversations, documents, or contacts even in the event of a software fault in the application layer.
• WhatsApp access tokens are encrypted at rest and are never written to our logs.

No service can guarantee absolute security. If we become aware of a personal-data breach that is likely to result in risk to affected individuals, we will notify you and the Data Protection Board of India within the timelines prescribed by law.

9. Your Rights

Subject to applicable law and verification of your identity, you have the right to:

• Access a summary of personal data we hold about you and the identities of any sub-processors with whom we have shared it.
• Correct or update inaccurate or incomplete personal data.
• Request erasure of your personal data, subject to our legal obligations to retain certain records.
• Withdraw consent at any time where processing is based on consent (this will not affect the lawfulness of processing carried out before withdrawal).
• Nominate another individual to exercise your rights in the event of death or incapacity, in line with the DPDP Act.
• File a grievance with our Grievance Officer (see Section 14) and, if unresolved, with the Data Protection Board of India.

Subscribers can exercise most of these rights directly from their account settings. For any other requests, please contact our Grievance Officer.

10. Children

The Service is intended for use by businesses and adults. We do not knowingly collect personal data from any individual under the age of 18. If you believe a child has provided personal data to us, please contact our Grievance Officer and we will delete it.

11. Cookies and Similar Technologies

We and our sub-processors use cookies, local storage, and similar technologies to authenticate you, remember preferences, and improve the Service. Full details — including the categories of cookies in use and how to control them — are set out in our Cookie Policy.

12. Marketing Communications

We may send you product updates, newsletters, and promotional offers about 1MarketingSolution. You can opt out at any time by clicking "unsubscribe" in any marketing email or by writing to our Grievance Officer. Transactional communications about your account (billing, security, service updates) are not optional while you remain a subscriber.

13. Third-Party Links

Our Service may contain links to third-party websites or integrations. We are not responsible for the privacy practices of those third parties. We encourage you to read their privacy policies before sharing personal data with them.

14. Grievance Officer and Contact

In accordance with the Information Technology Act, 2000, the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and the DPDP Act, 2023, we have designated the following person to address privacy queries and grievances:

We will acknowledge grievances within 48 hours and aim to resolve them within 30 days of receipt, in line with applicable timelines.

15. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last Updated" date at the top of this page reflects the most recent revision. For material changes, we will notify you through the Service or by email before the changes take effect. Your continued use of the Service after the effective date of the updated Policy constitutes acceptance of the changes.