This Privacy Policy explains how BulkyGrow ("we") collects, uses and protects personal data in connection with BulkyGrow (the "Service"). We follow the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023 ("DPDP Act").
1. Our two roles
- Data Fiduciary for data about our customers' account users (names, emails, login activity, billing contacts).
- Data Processor for data our customers upload or receive through the Service: their contacts, message content and conversation history ("Customer Data"). Our customers decide why and how that data is used, and they are responsible for having their contacts' consent.
2. Data we collect
- Account data: name, work email, company name, role, hashed password, sign-in times and availability status.
- Customer Data: phone numbers, names, custom attributes, messages, media and delivery statuses exchanged through WhatsApp.
- Billing data: plan, amount, payment status and the order and payment reference from Razorpay, and invoice numbers. We do not see or store your card, UPI or bank details; they are entered on Razorpay's secure checkout.
- Technical data: IP address, browser type and logs needed to secure and operate the Service.
- WhatsApp connection data: your WhatsApp Business Account ID, phone number ID and an access token issued by Meta.
3. Why we use data, and your consent
- To provide the Service: sending and receiving messages, showing conversations, running campaigns and reports.
- To take payments, issue invoices and keep records the law requires.
- To secure the Service, prevent abuse and comply with legal obligations.
- To communicate with account users about the Service, billing and important changes.
We process account data because you gave it to us to use the Service (you consent when you register) and for legitimate uses allowed by the DPDP Act, such as complying with law. You can withdraw consent by closing your account. We do not sell personal data and do not use Customer Data to advertise to anyone.
4. Cookies
We use only the cookies needed to sign you in and keep the site secure. See our Cookie Policy.
5. Security
- Each company workspace is logically isolated; every database query is scoped to a single company.
- WhatsApp access tokens, contact custom attributes and stored webhook payloads are encrypted at rest. Connections to the Service use HTTPS.
- Access within a workspace is role-based (owner, admin, agent).
- If a personal data breach affects you, we will tell you and the authorities as the law requires.
6. Sharing and transfers outside India
We share data only with: Meta, to deliver WhatsApp messages you send; Razorpay, to take payments; infrastructure providers (hosting, email) under contract; and authorities where legally required. Meta and some providers process data on servers outside India, so your data may be transferred abroad. We transfer it only to the extent needed to run the Service and only to countries not restricted by the Indian Government.
7. Retention
Customer Data is kept while your workspace is active and for up to 30 days after a plan ends or you ask us to close the account, then deleted. Webhook event logs are kept for 30 days. Billing records and invoices are kept for as long as tax and company law require.
8. Your rights as a Data Principal
Under the DPDP Act you can ask us to give you a summary of your personal data and who it is shared with, correct or complete it, erase it, and nominate someone to exercise these rights for you. Ask by emailing support@bulkygrow.com from your registered address; we aim to reply within 30 days. To delete your data, see Data deletion. People who receive messages through our customers should first contact the business that messaged them, or write to us and we will pass the request on.
9. Children
The Service is for businesses and is not meant for people under 18. We do not knowingly collect children's data.
10. Grievance Officer
For complaints about how your personal data is handled, contact our Grievance Officer: support@bulkygrow.com. We acknowledge complaints within 48 hours and aim to resolve them within 15 days. If you are not satisfied you may approach the Data Protection Board of India once it is operational.
11. Changes
We will post any change to this policy here with its date and tell account owners of material changes by email.
12. Contact
Privacy questions or requests: support@bulkygrow.com. See also the Contact page.