Privacy Policy

1. Data Controller

The data controller responsible for your personal data is:

2. Legal Framework

MessageBot processes personal data in compliance with the Digital Personal Data Protection Act, 2023 (DPDPA), the Information Technology Act, 2000 and its rules, the Telecom Regulatory Authority of India (TRAI) regulations for commercial messaging, and any other applicable Indian data protection laws. Where services are accessed from outside India, we also apply equivalent protections under applicable international frameworks.

3. Personal Data We Collect

We collect personal data in the following categories:

3.1 Account & Identity Data

• Full name, business name, and designation
• Email address and mobile number
• PAN, GSTIN, Aadhaar number, or other KYC documents (required under TRAI regulations for sender ID registration)
• Billing address and payment information (processed via PCI-DSS compliant payment gateways)
• Login credentials (stored as one-way cryptographic hashes)

3.2 Usage & API Data

• API access tokens and request logs (IP address, timestamp, endpoint, response code)
• Recipient mobile numbers submitted for SMS, Voice, or WhatsApp delivery
• Message content and templates submitted through our platform
• Delivery reports and DLR callback data
• Dashboard activity: campaigns created, reports accessed, contacts uploaded

3.3 Technical & Device Data

• IP address and approximate geolocation
• Browser type, operating system, and device identifiers
• Session duration and page interaction data (via analytics tools)
• Cookies and similar tracking technologies (see Section 9)

3.4 Communication Data

• Support tickets, chat transcripts, and email correspondence
• Feedback forms and satisfaction surveys
• Sales and onboarding call recordings (where consent is obtained)

4. Legal Basis for Processing

Under the DPDPA 2023, we process your personal data on the following lawful bases:

• Consent: For marketing communications, newsletters, and non-essential cookies. You may withdraw consent at any time.
• Contract performance: To deliver the messaging services you have subscribed to, process payments, and manage your account.
• Legal obligation: KYC verification and DLT registration as mandated by TRAI; financial record retention as required under the Companies Act and GST law.
• Legitimate interests: Fraud prevention, platform security, abuse detection, and product analytics to improve service quality.

5. How We Use Your Data

• Provision, operation, and maintenance of your MessageBot account and API access
• Processing and routing of SMS, Voice, WhatsApp, and RCS messages on your behalf
• Identity verification and KYC as required under TRAI DLT regulations
• Billing, invoicing, and payment processing
• Sending transactional communications: service alerts, invoices, OTP for your own account login, API status notifications
• Customer support and dispute resolution
• Fraud detection, rate limiting, and abuse prevention
• Product improvement and analytics (aggregated and anonymised where possible)
• Marketing communications and product updates (only where you have consented or are an existing customer under the soft opt-in rule)
• Compliance with regulatory requests from TRAI, Ministry of Communications, or courts of competent jurisdiction

6. Data Sharing & Third-Party Processors

We do not sell your personal data. We share data only with the following categories of processors under binding data processing agreements:

• Telecom operators and aggregators (Jio, Airtel, Vi, BSNL, and licensed SMS aggregators): to deliver messages to recipient mobile numbers. Recipient phone numbers are transmitted to operators under TRAI regulations.
• Meta Platforms (WhatsApp Business API): for routing WhatsApp messages. Meta's data processing terms apply to message content transiting their infrastructure.
• Payment gateways (Razorpay or equivalent): for processing credit/debit card and UPI transactions. We do not store full card numbers.
• Cloud infrastructure providers (hosting, storage, CDN): servers located in India or within DPDPA-compliant environments.
• Analytics providers (e.g., Google Analytics): for aggregated usage statistics. IP addresses are anonymised before transmission.
• Legal and regulatory authorities: where required by law, court order, or TRAI/DoT directive.

7. Data Retention

8. Your Rights Under DPDPA 2023

As a Data Principal under the Digital Personal Data Protection Act 2023, you have the following rights:

• Right to access: Request a summary of personal data we hold about you and the processing activities.
• Right to correction: Request correction of inaccurate or incomplete personal data.
• Right to erasure: Request deletion of your personal data where there is no overriding legal obligation to retain it.
• Right to grievance redressal: Lodge a complaint with our Data Protection Officer (DPO) and, if unresolved, with the Data Protection Board of India once operational.
• Right to withdraw consent: Where processing is based on consent, withdraw it at any time without affecting prior processing.
• Right to nominate: Nominate another individual to exercise rights on your behalf in the event of death or incapacity.

To exercise any of these rights, email privacy@messagebot.in with your registered email address and a description of your request. We will respond within 30 days as required under the DPDPA.

9. Cookies & Tracking Technologies

We use the following categories of cookies on messagebot.in:

10. Data Security

We implement industry-standard security measures including: TLS 1.2/1.3 encryption for all data in transit; AES-256 encryption for sensitive data at rest; multi-factor authentication on all internal systems; role-based access controls with principle of least privilege; regular third-party penetration testing; and ISO 27001-aligned information security management practices. In the event of a personal data breach that poses a risk to your rights, we will notify you and the relevant authority within the timeframes prescribed by the DPDPA 2023.

11. Cross-Border Data Transfers

Primarily, your personal data is stored and processed on servers located within India. Where data is transferred to processors outside India (for example, via Google Analytics or Meta WhatsApp Business API infrastructure), we ensure such transfers occur only to countries notified by the Central Government under the DPDPA as having adequate data protection standards, or under appropriate contractual safeguards.

12. Children's Privacy

Our services are intended solely for business use by adults aged 18 and above. We do not knowingly collect personal data from children under 18. If we become aware that a minor has provided personal data, we will delete it promptly. If you believe a minor has submitted data to us, contact privacy@messagebot.in.

13. Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in our data practices, applicable law, or our services. Where changes are material, we will notify you by email (to your registered address) or via a prominent notice on our dashboard at least 15 days before the changes take effect. The "Last updated" date at the top of this page indicates the most recent revision. Continued use of our services after the effective date constitutes acceptance of the updated policy.

14. Contact & Grievance Officer

For privacy-related queries, data requests, or complaints, contact our designated Grievance Officer: