Privacy Policy

This Privacy Policy explains how AI Grow Bot ("AiGrowBot", "we", "us" or "our") collects, uses, shares and protects personal data when you visit our website or use the AI Grow Bot WhatsApp marketing and automation platform (the "Service"). It is published as a notice under the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the rules made under it (the "DPDP Rules").

By using our website or the Service, or by giving your consent where we ask for it, you agree to the processing of your personal data as described here. You may request this notice in English or in any language listed in the Eighth Schedule to the Constitution of India by writing to us at the address in section 15.

1. Key terms

The following terms have the meaning given to them in the DPDP Act:

• Personal data — any data about an individual who is identifiable by or in relation to that data.
• Data Principal — the individual to whom the personal data relates (for example, you).
• Data Fiduciary — the person who decides the purpose and means of processing personal data.
• Data Processor — a person who processes personal data on behalf of a Data Fiduciary.
• Processing — any operation performed on personal data, such as collection, storage, use, sharing or erasure.

2. Our role

• We are a Data Fiduciary for the personal data of our website visitors, account holders, their team members and people who contact us.
• We are a Data Processor for the personal data our customers upload to or collect through the Service about their own customers — for example contact lists, WhatsApp conversations and leads. For this data, our customer (the business using AI Grow Bot) is the Data Fiduciary and we process it only on their instructions. If you are a contact of a business that uses AI Grow Bot, please reach out to that business first to exercise your rights; we will assist them as required.

3. Personal data we collect

• Account and profile data — name, email address, mobile number, business name, password (stored in hashed form) and the details of your team members.
• WhatsApp Business account data — your WhatsApp Business phone number, display name, business profile and the account identifiers we receive from Meta when you connect through Embedded Signup.
• Billing data — plan, invoices, billing name and address, GST details and transaction records. Card, UPI and bank details are entered on our payment gateway's pages and are not stored by us.
• Enquiry data — the name, email, phone number and message you send through our contact forms, email or WhatsApp.
• Usage and device data — IP address, browser type, pages visited, log and security records, and cookies (see section 13).
• Customer content — contacts, messages, templates, media, chatbot flows and leads that you add to or receive through the Service (processed by us as a Data Processor, see section 2).

4. Why we process your personal data

We process personal data only for lawful purposes, on the basis of your consent (section 6 of the DPDP Act) or for certain legitimate uses permitted by section 7 — for example, where you have voluntarily provided the data for a specific purpose, or where processing is needed to comply with law. We use personal data to:

• create and manage your account and provide the Service;
• connect your WhatsApp Business account and send, receive and deliver messages you instruct us to send;
• process payments, issue invoices and maintain accounting and tax records;
• respond to enquiries and provide customer support;
• send service, billing and security notifications;
• send product updates and offers, only where you have agreed to receive them — you can opt out at any time;
• keep the Service secure, prevent fraud and misuse, and fix errors;
• comply with legal obligations and lawful requests from authorities.

5. Consent and withdrawal of consent

Where we rely on consent, we ask for it through a clear affirmative action and only for the purpose described at the time. You may withdraw your consent at any time, as easily as you gave it, by using the unsubscribe option in our messages, changing your account settings or writing to us (section 15). Withdrawal does not affect processing done before it. After withdrawal we will stop processing — and ask our Data Processors to stop — within a reasonable time, unless the law requires or permits us to continue. If consent needed to provide the Service is withdrawn, we may not be able to continue providing it.

6. Your responsibilities for the data you send through AI Grow Bot

As the Data Fiduciary for your own customers' data, you are responsible for giving them proper notice, obtaining valid consent (including WhatsApp opt-in) before messaging them, honouring their requests to opt out, correct or erase their data, and complying with the DPDP Act and WhatsApp's Business and Commerce policies.

7. Who we share personal data with

We do not sell personal data. We share it only as needed to run the Service, with:

• Meta Platforms — to provide the WhatsApp Business Platform (Cloud API), Embedded Signup and, if you connect them, Facebook Lead Ads and Messenger;
• Payment gateways such as Razorpay — to process payments;
• AI providers such as OpenAI and Google (Gemini) — only when you enable AI features, to generate replies from the content you provide;
• Integrations you connect — such as Shopify, WooCommerce or webhooks you configure;
• Service providers who host our infrastructure, send emails and help us operate the Service, under contracts that require them to protect the data and use it only on our instructions;
• Government or law-enforcement authorities — where required by law or a valid legal process.

8. Transfer of data outside India

Some of our service providers (for example Meta and AI providers) may process personal data outside India. Such transfers are made in accordance with section 16 of the DPDP Act, and we will not transfer personal data to any country or territory that the Central Government has restricted by notification.

9. How long we keep personal data

We keep personal data only for as long as it is needed for the purpose for which it was collected. As required by section 8(7) of the DPDP Act, we erase personal data — and ask our Data Processors to erase it — when you withdraw consent or when the purpose is no longer being served, unless we must keep it longer to comply with law (for example, invoices and tax records). Customer content is deleted in line with our customer's instructions or after the account is closed.

10. How we protect personal data

We take reasonable security safeguards, as required by section 8(5) of the DPDP Act, to prevent personal data breaches. These include encrypted connections (HTTPS), hashed passwords, role-based access for your team, restricted internal access and logging. No method of transmission or storage is completely secure, but we work to protect your data and review our safeguards regularly.

11. Personal data breach

If a personal data breach occurs, we will inform the Data Protection Board of India and each affected Data Principal in the form and manner prescribed under the DPDP Act and the DPDP Rules, and take steps to contain and remedy it.

12. Your rights as a Data Principal

Under the DPDP Act you have the right to:

• Access information (section 11) — a summary of the personal data we process about you, the processing activities, and the identities of the Data Fiduciaries and Data Processors we have shared it with;
• Correction and erasure (section 12) — to correct, complete or update your personal data, and to have it erased when it is no longer needed, unless retention is required by law;
• Withdraw consent (section 6) — at any time, as described in section 5 above;
• Grievance redressal (section 13) — to have your complaint about our handling of your personal data addressed by us;
• Nominate (section 14) — to nominate another individual to exercise your rights in the event of your death or incapacity.

To exercise any of these rights, email us at support@aigrowbot.com with the subject "DPDP Request". We may ask you to verify your identity before acting on the request, and we will respond within the time period prescribed under the DPDP Rules.

13. Cookies

Our website and the Service use cookies that are necessary for them to work — for example to keep you signed in, remember your preferences and protect our forms against misuse. You can block or delete cookies in your browser settings, but some parts of the Service may then not work properly.

14. Children's personal data

The Service is meant for businesses and is not intended for anyone under 18 years of age. In line with section 9 of the DPDP Act, we do not knowingly process the personal data of a child without verifiable consent from a parent or lawful guardian, and we do not track, behaviourally monitor or target advertising at children. If you believe a child has given us personal data, please contact us and we will delete it.

15. Grievance Officer and contact

If you have any question, request or complaint about this Privacy Policy or how we process your personal data, please contact our Grievance Officer:

• Grievance Officer, AI Grow Bot
• Email: support@aigrowbot.com (subject: "DPDP Request" or "Grievance")
• Phone: +91 98702 17934

We will acknowledge and resolve grievances within the time period prescribed under the DPDP Rules. If you are not satisfied with our response, you may file a complaint with the Data Protection Board of India after first using our grievance redressal process, as provided in section 13(3) of the DPDP Act.

16. Your duties as a Data Principal

Section 15 of the DPDP Act requires Data Principals to comply with applicable law, not impersonate another person, not suppress material information, not register false or frivolous grievances or complaints, and provide only verifiably authentic information when asking for correction or erasure.

17. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in the law or in our Service. The "Last updated" date at the top shows when it was last changed. Where the changes are significant, we will notify you by email or through the Service and, where required, ask for your consent again.