Privacy Policy

Grahak ("we", "us") operates grahak.me, a software service that helps local businesses communicate with their customers on WhatsApp and manage their Google Business Profile using AI. This policy explains what data we collect, why, and your rights, including under India's Digital Personal Data Protection Act, 2023 ("DPDP Act").

1. Who this applies to

• Business users: owners and staff who sign up for Grahak.
• End customers: people who message a business that uses Grahak, or whose details a business uploads. For this data, the business is the Data Fiduciary and Grahak processes it on the business's behalf as a Data Processor.

2. Data we collect

• Account data: name, email, phone number, business name, address, category, and an encrypted password.
• Business content: services, prices, opening hours, FAQs and other information you give the AI agent.
• WhatsApp data: customer phone numbers, WhatsApp profile names, messages sent and received through your connected WhatsApp Business number, message delivery status, and opt-in / opt-out status. Access tokens are stored encrypted.
• Contacts you upload: names, phone numbers, emails and tags you import or add.
• Google Business Profile data (only if you connect Google): your Google account email, the list of business locations you manage, reviews on your chosen location, and replies and posts you publish. OAuth tokens are stored encrypted.
• Technical data: a session cookie that keeps you logged in, and basic logs (IP address, time, errors) used for security and debugging.

3. How we use it

• To provide the service: show your inbox, generate AI replies, send campaigns you create, sync reviews and publish replies or posts you approve.
• To keep accounts secure, prevent abuse and fix problems.
• To contact you about your account and important service changes.

We do not sell personal data, and we do not use customer messages or Google data for advertising.

4. AI processing

To write replies, message text and your business information are sent to an AI model. By default this is Cloudflare Workers AI; a business may choose another provider (such as Anthropic or OpenAI). The data is used only to generate the reply and is not used by us to train AI models.

5. Google user data (Limited Use)

Grahak's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We request the business.manage scope only to read your reviews and business locations and to publish replies and posts that you approve. We do not use Google user data for advertising, do not sell it, do not allow humans to read it except with your consent, for security, or as required by law, and do not use it to train generalised AI models. You can disconnect Google anytime in Grahak (Google reviews → Disconnect) or at myaccount.google.com/permissions.

6. Service providers we share data with

• Cloudflare: hosting, database and AI processing.
• Meta Platforms: WhatsApp Business Platform, to send and receive messages.
• Google: Business Profile APIs, only when you connect Google.
• An optional AI provider chosen by the business (e.g. Anthropic or OpenAI).

We may also disclose data if required by law or to protect our users and service.

7. Storage, security and retention

• Data is stored on Cloudflare's infrastructure and may be processed outside India.
• Passwords are hashed; WhatsApp and Google tokens are encrypted; all traffic uses HTTPS.
• We keep account data while your account is active. After you delete your account, we delete your data within 30 days, except where the law requires us to keep it longer.

8. Your rights

You can access, correct or delete your data, withdraw consent, and nominate someone to exercise your rights. Business users can edit or delete most data directly in the app. End customers can reply STOP to any business on WhatsApp to stop marketing messages, and may contact that business, or us, to request deletion. See our Data Deletion page.

9. Children

Grahak is meant for businesses and is not directed at children under 18.

10. Grievance Officer

For any complaint or request about your personal data, contact our Grievance Officer at support@grahak.me. We aim to respond within 7 days. You may also approach the Data Protection Board of India.

11. Changes

We may update this policy. We will post the new version here and, for significant changes, notify business users by email.