Privacy Policy

• Account data — name, business name, email address and phone number provided when signing up for our products or contacting us.
• Business data — product catalogs, orders, customer records and other content that our business customers upload to or generate within our platforms.
• Messaging data — where a business customer connects their WhatsApp Business Account to ChatPeDukaan, we process the messages, phone numbers and order details exchanged between that business and its own customers, strictly to deliver the service.
• Usage and technical data — IP address, browser and device information, and log data generated when using our services.
• Payment data — handled by our payment processors. We do not store full card numbers on our systems.

• To provide, operate, secure and support our products.
• To route messages, orders and notifications between a business and its customers on that business's instruction.
• To respond to enquiries and provide customer support.
• To detect, investigate and prevent fraud, abuse and security incidents.
• To meet legal, tax and regulatory obligations.

ChatPeDukaan is built on the WhatsApp Business Platform. When a business customer connects their own WhatsApp Business Account, we act as a technology provider processing messages on their behalf and under their instruction.

Message content is used only to operate the service for that business. We do not use it to build advertising profiles, we do not sell it, and we do not use it to train models. Meta's own handling of data transmitted through the WhatsApp Business Platform is governed by Meta's privacy terms.

We process personal data where it is necessary to perform our contract with you, where we have a legitimate interest in operating and securing our services that is not overridden by your rights, where you have given consent, and where we are required to by law.

We share personal data only with service providers who help us run our services — hosting, messaging, analytics and payment infrastructure — under contracts that limit their use of it; with a business customer whose account the data belongs to; and where required by law or to protect our legal rights. We do not sell personal data.

Some of our infrastructure providers operate outside India. Where personal data is transferred abroad, we rely on contractual protections requiring the recipient to apply standards comparable to those described in this policy.

We retain personal data for as long as an account is active and for the period afterwards required to meet legal, accounting and dispute resolution obligations. Business customers may request deletion at any time, subject to those obligations — see our Data Deletion page.

Data is transmitted over encrypted connections and stored on infrastructure with access controls, logging and regular patching. Access to production data is limited to personnel who need it to operate or support the service. Our Security page describes these controls in more detail.

You may request access to, correction of, or deletion of your personal data, and may object to or restrict certain processing. Write to dipa@pingtail.com and we will respond within the timeframe required by applicable law.

Our website uses cookies necessary for the site to function and, where enabled, analytics cookies that help us understand usage. See our Cookie Policy for the full list and how to control them.

Our services are intended for businesses and are not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe we have, tell us and we will delete it.

We will update this policy as our services change and will revise the effective date above. Material changes will be notified to account holders by email.