Privacy Policy

02Our two roles

Jawab handles two different kinds of personal data, and our responsibilities are different for each.

1. We are the data fiduciary for your account data

When a business owner, manager or staff member signs up and uses Jawab, we decide why and how their personal data is used — to run their account, bill them and support them. For this data, Jawab is the data fiduciary under the DPDP Act, and this policy applies in full.

2. We are a data processor for your customers' data

When a business uses Jawab to talk to its own customers — patients, clients, students, buyers — the business is the data fiduciary. It decides whom to message, what to store and why. Jawab is its data processor: we store and process that data only to provide the service, on the business's instructions, under our Terms of Service and Data Processing Addendum.

If you are a customer of a business that uses Jawab and you want to see, correct or delete your data, please contact that business first — it controls your data. If you cannot reach them, write to us at [email protected] and we will pass your request on and help them respond.

03What we collect

From business users (we are the fiduciary)

• Account details: name, work email, mobile number, and your role in the business.
• Business details: business name, industry, city, number of branches, GSTIN and billing address (for GST invoices).
• Sign-in data: one-time email codes, session records, and — if you use “Continue with Google” — your Google name, email and profile photo. We never see your Google password.
• Payment records: amounts, dates, invoice numbers and Razorpay payment references. Card, UPI and bank details are collected and stored by Razorpay, not by us.
• Usage and security logs: IP address, browser and device type, pages used, and an audit log of important actions (who changed a flow, exported contacts, and so on).
• Conversations with us: emails, WhatsApp messages and call notes when you contact support or sales, and the details you share during onboarding so we can build your automation.
• Website enquiries: name, phone number and business details you enter on jawabhq.com to book an audit or ask for a call.

From a business's customers (we are the processor)

• Name, WhatsApp number and WhatsApp profile name.
• Messages, photos, documents and voice notes exchanged with the business.
• Tags, notes, lead stage and assigned staff member, added by the business.
• Bookings and appointment history, reminders and payment status.
• Opt-in and opt-out status, and the date and way consent was given.

Some businesses — clinics and labs in particular — may receive health information in chats. That can be sensitive personal data under the SPDI Rules. The business is responsible for having a lawful reason and, where needed, consent to collect it. We protect it the same way as all customer data and never use it for our own purposes.

04How we use it, and on what basis

We use account data (where we are the fiduciary) to:

• create and secure your account, and let you sign in;
• build, run and support your WhatsApp automation;
• take payments, issue GST invoices and keep tax records;
• send service messages — sign-in codes, receipts, failed-payment alerts, outage notices;
• detect abuse, fraud and security incidents;
• improve the product using aggregated, de-identified usage figures;
• send product news, only if you have agreed to it — you can unsubscribe at any time.

Legal basis. We rely on your consent, given when you sign up and agree to this policy (section 6 of the DPDP Act), and on legitimate uses under section 7 — where you have voluntarily given us data for a specific purpose (such as an invoice), and where the law requires us to keep it (such as GST and accounting records). You can withdraw consent at any time by writing to [email protected]; this does not affect anything we did before, and we may then be unable to keep providing the service.

We use a business's customer data only to provide Jawab to that business. We do not sell it, rent it, use it for advertising, combine it across businesses, or use it to train AI models for anyone else.

05WhatsApp and Meta

Jawab is built on the official WhatsApp Business Cloud API from Meta. That means:

• Every message a business sends or receives through Jawab passes through Meta's servers. Meta handles that data under its own WhatsApp Business terms and privacy policy.
• A business can reply freely within 24 hours of a customer's last message. Outside that window it may only send Meta-approved template messages, and only to people who opted in.
• If a customer replies STOP (or a similar opt-out word), Jawab records the opt-out and stops all automated flows and broadcasts to that number before any other rule runs. The business can still answer questions the customer sends. Replying START opts the person back in.
• Each business connects its own WhatsApp Business number and Meta account. Its access token is kept encrypted in AWS Secrets Manager and used only to send and receive that business's messages.

06Who we share it with

We share personal data only with the service providers (“subprocessors”) we need to run Jawab, under contracts that require them to protect it and use it only for us:

If a business turns on an integration (for example a CRM, billing or calendar tool), data flows to that tool on the business's instructions and under the business's own contract with it.

We may also disclose data when Indian law requires it — for example to a court, the Data Protection Board of India, CERT-In or a law enforcement agency with a valid order — or to protect people's safety. If YS Digital Studio Private Limited is merged or sold, data would pass to the new owner under the same protections, and we would tell you first.

07Where your data is stored

Our database, file storage, backups and logs are hosted on Amazon Web Services in Mumbai (ap-south-1). Customer data is stored in India.

Some providers in the list above — Meta, Google and Resend — may process data outside India to deliver their part of the service (for example, WhatsApp messages travel through Meta's global network). The DPDP Act allows this except to countries the Government of India restricts; we will stop any transfer that becomes restricted.

08How long we keep it

• While your account is active, we keep your data so the service works.
• When a business cancels, the account stays read-only for 30 days so you can export everything. After that we delete chats, contacts, bookings and other customer data. Encrypted backups are overwritten within a further 35 days.
• When an owner deletes an account, we offer an export first, wait a 7-day grace period, then delete the personal data.
• Invoices and payment records are kept for as long as tax and company law requires (currently up to eight years), even after the account is closed.
• Security logs are kept for 180 days, as CERT-In directions require, and then deleted.
• Website enquiries that never become customers are deleted after 12 months.

09How we protect it

We follow reasonable security practices as required by section 8(5) of the DPDP Act and the SPDI Rules, including:

• encryption in transit (HTTPS/TLS) and at rest for the database, backups and secrets;
• strict separation between businesses, so one business can never see another's data;
• role-based access inside each business (owner, manager, agent, viewer and custom roles), with passwordless sign-in by one-time codes that expire in 10 minutes and are rate-limited;
• no standing access for our own staff: a Jawab team member can open a business's account only to help it, must record a reason, gets read-only access for 15 to 60 minutes, and every such visit is written to that business's audit log;
• daily backups, monitoring and alerting.

No system is perfectly secure. If a personal data breach happens, we will inform affected businesses without undue delay, and notify the Data Protection Board of India, CERT-In and affected people as the law requires.

10Your rights

Under the DPDP Act you (the “data principal”) have the right to:

• Access a summary of the personal data we hold about you and how we use it, and know whom we have shared it with;
• Correct, complete or update data that is wrong or incomplete — much of it you can change yourself in Settings;
• Erase data we no longer need, unless the law requires us to keep it;
• Withdraw consent at any time;
• Grievance redressal — raise a complaint with our Grievance Officer and get a response;
• Nominate someone to exercise these rights on your behalf if you die or become unable to.

To use any of these rights, email [email protected] from your registered email address. We may ask you to confirm your identity. We aim to respond within 30 days. If you are not satisfied with our answer, you can complain to the Data Protection Board of India.

If you are a customer of a business using Jawab, please send your request to that business (see “Our two roles” above).

11Children

Jawab is a tool for businesses. You must be at least 18 to create an account, and we do not knowingly collect children's data as a fiduciary.

Some businesses — coaching institutes, for example — may talk to students under 18. Under section 9 of the DPDP Act, that business must obtain verifiable consent from a parent or guardian before processing a child's data, and must not track or target children with advertising. Jawab processes such data only as the business's processor.

12Cookies and local storage

We keep this minimal:

• A session cookie keeps you signed in to the app. It is strictly necessary, cannot be read by page scripts, and ends when you sign out or the session expires.
• Your theme choice (light or dark) is saved in your browser's local storage. It never leaves your device.

We do not use advertising cookies or third-party tracking pixels.

13Changes to this policy

If we change this policy, we will update the date at the top of this page. For significant changes — such as a new purpose or a new subprocessor — we will email account owners at least 15 days before the change takes effect.

14Grievance Officer and contact

In line with the DPDP Act, the IT Act and the SPDI Rules, our Grievance Officer handles privacy questions and complaints. We will acknowledge your complaint within 48 hours and aim to resolve it within 30 days.

Name

[Grievance Officer name — to be added]

Designation

Grievance Officer

Email

[email protected]

Address

[Grievance Officer postal address — to be added]

For anything else about privacy, write to [email protected]. YS Digital Studio Private Limited, [Registered office address — to be added], Bengaluru, Karnataka [PIN], India.