Data Use Policy

This Data Use Policy explains how NotifyTechAI ("we", "our", or "us") collects, processes, and protects personal data in accordance with the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Digital Personal Data Protection Rules, 2025 ("DPDP Rules") of India.

The DPDP Act and Rules are being brought into force in phases. Provisions covering notice, consent, children's data, security safeguards, and breach reporting become fully binding on 13 May 2027. NotifyTechAI is aligning its practices with these obligations ahead of that deadline. This policy sits alongside, and does not replace, our Privacy Policy, which covers our data practices more broadly.

Before we collect any personal data from you, we provide a clear, standalone notice — separate from our Terms & Conditions — explaining what data we collect, why, and how you can exercise your rights over it. We do not bundle this notice into unrelated agreements or hide it behind other text.

This notice is currently published in English. As a Data Principal, you have the right to request this notice and our consent flow in any of the 22 languages listed in the Eighth Schedule of the Constitution of India — write to support@notifytechai.com and we will provide it in your preferred language.

We only process your personal data for the specific, narrow purpose disclosed to you at the time of collection — never for an undisclosed or unrelated purpose. These purposes include:

• Routing your WhatsApp conversations and delivering messages through our platform
• Operating your account — authentication, tenant provisioning, and team access control
• Processing your subscription, billing, and payment records
• Responding to support requests you submit to us
• Complying with applicable Indian law, including tax and accounting record-keeping

If we ever want to use your data for a new purpose beyond what you originally consented to, we will ask for your consent again before doing so.

We collect only the personal data strictly necessary to deliver the specific service you have signed up for. We do not request optional fields unrelated to the core functionality of connecting your WhatsApp number, managing conversations, running campaigns, and maintaining your contact book.

Where a data field is genuinely optional (for example, notes on a contact record), we make that clear at the point of collection rather than presenting it as required.

Under the DPDP Act, you have the following rights over the personal data we hold about you:

• Access — request a summary of the personal data we hold about you and the processing we carry out
• Correction — ask us to correct inaccurate or incomplete data
• Erasure — request deletion of your personal data once it is no longer needed for the purpose it was collected for
• Withdrawal of consent — withdraw consent at any time, as easily as you gave it, without affecting processing already carried out
• Grievance redressal — raise a complaint with us directly, and escalate to the Data Protection Board of India if unresolved

To exercise any of these rights, contact us at support@notifytechai.com.

We delete personal data as soon as you withdraw consent or the purpose it was collected for has been fulfilled, subject to limited legal retention obligations. In practice:

• Account and profile data is deleted within 30 days of a deletion request
• Message history and campaign records within your workspace are deleted in the same 30-day window
• Billing records are retained for 7 years as required under Indian Accounting Standards and GST regulations — this is a legal retention exception, not a general practice

To withdraw consent or request erasure, email support@notifytechai.comwith the subject line "Data Erasure Request".

NotifyTechAI is a business platform and is not directed at individuals under the age of 18. We do not knowingly collect or process personal data from minors. If you believe a minor has created an account or otherwise had their data processed by us, contact support@notifytechai.com and we will promptly investigate and delete the relevant data.

We apply reasonable security safeguards appropriate to the personal data we hold, including:

• Encryption in transit via TLS 1.2+ for all API and dashboard traffic
• Encryption at rest for database volumes and file storage
• Strict multi-tenant isolation — each business's data, contacts, conversations, and sessions are logically separated and inaccessible to other tenants
• Role-based access control, so team members only access what their assigned role permits
• Refresh token rotation and httpOnly cookie authentication to reduce session-hijacking risk
• Regular security reviews and dependency audits

No method of transmission or storage is 100% secure. If you believe your account has been compromised, contact us immediately at support@notifytechai.com.

If we become aware of a personal data breach, we will notify the Data Protection Board of India and all affected Data Principals without undue delay, describing the nature of the breach, the data affected, and the steps we are taking in response — in line with our obligations under the DPDP Act and Rules.

The Central Government may, from time to time, designate certain organisations as "Significant Data Fiduciaries" (SDFs) based on factors such as the volume and sensitivity of personal data they process. NotifyTechAI is not currently designated as an SDF.

If and when the Government designates NotifyTechAI as an SDF, we will comply with the corresponding obligations under the DPDP Act and Rules, which may include appointing a India-based Data Protection Officer, engaging an independent data auditor, and conducting periodic Data Protection Impact Assessments. We will update this policy to reflect that status if it applies.

If you have a complaint about how we process your personal data, you can reach our Grievance Officer directly:

We aim to resolve grievances promptly, and no later than 90 days from when we receive your complaint. If you remain unsatisfied with our response, you may escalate your complaint to the Data Protection Board of India.

We may update this Data Use Policy from time to time, including as the DPDP Act's remaining provisions come into force. When we make material changes, we will notify you via an email to the address registered on your account and an in-app banner visible at your next login. The "Last updated" date at the top of this page reflects the most recent revision.

For any questions about this policy or your personal data, reach out to us: