Privacy Policy

AnsaFlow is a customer-support service that organizations use to talk with the people they serve (their customers, students or members) and with visitors to their websites. AnsaFlow is operated by [Legal entity name], registered office [Registered office address].

Under the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data Protection Rules, 2025, we have two roles:

• Data Processor for organizations. Each organization is the Data Fiduciary for the data of the people it serves and its other contacts. We process that data only on its instructions, under our Data Processing Agreement. Partner support providers the organization engages are further processors.
• Data Fiduciary for our own operational data: staff and administrator accounts, security logs, billing contacts and our marketing website.

If you are one of the people an organization serves, or a visitor to its website, that organization is your first point of contact, and its own privacy notice applies. The DPDP Act and Rules commence in phases [confirm commencement dates with counsel]; until then, section 43A of the Information Technology Act, 2000 and the SPDI Rules, 2011 also remain relevant.

• Names, phone numbers and the reference numbers an organization uses, such as customer or membership numbers.
• Details the organization adds, such as groups, plans, dates and other custom fields.
• Message text and attachments, including files, images and videos.
• Ticket metadata: number, category, status, assignee, timestamps, internal staff notes and optional feedback ratings.
• The name a person gives when they ask an organization a question as someone new (a new enquiry).
• Details an organization's website sends when it signs you in, such as your groups or plan.
• Staff assignments, availability, and performance and review records.
• Push-subscription endpoints, if you turn on notifications.
• IP addresses, security logs and audit records.
• One-time-code records (phone number, time and attempts). Codes are stored only in hashed form and expire after a short time.

We ask organizations to collect only what they need and to keep sensitive details, such as health or financial information, out of custom fields.

• Staff and administrator accounts: name, mobile number, email address if given, roles and sign-in activity.
• Security and service logs: IP addresses, browser and device details and security events.
• Billing contacts: name, email address, phone number and billing address.
• Enquiries and website visits: what you send us, and basic technical data.

We use browser storage only to keep you signed in and remember preferences, and we do not use advertising or cross-site tracking cookies [confirm before publication]. When we use security logs or one-time-code records to secure the service or meet a legal obligation, we act as a Data Fiduciary for that use.

Data comes from you when you sign in, write or give feedback; from the organization you contact, through contact imports, added details and single sign-on; from its staff and its partners' staff; from your browser or device; and from our SMS providers, such as delivery status.

For organizations, we process data to run their support workspaces: sign-in, ticket routing (including to partner support providers), messaging, notifications, malware scanning, service reports and, if enabled, AI features. Each organization must have a lawful basis, usually consent (for a child, verifiable consent from a parent or lawful guardian) or a legitimate use under section 7 of the DPDP Act, and must give the notice the Act requires.

For ourselves, we process data to manage accounts, secure the service, prevent abuse, meet legal obligations such as incident reporting under the CERT-In Directions, 2022, bill organizations and answer enquiries. We intend to rely on legitimate uses under section 7, and on consent where required.

We will not sell personal data, or use organizations' data for advertising or our own marketing.

AI features are off unless an organization turns them on. When they are on:

• The ticket text and limited context, such as team descriptions and published help articles, may be sent to the AI provider the organization selects.
• The result suggests a team, a clarifying question or an answer from the organization's published help articles. Uncertain cases go to a person.
• We design these features so that other people's messages, private staff notes and unpublished articles are not used to answer your ticket.
• We do not use personal data to train AI models, and we intend to use providers only on terms that bar training on the data we send [confirm each provider's current terms].

Some of the people that organizations serve through AnsaFlow may be under 18, and so are children under the DPDP Act.

• The organization is responsible for obtaining the verifiable consent of a parent or lawful guardian where the law requires it [counsel to confirm any exemptions for educational institutions under the Rules].
• We will not use children's data for tracking, behavioural monitoring or targeted advertising, or process it in a way likely to harm a child's well-being.
• AnsaFlow shows no advertising and does not verify ages. If you believe a child's data was shared without the required consent, please tell the organization and our grievance officer.

We share personal data only with the organization and its authorised staff; with partner support providers the organization engages, for the tickets routed to them; with the sub-processors below, as needed to run the service; and where the law or a lawful order requires it.

Notifications may show a short message preview on your lock screen; you can turn them off in your browser. We will give organizations advance notice of sub-processor changes.

Some sub-processors are outside India. Section 16 of the DPDP Act allows transfers except to countries the Central Government restricts by notification. We will not transfer personal data to a restricted country, and we will require sub-processors to protect it to a comparable standard. Organizations can limit transfers by choosing an India-based SMS provider and keeping AI features off.

• Organization data: while the organization's account is active. When an organization closes its account, its data is kept for a grace period of 30 days, during which it can export it or change its mind, and is then deleted [counsel to confirm the period], unless the law requires longer.
• Your data at an organization, if you ask it to delete it: removed when the organization approves your request, which it answers within 30 days unless it sets a shorter period [counsel to confirm]; the organization may keep what the law requires it to keep.
• Backups: overwritten within [Backup retention period — to be confirmed].
• One-time-code records and security logs: [Retention period — to be confirmed].
• Staff and administrator accounts: while active, and for [Retention period — to be confirmed] afterwards.
• Billing records: as long as tax and accounting laws require.
• Push subscriptions: until you turn notifications off or the subscription expires.

After that, we will delete or de-identify the data.

We design AnsaFlow to protect personal data with reasonable security safeguards, including:

• Encryption in transit (HTTPS).
• Short-lived, single-use, rate-limited one-time codes, stored only in hashed form.
• Access controls, so staff see only what their organization and role allow, and partner support providers see only the tickets routed to them.
• Malware scanning of attachments, and time-limited download links.
• Audit logs of important administrative actions.
• Encrypted, access-controlled backups [confirm before publication].

No system is completely secure, and we do not claim any security certification.

Under the DPDP Act, you have the right to:

• Access a summary of your personal data, its processing and who it was shared with.
• Have inaccurate or incomplete data corrected, completed or updated.
• Have data erased when it is no longer needed, unless the law requires it to be kept.
• Withdraw consent, where processing is based on consent.
• Have your grievances redressed.
• Nominate someone to exercise your rights if you die or become unable to do so.

The people an organization serves, and guests on its website, should contact that organization first, because it is the Data Fiduciary for their data. In the support app, Your data (in the account menu) lets you download a copy of what the organization keeps about you and ask it to delete your data; you see its answer there, and the reason if it declines. If you contact us, we will pass your request on and help the organization respond. Staff, administrators, billing contacts and website visitors can contact our grievance officer directly.

We may need to verify your identity. The DPDP Act also expects you to give accurate information and not to make false or frivolous complaints.

• Grievance officer: [Grievance officer name]
• Email: [Grievance officer email]
• Address: [Grievance officer postal address]

We will [acknowledge within X, resolve within Y — confirm with counsel]. Never include a one-time code in a complaint.

If you are not satisfied with the response to your grievance, from the organization or from us, you may complain to the Data Protection Board of India. The DPDP Act expects you to use the grievance process first [confirm commencement dates with counsel].

AnsaFlow is operated by [Legal entity name], [Registered office address]. For other privacy questions, write to [Privacy contact email].

This is version [version] of this policy. Each change gets a new version number. We will tell organization administrators in the product before a material change takes effect [Notice period — to be confirmed], and we record the version each organization acknowledged.