Privacy Policy
How Capreact Private Limited collects, uses, stores and protects personal data when you use Varthaanam — including the messages you handle, the channels you connect, our AI processing, and the rights you have under India's DPDP Act and the GDPR.
Last updated: 5 October 2026
This Privacy Policy ("Policy") describes how Capreact Private Limited, the company that owns and operates the Varthaanam brand and platform ("Capreact Private Limited", "Varthaanam", "we", "our" or "us"), collects, uses, discloses, stores and protects personal data when you access or use our website, platform, mobile applications, APIs and related services (together, the "Services").
This Policy applies to everyone who uses the Services — visitors, trial users and paying subscribers. By accessing or using the Services you acknowledge that you have read and understood this Policy.
1. Scope of this Policy
This Policy governs:
- The Varthaanam website at https://varthaanam.com
- Your workspace, user accounts and dashboards
- The messaging channels you choose to connect — WhatsApp Business, Facebook Messenger, Instagram Direct, Gmail, custom email (IMAP/SMTP or Amazon SES) and the website chat widget
- AI features: conversation classification, summaries, suggested and automatic replies, and automated handoff
- Billing, customer support and our communications with you
It does not apply to third-party websites, platforms or services linked from Varthaanam, which are governed by their own policies.
1A. Notice at a glance (DPDP Act, section 5)
Section 5 of India's Digital Personal Data Protection Act, 2023 requires us to tell you, in plain language, exactly what personal data we process and why. The table below is that notice. The rest of this Policy expands on it.
| Personal data | Why we process it | Basis |
|---|---|---|
| Name, email address, password | Create and secure your account, and sign you in | Performance of contract |
| Workspace / company name, role, profile photo | Set up your workspace and control who can see what | Performance of contract |
| Channel access tokens (Meta, Google, email credentials) | Send and receive messages on the channels you connect, at your instruction | Performance of contract |
| Message content, attachments and contact identifiers | Deliver the unified inbox — the core function of the Services | Performance of contract |
| Conversation text sent for AI processing | Produce the classification, summary or suggested reply you asked for | Performance of contract |
| Billing details and transaction records | Take payment, issue GST invoices, meet tax and accounting duties | Contract / legal obligation |
| IP address, device and browser data, usage and audit logs | Security, abuse prevention, billing accuracy, service improvement | Legitimate use / legal obligation |
We do not run advertising, behavioural profiling or cross-site tracking, so there is no consent-based advertising processing to withdraw. This notice is available in English; on request to varthaanam@gmail.com we will provide it in any language listed in the Eighth Schedule to the Constitution of India.
2. Information we collect
2.1 Information you provide directly
- Full name and email address
- Login credentials (passwords are stored only as a hash)
- Workspace or business name, and the role you assign each member
- Channel credentials and OAuth tokens for the accounts you connect
- Knowledge-base content and AI training material you upload
- Subscription and payment details (handled by our payment processor)
- Anything you send us in a support conversation
2.2 Information collected automatically
- IP address, browser type, device type and operating system
- Usage data — features used, actions taken, frequency, timestamps
- Log files, diagnostic data and audit trails of administrative actions
- Channel connection status and delivery/error events
- AI usage and consumption metrics
This is used for security, abuse prevention, billing accuracy and service improvement.
2.3 Channel content you authorise us to access
When you connect a channel we receive, on your instruction, the message content and attachments, the contact identifiers attached to them (phone number, email address, social handle, display name), conversation metadata, and — where the platform provides it — delivery and read receipts.
Much of this is personal data about your own customers, not about you. For that data you are the Data Fiduciary (under the DPDP Act) or Controller (under the GDPR) and we act as your Data Processor: we process it only to run the Services for you. You are responsible for having a lawful basis to bring that data into Varthaanam, and for telling your own customers how you handle it.
We connect only through the official OAuth or Login flows of each provider. We never ask you for your personal social-media or email passwords.
3. AI processing and automated decision-making
Varthaanam uses AI models to:
- Classify conversations by intent, urgency and sentiment
- Summarise long threads
- Draft suggested replies for your team to review
- Answer from the knowledge base you provide
- Decide when a conversation should be handed to a human agent
To do this, the text of your customers' messages, the recent conversation history and the relevant parts of your knowledge base are sent to our AI provider, OpenAI, in the United States. Knowledge-base documents you upload are also sent to OpenAI to extract their text and build the search index. See sections 4.2 and 8.
Important AI disclosures
- AI output is probabilistic, not deterministic
- Generated replies may contain errors or inaccuracies
- No automated decision produces a legal or similarly significant effect on any individual
- Your workspace chooses how AI is used — Off, Suggest replies (an agent approves each draft before it is sent) or Auto-reply — and can change this at any time. In every mode your agents can reply to any conversation themselves
- You are responsible for reviewing AI-suggested replies before they are sent to your customers, and for replies sent automatically if you turn on Auto-reply
4. Content ownership and AI training
4.1 Ownership
You retain ownership of your workspace content, your knowledge base and the conversations in your inbox. We do not sell or license your content to third parties.
4.2 We do not train shared models on your messages
We do not use your messages, your customers' messages or your knowledge base to train shared or third-party AI models. Whenever AI is used — automatically, or when a team member asks it for a draft — the text needed for each task is sent to our model provider, OpenAI; the output is returned to your workspace and is not retained by us for training. Your data is not used to build advertising profiles.
We do use aggregated, de-identified operational metrics — volumes, latencies, error rates, feature usage — to measure and improve the platform. These contain no message content and no personally identifiable information.
5. How we use information
- Operate the Services and route messages between you and your customers
- Provide AI assistance within your own workspace
- Authenticate accounts and prevent abuse, fraud and misuse
- Process subscriptions and issue invoices
- Send transactional notifications (password reset, channel reconnect needed, billing)
- Provide customer support
- Monitor security, availability and capacity
- Comply with legal obligations and respond to lawful requests
We do not sell personal data.
6. Channel access and publishing authorisation
When you connect a channel to Varthaanam:
- You authorise us to read and send messages on that channel on your behalf
- Access is limited to what is required to run the Services
- Access tokens are encrypted at rest and are never exposed to your browser
- You can disconnect any channel at any time from the Channels page, which deletes the stored tokens for that channel immediately
We are not responsible for platform downtime, policy changes, rate limits or account restrictions imposed by the channel providers themselves.
9. International data transfers
Your data is processed outside India, principally in the United States. Our database, our message-processing compute and our AI provider, OpenAI, are in the United States; attachments, uploaded knowledge-base files and contact pictures are stored in the Asia-Pacific region; custom-domain email is processed by Amazon SES and the knowledge-base search index is kept in India (see section 8). We state this plainly because you are entitled to know where your customers' messages are handled.
We rely on the following transfer mechanisms:
- From India — section 16 of the Digital Personal Data Protection Act, 2023. We do not transfer personal data to any country restricted by notification of the Central Government.
- From the EEA/UK — the European Commission's Standard Contractual Clauses (Decision 2021/914) and, for the UK, the International Data Transfer Addendum; or an adequacy decision where one applies.
Each recipient is contractually bound to protection no less protective than this Policy.
10. Data retention
We retain personal data only as long as necessary to:
- Provide the Services while your workspace is active
- Meet legal, accounting, tax or regulatory requirements
- Resolve disputes and enforce our agreements
- Meet security-log retention duties — we retain security logs for 180 days as the CERT-In Directions of 28 April 2022 require
When you delete your workspace we remove personal data within 30 days, except where longer retention is required by law or for security and audit purposes. Backups are purged on their own rolling cycle.
11. Data security
We maintain administrative, technical and organisational safeguards including:
- TLS 1.2+ encryption in transit and encryption at rest
- Channel access tokens encrypted with AES-256 and never sent to the browser
- Role-based access control inside your workspace and least-privilege access for our personnel
- Multi-factor authentication on administrative access to production systems
- Managed secrets, network isolation and audit logging of administrative actions
- Separate production and test environments
- Regular backups and a documented restoration process
No system is perfectly secure, and we cannot guarantee absolute security.
12. Your responsibilities
You are responsible for:
- Keeping your credentials confidential and your team's access current
- Having a lawful basis for the customer data you bring into Varthaanam, and giving your own customers the notice their law requires
- Reviewing AI-suggested replies before sending them
- Complying with the policies of each channel you connect, including WhatsApp Business messaging rules and opt-in requirements
We are not liable for the content you or your team send to your customers.
13. Children's privacy
The Services are a business tool. They are not intended for, marketed to, or made available to individuals under 18. Registration requires confirmation that you are 18 or older.
Section 9 of the DPDP Act prohibits processing a child's personal data without verifiable parental consent, and prohibits tracking, behavioural monitoring and targeted advertising directed at children. We do none of these. If you believe a child has given us personal data, write to varthaanam@gmail.com and we will remove it.
14. Your rights
Depending on the law that applies to you, you have the right to:
- Access — obtain a summary of the personal data we hold about you and the processing we carry out (DPDP s.11; GDPR Art.15).
- Correct, complete and update — have inaccurate or incomplete data fixed (DPDP s.12; GDPR Art.16).
- Erase — have your personal data deleted where we no longer need it (DPDP s.12(3); GDPR Art.17).
- Nominate — nominate another individual to exercise your rights on your behalf in the event of your death or incapacity (DPDP s.14).
- Grievance redressal — raise a complaint with us before approaching the Data Protection Board (DPDP s.13). See section 20.
- Withdraw consent — for anything we do on the basis of consent, as easily as you gave it.
- Portability, restriction and objection — where the GDPR or UK GDPR applies (Arts.18, 20, 21).
- Complain to a regulator — the Data Protection Board of India, or your EU/UK supervisory authority.
Send requests to varthaanam@gmail.com. We respond within 30 days, and we will not charge you or degrade your service for exercising a right. We may ask you to verify your identity first.
If the request concerns data belonging to one of our customers' end-users, we will forward it to that customer rather than answer it ourselves — they are the Data Fiduciary for it.
14.1 Data deletion
You can withdraw Varthaanam's access to your accounts and have the data it holds deleted — including data obtained through connected Meta (Facebook, Instagram and WhatsApp) and Google accounts — as follows:
- Disconnect a channel — on the Channels page, choose Disconnect. This immediately deletes the stored access token for that channel and stops its messages reaching Varthaanam. Conversations already in your inbox stay until you delete the workspace.
- Revoke Meta access — on Facebook, open Settings → Business Integrations, find Varthaanam and choose Remove. This withdraws the access you granted Varthaanam through Facebook.
- Delete your workspace — email varthaanam@gmail.com from the workspace owner's email address and ask us to delete it. We delete the workspace and its data — connected-account tokens, conversations, contacts, attachments and knowledge base — within 30 days, except records the law requires us to keep (section 10).
Anyone else — a team member, or a customer of a business that uses Varthaanam — can ask for their personal data to be deleted as described in section 14 above.
15. Google API Services — Limited Use disclosure
When you connect a Gmail account, Varthaanam's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:
- We use Gmail data only to provide and improve user-facing features in the Varthaanam app — reading messages into your unified inbox, sending replies, and labelling or modifying on your behalf.
- We do not transfer Gmail data to others except as needed to provide those features, to comply with applicable law, or as part of a merger or acquisition (with notice).
- We do not use Gmail data for serving advertisements.
- We do not allow humans to read Gmail data unless we have your affirmative agreement for specific messages, it is necessary for security purposes such as investigating abuse, it is required to comply with law, or the data has been aggregated and anonymised for internal operations.
- We do not use Gmail data to train generalised or third-party AI/ML models. Per-workspace AI processing happens transiently to fulfil your in-app request.
You can revoke our access at any time at myaccount.google.com/permissions.
16. Meta Platform data — WhatsApp, Messenger and Instagram
When you connect a WhatsApp Business account, a Facebook Page or an Instagram professional account:
- We request authorisation to receive and send messages for the account you select, and to read their content (including media and files attached to them) and the conversation details that come with them, such as sender, recipient, time, message ID and delivery status.
- For a Facebook Page or Instagram account, we also read its posts and the comments people leave on them, so your team can see and answer them in Varthaanam. On your instruction, or under a comment rule you set up and can switch off, we publish replies on those posts on your behalf, edit or delete the replies we posted for you, hide or delete comments on your posts where Meta allows it, and send one private reply to a person who commented.
- We store your Meta access tokens encrypted on our servers and use them only to operate your connected accounts as described here. Tokens are never exposed to your browser, never sold, and never shared with third parties for their own purposes; only the service providers in section 8, acting on our instructions, host them.
- When Facebook or Instagram tells us that a person has deleted a comment or unsent a message, we delete our copy of it, including any files attached to it, from our active systems, unless the law requires us to keep it longer (for example under a legal hold or a request from a public authority).
- We do not access your advertising accounts or your ad performance data. Apart from the basic account details needed to connect and show your account (such as its name, ID, category and profile picture), we do not access data unrelated to the messages, posts and comments of the account you connected.
Varthaanam's use and transfer of information received from the Meta Platform APIs adheres to the Meta Platform Terms and Developer Policies. You may disconnect at any time from the Channels page, or remove Varthaanam under Settings → Business Integrations on Facebook. See section 14.1 for how to have this data deleted.
17. Payment processing
Subscription payments are processed by Razorpay Software Private Limited, India. Capreact Private Limited is the seller of record. Razorpay receives your name, email, billing details and the transaction amount, and processes them as an independent controller under its own privacy policy.
We never store full card numbers, CVV codes or bank account details on our servers. We retain only the transaction record and invoice needed for accounting and tax.
18. Business transfers
In the event of a merger, acquisition, asset sale or restructuring, personal data may be transferred as part of the transaction, subject to applicable law. We will give notice before your data becomes subject to a different privacy policy.
19. Data breach notification
If a breach compromises personal data, our obligations run on several clocks and we meet the shortest applicable one:
- CERT-In — within 6 hours. Cyber security incidents of the types specified in the CERT-In Directions of 28 April 2022 are reported to the Indian Computer Emergency Response Team within six hours of our noticing them.
- Data Protection Board of India — without delay. We notify the Board of every personal data breach, as the DPDP Act requires.
- Affected users — without delay, and in any event within 72 hours of becoming aware, where feasible. Business customers whose own customers' data is affected are notified within 48 hours, so they can meet their own 72-hour deadline.
- EU/UK supervisory authorities — within 72 hours where the GDPR or UK GDPR applies.
Every notification will describe the nature of the breach, the types of data and approximate number of people affected, the likely consequences, what we have done to contain it, and what you can do to protect yourself.
20. Grievance Officer
As required by section 13 of the Digital Personal Data Protection Act, 2023, rule 4(5) of the Consumer Protection (E-Commerce) Rules, 2020 and rule 3(2) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, Capreact Private Limited has appointed a Grievance Officer:
- Grievance Officer — varthaanam@gmail.com
- Data Protection Contact — varthaanam@gmail.com for access, correction, erasure, nomination or any question about how we process personal data
We acknowledge every complaint within 48 hours and aim to resolve it within 30 days. If you are not satisfied with the outcome, you may approach the Data Protection Board of India, the National Consumer Helpline (1915), or — if you are in the EU or UK — your national supervisory authority. Full details are on our Contact page.
21. Changes to this Policy
We may update this Policy. Material changes will be communicated by email or an in-app notice at least 7 days before they take effect. The "Last updated" date at the top always reflects the current version.
22. Contact
- Capreact Private Limited — operator of the Varthaanam platform
- Privacy and data requests: varthaanam@gmail.com
- General support: varthaanam@gmail.com
Full contact and escalation details are on the Contact page.