Legal
Privacy policy
Last updated 29 October 2026
- We collect only what’s needed to run a business’s assistant and its account.
- Customer chats belong to the business you’re talking to. Phalsa processes them on its behalf.
- We never sell personal data or use chats for advertising.
- Data is encrypted in transit, access is logged, and chats are deleted automatically after a set time.
- You can ask for a copy, a correction or deletion at hello@phalsa.ai.
1. Who is responsible
Phalsa is operated by Phalsa, India (“we”). This policy covers two groups of people:
- Businesses and their staff who use Phalsa. For their account data, we decide how it’s used (we are the “data fiduciary” under India’s Digital Personal Data Protection Act, 2023, and the “controller” under the GDPR).
- Customers who message a business that uses Phalsa, on WhatsApp or the business’s website. For their data, the business is responsible; we process it only on the business’s instructions (we are its “data processor”). If you are a customer, the business’s own privacy notice also applies, and you can contact the business or us.
2. What we collect
| Whose | What | Where it comes from |
|---|---|---|
| Businesses and staff | Name, email, password (stored only as a one-way hash), business details, settings, services, prices and hours; payment records (plan, amount, Razorpay payment ID — never card or bank details); security log entries (login times, IP address). | You, when you sign up and use the dashboard; Razorpay when you pay. |
| Customers of a business | WhatsApp number or website chat ID, the name they share, messages, answers to the business’s questions, bookings, and whether they opted out. | The customer, when they message the business. |
| Website visitors | Details typed into the demo request form (name, business, phone, city, message). | You, when you ask for a demo. |
We don’t use advertising or tracking cookies. We use one essential cookie to keep you logged in. Fonts are loaded from Google Fonts, which receives your IP address when a page loads.
3. Why we use it
- To run the Service: answer customers, manage bookings, send reminders, show the business its inbox and reports (contract with the business).
- To create and secure accounts, prevent abuse and keep a security log (legitimate use / legal obligation).
- To take payments, issue receipts and keep tax records (contract and legal obligation).
- To reply to demo requests and support messages (your consent, which you can withdraw).
We do not sell personal data, rent it, use it to advertise, or use customer conversations to train AI models.
4. Who we share it with
We use a few trusted providers (“sub-processors”) only as needed to run Phalsa:
| Provider | Purpose |
|---|---|
| Meta Platforms (WhatsApp Business Platform) | Receiving and sending WhatsApp messages |
| Cloudflare | Secure connection (HTTPS) and protection between the internet and our server |
| Razorpay | Processing payments and refunds |
| Anthropic (only if the business turns on AI answers) | Answering free-form questions; the message and the business’s details are sent, and are not used by Anthropic to train its models under its commercial terms |
| Google (Gmail) | Sending account emails such as password resets and receipts |
We may also share data when the law requires it, or to protect people’s safety. Some providers process data outside India; where they do, they are bound by contract to protect it.
5. How long we keep it
- Customer chats: deleted automatically after 24 months by default. Each business can choose 6, 12, 24 or 36 months, or to keep them.
- Business accounts: until the business closes its account. Closing the account deletes its data straight away; daily backups that contain it are overwritten within 14 days.
- Payment records: as long as Indian tax law requires (up to 8 years).
- Security log: 1 year.
- Demo requests: up to 12 months after we last spoke.
6. How we protect it
Connections use HTTPS. Passwords are hashed with scrypt. WhatsApp access tokens are encrypted (AES-256-GCM). Each business can only see its own data. The Phalsa team uses separate logins, and every time a team member opens a business’s dashboard it is logged. Messages from WhatsApp and Razorpay are checked for a valid signature. Read more on our security page.
If a personal data breach happens, we will inform the affected businesses without delay, help them inform their customers where needed, and notify the Data Protection Board of India and other authorities as the law requires.
7. Your rights
Depending on where you live, you can ask to see the personal data we hold about you, correct or update it, delete it, withdraw consent, or nominate someone to act for you. You can also complain to the Data Protection Board of India or your local data-protection authority.
- Businesses: download everything or close your account any time from Settings → Team & account → Data & privacy.
- Customers: reply STOP to stop messages. To see or delete your data, ask the business, or write to us and we’ll pass it on and help. Businesses can erase a customer from their Customers page.
We reply to requests within 30 days, and sooner when we can.
8. Children
Phalsa is for businesses and is not meant for children. Businesses must not use it to knowingly collect data from children without the consent the law requires.
9. Data processing terms (for businesses)
When we process your customers’ personal data, we will:
- process it only to provide the Service and on your documented instructions (your settings count as instructions);
- make sure everyone who handles it is bound to confidentiality;
- keep the security measures described above, and tell you without undue delay about any breach affecting your data;
- use only the sub-processors listed above, and tell you before adding a new one so you can object;
- help you answer your customers’ requests to see, correct or delete their data;
- delete your data when you close your account (except what the law requires us to keep), and let you download it first.
10. Grievance officer and contact
Questions, requests or complaints about personal data: Phalsa, Grievance Officer, hello@phalsa.ai, Hyderabad, Telangana, India.
11. Changes
We’ll post any update here and change the date at the top. For important changes we’ll also tell businesses by email or in their dashboard.