Privacy Policy

This policy explains how Swastik processes personal data in connection with Engage. We comply with India's Digital Personal Data Protection Act, 2023 and, where applicable, the GDPR.

1. Data we collect

• Account data: name, email, organization, role, authentication and security events.
• Customer content: contacts, messages, media and templates you process through Engage.
• Usage data: logs and metrics needed to operate, secure and bill the service.

2. How we use it

To provide and secure the service, process payments, send transactional emails, provide support and meet legal obligations. We do not sell personal data or use customer content to train models.

3. Sharing

With Meta (to deliver WhatsApp messages), payment processors (Razorpay, Stripe), email and infrastructure providers under contract — only as needed to run the service.

4. Retention

Message bodies and media are kept for 180 days by default (configurable per organization); logs for 30 days; audit records for one year.

5. Security

Encryption in transit and at rest, encrypted secrets (AES-256-GCM), role-based access, 2FA and a tamper-evident audit log. See Security.

6. Your rights

You may access, correct, export or erase your personal data. Organizations can export or erase a contact's data from the dashboard. Contact privacy@swastik.ai.

7. Data Processing Addendum

For customer content, your organization is the data fiduciary/controller and Swastik is the processor. Our DPA covers processing instructions, sub-processors, security measures, breach notification within 72 hours, assistance with data-subject requests, and deletion on termination. Request a countersigned copy at legal@swastik.ai.