Privacy Policy

1. About this policy

This Privacy Policy explains how Sensiblee Technologies Private Limited (“Sensiblee”, “we”, “us”), a company registered in Bengaluru, Karnataka, collects, uses, stores and protects personal data when you use our platform at sensiblee.in, the client application at app.sensiblee.in, our guest touchpoints (QR landing pages and WhatsApp flows), and any related support and billing channels.

It is written to comply with India's Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the rules framed under it, together with the Information Technology Act, 2000 and its applicable rules. Where guests or business users outside India interact with the platform, we apply GDPR-aligned practices on top of these commitments.

2. Our roles under the DPDP Act

For our subscribers' account data (owner and team profiles, billing contacts, login and audit records) and for usage telemetry, Sensiblee acts as the Data Fiduciary — the entity that determines the purpose and means of processing.

For the data our subscribers process through the platform — Google review content, guest phone numbers uploaded for review requests, and guest feedback captured via QR or WhatsApp — our subscriber (the business) is the Data Fiduciary and Sensiblee acts as its Data Processor, handling that data only on the subscriber's documented instructions. Guests who tap a QR code, send a WhatsApp reply or leave feedback are Data Principals with the rights described in section 11, and we enable those rights on the subscriber's behalf.

3. What we collect

Business data you give us: your name, business name, contact details, Google Business Profile locations you connect, brand-voice samples, reply templates you approve, and billing records.

Review data we receive through the official Google Business Profile API: review text, star rating, reviewer display name and profile photo (as exposed by Google), timestamps, and your published responses.

Guest contact data for review requests: names and phone numbers supplied by you or your POS/PMS integrations, strictly to send review invitations you have authorised. We record the consent basis for every contact you upload.

Guest feedback data: mood taps, star selections and private notes submitted through QR landing pages or WhatsApp flows, together with the optional phone number a guest chooses to leave for a follow-up.

Usage and technical data: product interaction events, device type, approximate city derived from IP, and server logs — used to keep the service fast, secure and audit-ready.

4. Notice and consent

Before or at the time of collecting any personal data, we provide an itemised notice stating what is collected, the specific purpose, the rights available and how to exercise them, and how to withdraw consent or reach our Grievance Officer — as required by Section 5 of the DPDP Act.

We process personal data on the basis of free, specific, informed, unconditional and unambiguous consent given by a clear affirmative action, in line with Section 6 of the DPDP Act. Guests give consent when they opt in to WhatsApp follow-ups or marketing circles; subscribers give consent when they connect Google profiles, upload guest lists or enable AI features. Consent managers registered under the DPDP framework can be used to manage permissions.

Withdrawing consent is as easy as giving it: a guest replies “STOP” (or unsubscribes in one tap), a subscriber disconnects Google or disables AI from the dashboard, and either may write to our Grievance Officer. We honour withdrawal without penalty, though it does not affect processing already carried out.

5. How we use data

We use personal data only for the purposes we stated: monitoring and scoring reviews (sentiment, keywords, urgency), drafting replies in your brand voice, dispatching WhatsApp review requests and QR flows, computing the Reputation Health Score, producing analytics and monthly reports, billing, and securing the platform.

We never sell personal data, never rent contact lists, never use guest phone numbers for unsolicited marketing beyond the consent recorded, and never run behavioural or targeted advertising at Data Principals — including children. We do not use dark patterns to obtain consent.

6. AI processing

Review text and approved brand-voice samples are processed by our AI provider under a zero-retention agreement to generate reply drafts, sentiment and keyword insights. Guest phone numbers and other direct identifiers are never sent to AI models. Drafts are suggestions only — nothing is published to Google until a human on your team approves it.

You may opt out of AI features at any time from Reputation controls; monitoring and request modules remain fully functional. Our AI use follows the Government of India's advisories on artificial intelligence, including responsible deployment, labelling of AI-generated or synthetically produced content where applicable, and prohibitions on unlawful or harmful synthetic media.

7. Google and WhatsApp platform terms

Google: Sensiblee's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We access reviews only through the official Business Profile API with your explicit OAuth consent, never scrape, and you can revoke access at any time from your Google account or our dashboard.

WhatsApp: every request campaign runs on pre-approved message templates through the WhatsApp Business Cloud API under Meta's Business Solution Terms. Messages go only to guests whose opt-in we hold on record; opt-outs are honoured immediately; and template quality ratings are monitored with automatic throttling to protect number standing.

8. Children's data

The platform is directed at business users, not children. Consistent with Section 9 of the DPDP Act, we do not knowingly process a child's personal data without verifiable consent from the child's parent or lawful guardian, and we do not undertake tracking, behavioural monitoring or targeted advertising directed at children.

Guest touchpoints are anonymous by design and collect nothing beyond what a guest voluntarily types. If we learn that a child's data has been collected without the required consent, we delete it and notify the subscriber to correct the underlying flow.

9. Sub-processors and cross-border transfers

We share personal data only with the sub-processors listed on our Security & Trust page: Google (Business Profile API) for review sync and posting, Meta (WhatsApp Cloud API) for message delivery, Razorpay for subscription payments, our AI provider for draft generation under zero-retention terms, and our hosting provider for application and database infrastructure in India. Each is bound by contractual confidentiality and security obligations, and we give advance notice of any new or replacement sub-processor.

Under Section 16 of the DPDP Act, personal data may be transferred outside India except to countries restricted by the Central Government. Where any processing occurs outside India, we apply equivalent contractual safeguards. Our primary hosting, database and encrypted backups remain in India (Mumbai).

10. Retention and erasure

We retain personal data only as long as the consented purpose lasts, and erase it when consent is withdrawn or the purpose is fulfilled, in line with Section 8(7) of the DPDP Act. Concretely: business and review data are retained while your subscription is active and for 90 days after cancellation, then permanently deleted; guest phone numbers are deleted 120 days after their last campaign activity; private guest feedback is retained per your configured schedule; and audit logs are kept for the statutory period applicable to them.

Encrypted backups roll off on a 30-day cycle, so residual copies age out of backups within one month of deletion. On written request we provide confirmation of erasure.

11. Your rights as a Data Principal

Under the DPDP Act you may: request a summary of the personal data we hold about you and the processing activities (Section 11); request correction, completion, updating or erasure of your personal data (Section 12); register a grievance (Section 13); and nominate another individual to exercise your rights in specified circumstances (Section 14).

Subscribers can exercise most rights directly from the dashboard (export, correction, deletion). Guests and other individuals can write to our Grievance Officer — we respond within 30 days as required under the DPDP framework, and usually within 7 working days. If you are unsatisfied with our response, you may escalate to the Data Protection Board of India.

12. Security safeguards and breach notification

We take reasonable security safeguards to prevent personal data breaches, as required by Section 8(5) of the DPDP Act: TLS 1.3 in transit, AES-256 at rest, role-based least-privilege access, enforced two-factor authentication for privileged roles, per-client encryption of OAuth tokens, immutable audit logs, and annual penetration testing. The full list lives on our Security & Trust page.

If a personal data breach occurs, we intimate affected Data Principals and the Data Protection Board of India without delay in the form and manner the DPDP framework requires, and no later than 72 hours from our own confirmation of the breach — alongside the CERT-In incident reporting obligations that apply to us as an Indian service provider.

13. Grievance redressal and Data Protection Officer

Our Grievance Officer and Data Protection Officer is the Head of Trust & Safety, Sensiblee Technologies Private Limited, Bengaluru, Karnataka. Write to dpo@sensiblee.in (or WhatsApp +91 93547 60585) with the subject “Data grievance”.

Please describe what data and which processing your grievance concerns. We acknowledge within 2 working days and respond within 30 days as required under the DPDP framework — usually much sooner. You are not required to pay any fee to file a grievance.

14. Changes to this policy

We may update this policy as the product, the DPDP rules or platform terms evolve. Material changes are announced in-app and on this page with a new “last updated” date at least 30 days before they take effect. Where a change requires fresh consent, we will ask for it rather than assume it.