Your guests' data, guarded.
Sensiblee sits between your Google profile, your guests' WhatsApp and your team. Here is exactly how that data is handled, protected and governed — under India's DPDP Act, CERT-In directives, and the Google and Meta rulebooks.
Encrypted in transit & at rest
TLS 1.3 for every connection, AES-256 for stored data. Review content, guest phone numbers and reply drafts never travel unencrypted — internally or to your browser.
Minimal, purpose-bound data
We hold only what reputation work needs: Google review content, the guest phone numbers your team explicitly uploads for requests, and product telemetry. Nothing scraped, nothing bought.
Role-based access & audit trail
Owner, Manager and Observer roles with least-privilege defaults. Every reply approval, campaign send and settings change is written to an immutable audit log you can export.
Hosted in India, backed up daily
Workloads run on isolated VPS infrastructure in Mumbai with daily encrypted backups and 30-day retention, aligned to CERT-In's logging directives. Restores are tested quarterly — not assumed.
Platform compliance, in plain language
Three rulebooks govern what we do — India's Digital Personal Data Protection Act and CERT-In directives, Google's review APIs, and Meta's WhatsApp policies, with responsible-AI guardrails on top. We treat all of them as product requirements, not legal fine print.
Google Business Profile API terms
Sensiblee accesses reviews exclusively through the official Google Business Profile API with your explicit OAuth consent, and our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We never scrape, and you can revoke access from your Google account at any time.
WhatsApp Business policy compliance
Every campaign runs on pre-approved message templates through the WhatsApp Business Cloud API under Meta's Business Solution Terms. Consent is recorded per contact, opt-outs are honoured immediately, and template quality ratings are monitored continuously with automatic throttling to protect your number standing.
DPDP Act 2023 aligned
Our notice, consent, erasure and grievance workflows are built for India's Digital Personal Data Protection Act — Section 5 itemised notices, Section 6 clear-affirmative consent, Section 8(7) erasure, and Section 13 grievance redressal. We cooperate with the Data Protection Board of India and commit to breach intimation within 72 hours, aware of the Act's penalty framework that runs to ₹250 crore for security-safeguard failures.
IT Act 2000 & CERT-In directives
We maintain reasonable security practices under the Information Technology Act and its rules, and comply with CERT-In's 2022 cyber-security directives — 180-day traffic-log retention, synchronised time sources and incident reporting to CERT-In within the mandated six-hour window, coordinated with our own 72-hour DPDP breach commitments.
AI with guardrails
Our AI provider operates under a zero-retention agreement; guest phone numbers and direct identifiers never reach a model. Every public word is human-approved before posting, and our deployment follows MeitY's advisories on responsible AI — including labelling of AI-generated or synthetic content where applicable and a full opt-out from AI features.
Payments & data residency
Payments run through Razorpay under RBI's payment and e-mandate frameworks — card and UPI credentials never touch our servers. Application data, database and encrypted backups stay in India (Mumbai); any cross-border processing follows Section 16 of the DPDP Act with equivalent contractual safeguards.
Subprocessors
Every third party that touches your data, and why.
| Provider | Purpose | Data shared | Region |
|---|---|---|---|
| Google Business Profile API | Review source (read-only) | Reviews, ratings, replies | Global (Google) |
| WhatsApp Business Cloud API | Request delivery | Opted-in phone numbers, template status | Meta (EU/IN) |
| Razorpay | Payments & auto-debit (RBI-regulated) | Billing contact, invoice history — never card data | India |
| LLM inference provider | Draft & sentiment engine (zero-retention) | Review text (no guest PII) | India / EU endpoints |
| VPS provider (Hostinger) | Application & database hosting | All stored data (encrypted) | India (Mumbai) |
Operational commitments
99.9%
monthly uptime target
15 min
review sync cadence
24 h
support response, WhatsApp & email
RPO 24h
backup point · RTO under 4h
Status page with incident history ships with Phase 2. In the meantime, incidents are announced on your WhatsApp digest within 30 minutes of confirmation.
Security practices
- Two-factor authentication enforced for all owner and admin roles
- OAuth tokens stored with per-client encryption; revocable in one click
- Quarterly access reviews and least-privilege audits
- Documented incident-response runbook — 72-hour DPDP breach notification plus CERT-In six-hour incident reporting
- Annual penetration test before each major release train
- Quarterly backup-restore drills with results recorded in the audit log
- Immutable, exportable audit trail behind every approval, send and setting change
See it on your own reviews
Happy to walk your IT or legal team through our architecture — just ask.