Privacy Policy

1. Identification & Our Role as Data Fiduciary / Processor

Entity Details: GoGroww Technologies is a digital engineering, marketing agency, and Meta Tech Provider headquartered at 186/1008 Urban Vihar, Ludhiana, Punjab 141013, India (Website: https://gogroww.in | Corporate Email: privacy@gogroww.in).

Role as Data Fiduciary (Data Controller): We act as a Data Fiduciary when collecting information from visitors to our website, prospective leads submitting audit or proposal forms, and direct clients establishing subscription accounts with us.

Role as Data Processor (Business Associate): When our business clients utilize the GoGroww Messaging portal to connect their WhatsApp Business Accounts (WABA), upload contacts, create message templates, or dispatch communications to their end-customers, GoGroww acts strictly as a Data Processor. Our client remains the Data Fiduciary (Data Controller) responsible for lawful collection and consent, and GoGroww processes end-customer messaging solely on our client’s instructions and in accordance with Meta Platform Terms.

2. Information We Collect

Direct Account & Contact Information: When you contact us, register for an account, or request a service audit, we collect your full name, business or company name, corporate email address, telephone/WhatsApp number, billing address, and Goods and Services Tax Identification Number (GSTIN) where applicable.

Meta Platform & WhatsApp Business Cloud API Data: As an independent Meta Tech Provider, when you connect your WhatsApp Business Account to GoGroww Messaging via Meta Embedded Signup, we collect and process: Meta Business Portfolio IDs, WhatsApp Business Account (WABA) IDs, Phone Number IDs, WhatsApp display names, account quality ratings, messaging tier limits, pre-approved message templates, and Cloud API system access tokens.

Coexistence Mode Information: When you link an active phone number using Meta Coexistence (enabling you to continue using the WhatsApp Business mobile application while simultaneously operating the Cloud API on the same number), our system receives inbound and outbound webhook synchronization events to reflect status in your shared team inbox. We do not access, scan, or copy personal files, photos, or unrelated third-party applications on your mobile device.

Customer Messaging & CRM Data: At the instruction of our clients, our platform processes incoming and outgoing message payloads, message IDs (wamid), text messages, media attachment links (images, PDFs, documents), customer phone numbers (E.164 international format), delivery status notifications (sent, delivered, read, failed), customer opt-in timestamps, custom CRM attributes, and contact segment tags.

Technical & Usage Information: When browsing gogroww.in or using our client dashboard, we automatically log IP addresses, browser types, operating systems, referring URLs, request timestamps, and privacy-respecting aggregate performance metrics.

No Children’s Data & No Sensitive Data: Our services are designed strictly for commercial businesses and adults. We do not knowingly collect personal data from individuals under 18 years of age, nor do we collect special categories of sensitive personal data (such as genetic, biometric, religious, or health records).

3. How We Use Your Information & Purpose of Processing

Delivering WhatsApp Business API Services: To provision Meta Embedded Signup onboarding, sync WhatsApp Business accounts, register phone numbers, submit and manage message templates, power shared team inboxes, and execute client-scheduled broadcasts.

Executing Digital & Agency Engagements: To deliver search engine optimization (SEO), digital marketing campaigns, web and mobile application engineering, and custom AI workflow automations.

Billing, Accounting & GST Compliance: To calculate Meta Cloud API conversation charges, manage prepaid wallets, process subscription billing through PCI-DSS certified gateways (Razorpay), and generate statutory B2B tax invoices adhering to Indian GST laws.

System Reliability & Security: To monitor Cloud API rate limits, verify incoming Meta webhook HMAC-SHA256 signatures, authenticate user logins, prevent fraud, mitigate spam, and troubleshoot service interruptions.

Absolute Zero-Sale Guarantee: GoGroww DOES NOT sell, rent, lease, monetize, broker, or trade personal data, end-customer phone numbers, or messaging transcripts to any third-party advertisers, data aggregators, or external companies under any circumstances.

4. WhatsApp Business Policy, Meta Platform Terms & Opt-In Safeguards

WhatsApp Policy Compliance: All clients utilizing GoGroww Messaging must strictly adhere to the WhatsApp Business Messaging Policy and Meta Commerce Policy. Prohibited goods, services, or deceptive messaging are strictly barred.

Mandatory Prior Opt-in: Under WhatsApp policy and applicable privacy laws, clients are legally obligated to obtain verifiable prior opt-in from recipients before sending proactive marketing or utility template messages. GoGroww provides automated opt-in tracking tools to assist clients with compliance.

Automated Opt-Out & Stop Handling: GoGroww Messaging automatically recognizes and processes standard opt-out keywords (e.g., "STOP", "UNSUBSCRIBE", or quick-reply opt-out buttons). Once an end-user opts out, the platform suppresses further outbound marketing messages to that number unless re-authorized.

24-Hour Customer Care Session Window: Customer-initiated service chats are conducted within the rolling 24-hour service window mandated by Meta Cloud API protocols. Outside this window, messages can only be initiated using pre-approved Meta message templates.

5. Legal Bases for Processing (DPDP Act 2023 & GDPR)

Contractual Necessity: Processing is required to perform our contractual commitments under client service agreements and SaaS terms of service.

Explicit Consent: Where required (such as for optional marketing broadcasts, newsletters, or new product announcements), we process personal data based on your voluntary consent, which can be revoked at any time.

Legitimate Uses & Legitimate Interests: Processing is conducted for legitimate purposes recognized under Section 7 of the India DPDP Act 2023 and Article 6(1)(f) of the GDPR, including responding to queries voluntarily submitted by you, safeguarding portal security, and maintaining network integrity.

Legal Compliance: Fulfilling obligations mandated by statutory Indian authorities, including tax records under the Goods and Services Tax Act and corporate reporting requirements.

6. Third-Party Service Providers & Sub-processors

Meta Platforms, Inc. & WhatsApp LLC: Provides the core WhatsApp Cloud API infrastructure, template approval engines, phone number verification, and webhook event delivery.

Cloud Hosting & Infrastructure: Secure dedicated virtual private servers and managed databases located in enterprise-grade data centers equipped with firewall protection, DDoS mitigation, and encrypted backups.

Payment Gateways: Razorpay Software Private Limited processes Indian Rupee (INR) payments, subscription renewals, and GST invoicing under strict PCI-DSS Level 1 compliance. We do not store sensitive credit/debit card numbers on our servers.

Transactional Email & Operational Utilities: Encrypted transactional email relays (for password resets and system alerts) and internal monitoring tools.

International Transfers: Where data is processed across borders, we ensure appropriate safeguards including standard contractual clauses and rigorous technical protections are implemented.

7. Data Retention & Deletion Schedules

Account & Profile Information: Stored for the duration of your active subscription or contractual engagement, plus 90 days following account closure to facilitate seamless reactivation if requested.

WhatsApp Messaging Transcripts & Logs: Stored for a default rolling period of 90 to 180 days (or the customized retention duration configured by the client administrator), after which conversation contents and media links are permanently purged from active databases.

Financial & Tax Records: Invoices, payment receipts, and GST ledgers are retained for 7 years in mandatory compliance with Indian taxation and corporate statutory standards.

Backups: Encrypted server backup snapshots are maintained on an automated 30-day rolling rotation, after which deleted records are irrevocably overwritten.

8. User Data Deletion Instructions & Revocation of Permissions

Meta User Data Deletion Callback: In strict compliance with Meta Platform Terms, GoGroww maintains a publicly accessible User Data Deletion Instructions page at https://gogroww.in/data-deletion.

Revoking Permissions via Facebook Settings: You can disconnect GoGroww Messaging from your Meta account at any time by visiting Facebook Settings & Privacy > Settings > Apps and Websites > Select "GoGroww Messaging" > Click "Remove". When selected, Meta triggers our automated data deletion callback URL.

Self-Service Deletion Portal: Any user or client can submit a self-service deletion request directly at https://gogroww.in/data-deletion by providing their registered phone number or email, instantly receiving a unique tracking confirmation code.

Direct Email Deletion Request: You may also email privacy@gogroww.in with the subject "Data Deletion Request". Requests are verified and fulfilled within 48 to 72 business hours, with written confirmation delivered upon completion.

9. Security & Technical Safeguards

Encryption in Transit: All incoming and outgoing web traffic is encrypted using Transport Layer Security (TLS 1.3 / HTTPS) with modern cryptographic cipher suites.

Encryption at Rest: Sensitive database columns—including Meta Cloud API tokens, webhook verification tokens, and user credentials—are encrypted at rest using AES-256 standard encryption.

Webhook Signature Verification: Every incoming webhook from Meta Cloud API is verified using HMAC-SHA256 signatures with our secure App Secret before any payload is parsed or stored.

Tenant Isolation & Role-Based Access: Our database enforces multi-tenant row-level and schema-level separation, preventing any client from viewing or accessing another client’s contacts, templates, or conversations. Access within accounts is governed by granular roles (Super Admin, Client Admin, Agent).

10. Your Rights as a Data Principal (DPDP Act 2023 & GDPR)

Right to Access: You have the right to request a summary of personal data being processed by GoGroww, the identities of data fiduciaries with whom data has been shared, and any other relevant processing details.

Right to Correction & Erasure: You have the right to correct inaccurate, outdated, or misleading personal data, and to request the permanent erasure of data that is no longer necessary for the purpose it was collected.

Right of Grievance Redressal: You have the right to readily accessible grievance redressal mechanisms regarding any act or omission in our data processing obligations.

Right to Nominate: In accordance with Section 14 of the India DPDP Act 2023, you have the right to nominate another individual who shall exercise your data principal rights in the event of death or incapacity.

Right to Withdraw Consent: Where processing is based on consent, you may withdraw your consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact our Data Protection Officer at privacy@gogroww.in. We respond to all verified requests within 30 days.

11. Cookies & Tracking Technologies

Essential Cookies: We utilize strictly necessary cookies to maintain secure sessions for administrators and clients logged into the portal. These cannot be disabled.

Privacy-Respecting Analytics: We use first-party, privacy-preserving analytical measurements to understand website performance and improve content. We do not use third-party behavioral retargeting cookies or sell browsing history.

Cookie Controls: You can manage or disable cookies through your web browser preferences at any time.

12. Grievance Redressal Officer & Contact Information

In compliance with Section 13(2) of the Digital Personal Data Protection Act 2023 and Meta Tech Provider requirements, the details of our designated Grievance & Data Protection Officer are as follows:

Officer Name: Sourabh Sharma

Designation: Grievance & Data Protection Officer, GoGroww

Registered Office: 186/1008 Urban Vihar, Ludhiana, Punjab 141013, India

Corporate Email: privacy@gogroww.in (with copy to info@gogroww.in)

Direct Telephone / WhatsApp: +91-98763-98815

Resolution Timeline: We acknowledge all grievance notices within 24 hours of receipt and provide a detailed written resolution within 30 calendar days.

Updates to this Policy: We may update this Privacy Policy periodically to reflect technological, operational, or legal developments. The revised policy will be posted on this page with an updated "Last updated" date.