Privacy Policy

1. Commitment to Privacy & Data Protection

At GrowLokal Technologies (“GrowLokal”, “we”, “us”, or “our”), we recognize the importance of safeguarding personal and commercial data. This Privacy Policy details how we collect, process, store, protect, and delete information when you access our platform, use our Google Business Profile audit, or subscribe to our AI marketing services. Under the Digital Personal Data Protection Act, 2023 (DPDP Act), GrowLokal acts as a “Data Fiduciary”, and you, as our registered business user, act as the “Data Principal.”

2. Categories of Information We Collect

We strictly limit data collection to what is essential for delivering our marketing and CRM automation services:

• Business Profile Details: Business name, locality, city, services/treatments/courses offered, pricing structures, and operating hours.
• Authorized Account Data: Registered Indian mobile number (authenticated via SHA-256 encrypted OTP), owner/staff name, and optional billing email address.
• Connected Platform Permissions: OAuth authorization tokens and place identifiers authorized by you to manage public Google Maps listings and Instagram.
• WhatsApp Conversation Content: Inbound and outbound customer messages exchanged with your automated assistant to resolve client questions and provide quotes.
• Customer Inquiries & CRM Leads: Names, WhatsApp contact numbers, enquiry timestamps, and service requests captured through Google Maps, your booking link, or WhatsApp chat.
• Billing & Tax Records: Subscription plan, payment transaction IDs, and GST-compliant invoice records (financial payment credentials are processed directly by our RBI-authorized gateway partner).

3. Lawful Basis & Purpose of Processing

We process personal and commercial data strictly for legitimate business purposes:

• Generating your complimentary Google Business Profile local visibility audit and competitive score.
• Drafting localized Google posts, social media creatives, festival greetings, and review responses using enterprise AI infrastructure.
• Powering 24/7 WhatsApp customer auto-replies, appointment booking links, and promotional broadcast campaigns.
• Organizing customer inquiries into your private stage pipeline (`New` → `Contacted` → `Booked` → `Won`).
• Processing subscription renewals, issuing GST invoices, and fulfilling statutory financial compliance.

We do not sell, rent, or trade customer phone numbers or commercial data to third-party advertisers, and we do not use your proprietary business context to train public artificial intelligence models.

4. Notice & Consent Mechanism

In accordance with Section 6 of the DPDP Act, 2023, consent is obtained explicitly upon account creation and OTP verification. You maintain the absolute right to withdraw consent at any time with the same ease as providing it. You may withdraw consent or disconnect specific channels (such as Google OAuth or Meta accounts) directly through your dashboard settings or by notifying our Grievance Officer (Section 12). Withdrawing consent does not affect the lawfulness of processing undertaken prior to such withdrawal.

5. Security Safeguards, Encryption & Cookie Disclosure

• Transit & Storage Encryption: All browser, WhatsApp, and API communications are guarded by TLS 1.3 encryption. OTP credentials are SHA-256 hashed with timing-safe verification.
• Multi-Tenant Isolation: Database queries and caching layers enforce strict tenant isolation by business ID, guaranteeing that your customer inquiries and messages are never accessible by other tenants.
• Essential Authentication Cookies Only: GrowLokal uses strictly necessary security session cookies (configured as httpOnly, Secure in production, and SameSite: Strict) to maintain authenticated logins. We deploy zero third-party advertising, tracking, or behavioral profiling cookies.

6. Third-Party Service Providers & Infrastructure

To maintain reliable platform operations, we collaborate with reputable enterprise service providers who process data strictly under confidentiality and data protection agreements:

• Google Cloud (Places API & Business Profile API): To analyze local search rankings and publish authorized profile updates.
• Meta Platforms (WhatsApp Cloud API & Graph API): To transmit customer conversations, festival alerts, and authorized social posts.
• Enterprise AI Infrastructure Partners: To generate localized post captions, festival creatives, and review drafts without retaining data for model training.
• First-Party Self-Hosted Enterprise Inquiries & CRM Infrastructure: Hosted securely on private, access-controlled virtual private servers to organize lead pipelines.
• Twenty CRM: Open-source CRM platform for managing customer relationships and lead tracking.
• Cloudflare: For web application firewall (WAF) security, DDoS mitigation, and encrypted visual asset storage.
• WhatsApp: For one-time authentication codes and account notifications.
• Amazon Web Services (SES): For transactional billing notifications, invoice dispatch, and renewal notices.
• Razorpay Software Private Limited: RBI-authorized payment aggregator processing UPI, debit/credit cards, and net banking transactions.

7. Cross-Border Data Transfers

In compliance with Section 16 of the DPDP Act, 2023, data transfers across borders to cloud infrastructure nodes are conducted in full adherence to guidelines notified by the Central Government of India. All infrastructure partners are bound by strict security and confidentiality safeguards.

8. Data Retention Schedule

We enforce structured data retention and cleanup schedules:

• Active Session & Auth Logs: Retained for 90 days, after which expired sessions are automatically purged.
• Webhook Idempotency Caches: Retained in volatile storage for 24 hours to prevent duplicate message dispatch.
• Customer Inquiries, Leads & Messages: Maintained during the duration of your active subscription, and permanently erased within 30 days following an account deletion or verified erasure request.
• Partitioned System Event Records: Retained on a rolling 24-month schedule, with older partitions dropped automatically with zero data locking.
• Tax & Statutory Financial Invoices: Retained for up to 8 years (72 months from the due date of the relevant annual return), as mandatory under Section 36 of the Central Goods and Services Tax (CGST) Act, 2017. This applies even after account deletion; only invoice and payment records are kept.

9. Rights of Data Principals (DPDP Act, 2023)

As a Data Principal under Chapter III of the DPDP Act, you possess the following legally enforceable rights:

• Right to Access & Summary (Section 11): Request a summary of personal data processed by us and the identities of all data fiduciaries/processors with whom it has been shared.
• Right to Correction & Updating (Section 12): Correct inaccurate or incomplete business profile and contact information directly in your dashboard or via support.
• Right to Erasure / Account Deletion (Section 12): Permanently delete your account yourself from Settings → Delete Account in the GrowLokal mobile app, or raise a deletion ticket with GrowLokal Support from the Security tab of your web dashboard (or through our Grievance Officer). Deletion stops any auto-renewal and closes your account immediately; your business data is erased 30 days later, unless you ask us to restore the account before then, subject to the tax retention exception above.
• Right of Grievance Redressal (Section 13): Access a readily available grievance redressal mechanism with mandatory time-bound resolution (Section 12).
• Right to Nomination (Section 14): Nominate another individual to exercise your Data Principal rights in the event of death or medical incapacity by submitting a verified nomination form to our Grievance Desk.

10. Commercial Service & Children's Privacy

GrowLokal is a B2B commercial marketing software platform designed strictly for enterprise owners and professionals aged 18 and above. We do not knowingly solicit or collect personal data from individuals under 18 years of age.

11. Personal Data Breach Management

In accordance with Section 8(6) of the DPDP Act, in the unlikely event of a verified personal data breach, GrowLokal will promptly notify the Data Protection Board of India and all affected Data Principals in the prescribed manner, detailing the nature of the breach, mitigation steps taken, and safety recommendations.

12. Grievance Redressal Officer & Compliance Contact

For privacy inquiries, consent withdrawals, data principal rights requests, or grievances under Section 8(9) of the DPDP Act, please contact our designated Grievance Officer:

If you remain unsatisfied with our internal grievance resolution, you retain the statutory right to escalate your complaint to the Data Protection Board of India.

13. Policy Amendments & Notifications

We may periodically update this Privacy Policy to reflect platform enhancements or statutory updates under the DPDP Act. Material amendments will be prominently communicated via dashboard alerts, registered email, or verified WhatsApp messages prior to taking effect.