Privacy Policy

1. In short

• We collect what we need to run Commstate for the businesses that use it. We do not sell personal data, we do not share it for targeted advertising, and we do not show ads.
• For people who use Commstate to run a business (owners and staff), we decide how their account data is used. That is most of this policy.
• For the customers of those businesses (shoppers, people who message or call a business, contacts in its records), the business decides, and we handle the data on its behalf. Section 8 explains what that means for you.
• Whatever country you are in, you can ask to see, correct or delete your data. Section 11 sets out the rights that the law where you live gives you: the EU and UK, California and other US states, India, and elsewhere.

This policy is published by Wexron Infotech LLP, a limited liability partnership registered in India, with its registered office at {{REGISTERED_ADDRESS}} ("Commstate", "we", "us"). It covers the Commstate web app, the Commstate mobile app, sign-up, and the online shops businesses run on Commstate, as far as we are involved in them.

2. What we collect about the people who use Commstate

When you sign up: your business name, the web address you choose for it, your name, email address, phone number, a password (stored only as a one-way hash), the plan you picked, a referral code if you had one, which version of our terms and this policy you accepted and when, your IP address, your browser's description of itself (user agent), and the country your connection comes from. A sign-up check by Cloudflare Turnstile helps us stop automated sign-ups. If you instead ask us to contact you, we keep the details you give in that form.

Your account: name, email, phone number, profile picture if you add one, display preferences, the businesses you belong to and your role in each.

Signing in and security: a record of each sign-in (time, IP address, browser and device type, whether it succeeded), the IP address of your last sign-in, active sessions, and if you use them, your two-step verification setup (kept encrypted) and the accounts you sign in with (Google, Facebook, Apple, Microsoft), of which we keep the provider's ID for you and your email. One-time codes sent to your phone or email are stored only as hashes and expire.

What you do in Commstate: an activity log of changes made in a business's account (who changed what, when, from which IP address and browser) so the business can see what happened. When our support staff are given access to your account to help you, that access is time-limited and recorded.

The mobile app: your device's push-notification token, device name and model, operating-system and app version, and your notification choices. The app does not collect your location, contacts or advertising ID. The app store listing's privacy notice for the app is published at {{APP_PRIVACY_URL}}.

Payments: when you top up your account balance we receive the payment's status and reference from Razorpay. We do not see or store your card or bank details.

Resellers: if you apply to resell Commstate, we collect your identity, business and tax details, identity and address documents, a photo, and bank details to pay you. Document files are encrypted before they are stored and the bank account number is encrypted.

When you contact us: what you write and our replies.

3. What the businesses on Commstate store about their customers

Businesses use Commstate to keep and act on their own customer records. Depending on the features they turn on, this includes:

• Customers and orders: names, email addresses, phone numbers, delivery and billing addresses, order history, notes and tags.
• Messages: email, SMS and WhatsApp conversations with the business, and live-chat conversations on its website (with the visitor's name, email or phone if they give them, the pages they visit during the chat, and their approximate location worked out from their IP address).
• Calls: phone numbers, call times and durations, recordings (where the business records calls), transcripts and AI summaries of calls.
• AI: conversations with AI assistants and the information they used to answer.
• Shop accounts: a shopper's email or phone, saved addresses, wishlist and reviews, and shop visits (see section 8).
• Shipping: tracking numbers and delivery events from couriers.

Section 8 explains our role for this data.

4. Why we use it, and on what basis

• To provide Commstate, which is what you signed up for: create and run your account, do what you ask it to do, send the messages and make the calls you start, show you your data. Basis: performing our contract with you.
• To keep it secure: verify sign-ups, detect suspicious sign-ins, limit repeated attempts, keep audit records, investigate misuse. Basis: our legitimate interest in a safe service, and our legal duties.
• To bill you: plans, top-ups and invoices. Basis: contract; legal obligation for tax records.
• To support you when you ask for help. Basis: contract.
• To tell you about your account: sign-in codes, security alerts, invitations, billing notices and changes to these policies. Basis: contract and legitimate interest.
• To improve Commstate: counts of how features are used, measured inside Commstate. We do not use third-party analytics or advertising tools in the Commstate app. Basis: legitimate interest.
• Because the law requires it: tax records, responding to lawful requests. Basis: legal obligation.

Where we rely on consent, you can withdraw it at any time without affecting what was done before. Where we rely on legitimate interests, you can object (section 11).

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects on you.

5. Who we share it with

• Service providers who help us run Commstate, listed with what each receives and where on the Sub-processors page: hosting, file storage and backups, email and one-time-code delivery, AI models, push notifications, and others. They may use the data only to provide their service to us.
• Services a business connects itself (its own Shopify store, Razorpay account, WhatsApp Business account, couriers and the like). The business chooses these and has its own agreement with them.
• Within your business: other people in your business's account can see what their role allows.
• When the law requires it, or to protect people's safety or our rights, and only what is required.
• If our business changes hands, to the new owner, who must keep this policy's promises.

We do not sell personal data, and we do not share it for cross-context behavioural advertising.

6. Cookies and similar technology

The Cookie Notice lists them. In short: the Commstate app keeps your sign-in in your browser's storage and sets no tracking cookies. On a business's online shop, visits are counted without cookies unless the shopper accepts the shop's cookie banner, and advertising tags the shop adds load only after that acceptance.

7. Where it is kept, and international transfers

• Commstate runs on servers provided by {{HOSTING_PROVIDER}} in {{HOSTING_COUNTRY}}.
• Uploaded files, call recordings and database backups are stored with Backblaze in the United States. Shop pictures and videos may be stored with Cloudflare.
• Our service logs and system measurements are sent over an encrypted connection to a monitoring server provided by {{MONITORING_HOST_PROVIDER}} in {{MONITORING_HOST_COUNTRY}}.
• Some providers on the Sub-processors page process data in other countries, for example AI providers in the United States.

So your data may be processed in countries other than yours, whose laws may protect it differently. When we transfer it:

• from the European Economic Area, the UK or Switzerland, we use the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or another lawful mechanism such as an adequacy decision or the EU-US Data Privacy Framework where the recipient is certified. {{TRANSFER_MECHANISMS}}
• from India, we follow the Digital Personal Data Protection Act, 2023, including any country restrictions the Government of India notifies;
• from elsewhere, we follow the transfer rules of that country's law.

You can ask us for a copy of the safeguards we use (section 13).

8. If you are a customer of a business that uses Commstate

If you bought from, messaged, called or chatted with a business that uses Commstate, that business decides what it collects about you and why. It is the controller (under India's law, the data fiduciary) for your data, and Commstate is software it uses: we store and process your data on its behalf, under its instructions and our Data Processing Addendum, and we do not use it for our own purposes.

• A shop's own policies are the shop's. An online shop run on Commstate is the business's own website. Its privacy policy, terms, refund and other policies, found on the shop's own pages, are written by that business and are what apply to you as its customer. This policy does not replace them; it explains our part as the software behind them.
• To use your rights (see your data, correct it, have it deleted, withdraw consent, object), ask the business. If you write to us instead, we will pass your request to the business and help it respond, but we cannot act on its data without its instructions, except where the law requires us to.
• Shop visits: a shop counts its visits without storing your IP address, browser details or anything that identifies you. If your browser sends "Do Not Track" or "Global Privacy Control", the visit is not counted at all. Only if you accept the shop's cookie banner does it join visits into a short session (a random, daily-changing code that is not linked to you).
• Calls may be recorded by the business; it should tell you at the start of the call.
• Live chat: your IP address is used to show the business your approximate location, and is shortened before it is stored.

9. Keeping and deleting data

We keep personal data while it is needed for the purposes above and then delete it. These periods are set in Commstate and run every night:

• one-time sign-in codes: 1 day;
• shop visit records with session codes: 30 days, after which only daily totals are kept;
• webhook delivery logs and workflow step logs: 30 days;
• the message log (email, SMS and WhatsApp sent through the platform) and platform email delivery records: 90 days;
• a phone that has not opened the mobile app, with its notification token: 90 days;
• anonymous live-chat visitors and their page visits: 180 days;
• sign-in history, and the IP address of an account's last sign-in: 1 year;
• sign-up attempts and "talk to us" requests: 1 year (for a business that signed up, we keep only which terms and policy it accepted, and when);
• call recordings and call transcripts: 1 year;
• activity (audit) logs: 1 year;
• live-chat conversations and AI conversations: 2 years after they were last touched;
• usage analytics: events 400 days, summaries 3 years;
• database backups: about 14 days.

Other data, including accounts, customer and order records, and message conversations with customers, is kept for as long as the business's account is active, unless the business deletes it sooner. The platform can shorten these periods; it does not lengthen them without a new version of this policy.

Deleting. A business can delete individual customer records itself. To delete your own user account, or a whole business and its data, write to {{PRIVACY_EMAIL}}. We will confirm who you are and delete the data within {{DELETION_DAYS}} days, except what the law requires us to keep (such as tax records, kept for {{TAX_RECORD_YEARS}} years). Deleted data leaves our backups within about 14 days as they are replaced.

Exporting. A business can export its customers, orders, products and other records as files from its account at any time.

10. How we protect it

• Connections to Commstate are encrypted (HTTPS).
• Passwords are stored only as one-way hashes. Two-step verification is available to every account.
• Secrets you give us (such as your connected services' keys), two-step verification codes, reseller documents and bank account numbers are encrypted.
• Each business's data is kept separate from every other business's, and inside a business, people see only what their role allows.
• Repeated sign-in and sign-up attempts are limited, sign-ins are recorded, and changes are logged.
• Our staff get access to a business's account only to help it, for a limited time, and that access is recorded.

No system is perfectly secure. If a breach affects your personal data, we will tell you and the authorities where the law requires.

11. Your rights, by where you live

Wherever you are, you can ask us what we hold about you, ask us to correct it, and ask us to delete it, and we will answer within {{RIGHTS_RESPONSE_DAYS}} days. Send requests to {{PRIVACY_EMAIL}}. We may need to confirm who you are first. We will not treat you differently for using your rights. If your data is held by a business on Commstate (section 8), ask that business first.

The law where you live may give you more, as follows.

European Economic Area, United Kingdom and Switzerland (GDPR, UK GDPR)

• Your rights: access, correction, deletion, restriction of processing, data portability (a copy in a machine-readable format), objection (including to direct marketing, always), and withdrawing consent at any time.
• Legal bases for each use are listed in section 4.
• Controller: Wexron Infotech LLP for the data in sections 2 and 4; the business for its customers' data (section 8).
• Our representative in the EU: {{EU_REPRESENTATIVE}}. In the UK: {{UK_REPRESENTATIVE}}.
• Data Protection Officer: {{DPO_CONTACT}}.
• Transfers outside the EEA or UK: see section 7.
• Complaints: you may complain to the data protection authority where you live or work, or where you think the law was broken (in the UK, the Information Commissioner's Office). We would welcome the chance to sort it out first.

California and other US states

This section covers California residents under the California Consumer Privacy Act as amended by the CPRA, and residents of other US states with similar laws.

• Categories collected in the last 12 months, from you, your device or the business you work for: identifiers (name, email, phone, IP address, account IDs); commercial information (plan and payment records); internet activity (sign-in records, activity in the app); geolocation at country level from your IP address; audio recordings (calls, if a business records them); professional information (the business you work for and your role); and, for resellers only, sensitive personal information (government ID, bank account). We use them for the purposes in section 4 and keep them as in section 9.
• Sensitive personal information is used only to verify resellers and pay them, not to infer anything about you.
• We do not sell or share personal information, as those words are defined in the CCPA, and have not done so in the last 12 months. We do not knowingly sell or share the data of anyone under 16.
• Your rights: to know what we collect, use and disclose; to delete; to correct; to limit the use of sensitive personal information; and not to be discriminated against for using them. You can use an authorised agent, and we will ask it for proof of your permission.
• Global Privacy Control is honoured: on shops run on Commstate, a browser sending it is not counted at all.
• How to ask: {{PRIVACY_EMAIL}} or {{US_PRIVACY_PHONE}}.

India (Digital Personal Data Protection Act, 2023, and IT Rules, 2021)

• Your rights: a summary of the data we hold and what we do with it, and who we have shared it with; correction, completion and updating; erasure; withdrawing consent as easily as you gave it; grievance redressal; and nominating someone to use your rights if you die or cannot use them yourself.
• Data fiduciary: Wexron Infotech LLP for the data in section 2; the business for its customers' data (section 8).
• Grievance Officer (Information Technology Act, 2000 and the Intermediary Guidelines Rules, 2021): {{GRIEVANCE_OFFICER_NAME}}, {{GRIEVANCE_OFFICER_EMAIL}}, Wexron Infotech LLP, {{REGISTERED_ADDRESS}}. We acknowledge complaints within 24 hours and resolve them within 15 days. More on the complaints page.
• If not resolved, you can complain to the Data Protection Board of India.

Other countries

If you live elsewhere (for example Brazil under the LGPD, Canada under PIPEDA, Australia under the Privacy Act 1988, Singapore under the PDPA, or the UAE), you have the rights your law gives you, and you can use them the same way: write to {{PRIVACY_EMAIL}}. {{OTHER_REGION_NOTES}}

12. Children

Commstate is for businesses and is not meant for anyone under 18. We do not knowingly collect children's data for our own purposes. A business that sells to or collects data about children is responsible for getting the parental consent the law where it operates requires (for example verifiable consent of a parent or guardian under India's DPDP Act, or under COPPA in the United States).

13. Changes and contact

When we change this policy we publish the new version at its own address under /legal/privacy, keep the old ones readable, and tell account owners about changes that matter before they apply.

Privacy questions and requests: {{PRIVACY_EMAIL}}. Postal address: Wexron Infotech LLP, {{REGISTERED_ADDRESS}}. Complaints: the complaints page.