This Privacy Policy explains how Unsolved Technology LLP, operating under the brand VaakuOS ("VaakuOS", "we", "us", or "our"), collects, uses, stores, shares, and protects personal data when you use our websites, applications, integrations, plugins, widgets, scripts, and other services (collectively, the "Services").
Our Services include, among other things, tools that help businesses manage customer conversations, contacts, campaigns, automations, support, leads, abandoned-cart activity, e-commerce integrations, and related business operations.
This Privacy Policy applies to individuals in India whose personal data is processed by VaakuOS in connection with the Services.
1. Important Definitions
For purposes of this Privacy Policy:
"Personal Data"
Means any data about an individual who is identifiable by or in relation to such data.
"Data Principal"
Means the individual to whom the personal data relates.
"Data Fiduciary"
Means the person who, alone or in conjunction with other persons, determines the purpose and means of processing personal data.
"Data Processor"
Means a person who processes personal data on behalf of a Data Fiduciary.
"Customer Data"
Means personal data belonging to or relating to a business's customers, shoppers, leads, contacts, website visitors, or other individuals that the business provides to VaakuOS or that VaakuOS processes on the business's behalf.
These terms are used consistently with the applicable Indian data-protection framework, including the Digital Personal Data Protection Act, 2023 ("DPDP Act") and applicable rules.
2. Our Role in Processing Personal Data
The role VaakuOS plays depends on the relationship in which personal data is processed.
2.1 Personal Data relating directly to VaakuOS users
When you interact directly with VaakuOS as a visitor, prospect, customer, account holder, administrator, or team member, VaakuOS generally determines the purposes and means for processing your personal data.
In such circumstances, VaakuOS may act as a Data Fiduciary under applicable Indian law.
Examples include:
creating and managing your VaakuOS account;
processing your subscription;
providing customer support;
sending service communications;
securing your account;
improving VaakuOS.
2.2 Customer Data processed for businesses
Businesses use VaakuOS to manage information relating to their own customers, shoppers, leads, contacts, and website visitors.
For such Customer Data, the business generally determines the purposes for which the information is processed, and VaakuOS acts as a Data Processor on the business's instructions.
For example, if an online store uses VaakuOS to store its customers' phone numbers and WhatsApp conversations, the store generally determines why those records are processed, while VaakuOS provides the infrastructure and services used to process them.
If you are a customer, shopper, lead, or contact of a business that uses VaakuOS, that business is generally responsible for providing you with its privacy notice and responding to requests concerning your personal data.
3. Personal Data We Collect
The information we collect depends on how you interact with VaakuOS.
3.1 Information you provide directly
Account information
When you create a VaakuOS account, we may collect:
name;
work email address;
phone number;
company/business name;
business website;
login credentials;
account preferences;
team member information;
roles and permissions.
Passwords are stored using password-hashing mechanisms and are not intentionally stored in plain text.
Google Sign-In
If you choose to sign in using Google, we may receive information made available through the Google authentication process, such as:
name;
email address;
profile picture, where available.
We do not use Google Sign-In to access your Gmail, Google Drive, or other Google services unless you separately authorize an integration that requires such access.
Forms and enquiries
If you contact us or submit information through our website, including demo requests, contact forms, integration requests, early-access forms, or newsletter forms, we may collect:
name;
email;
phone number;
company;
website;
message;
information you voluntarily provide.
Billing information
We may collect:
subscription plan;
billing name;
billing address;
GST information;
invoice information;
payment status;
transaction identifiers.
Payment card, UPI, bank, and other payment credentials may be processed directly by our payment service providers.
Where Razorpay or another payment processor is used, VaakuOS does not intentionally store full payment-card credentials unless specifically stated otherwise.
Support information
When you contact our support team, we may collect:
support messages;
tickets;
attachments;
account information;
technical information required to investigate your issue.
4. Information From Connected Accounts and Integrations
When you connect another service to VaakuOS, we receive and process information made available through the permissions and access you authorize.
The information depends on the integration.
4.1 WhatsApp Business Platform and Meta
When you connect a WhatsApp Business Account to VaakuOS, we may process:
WhatsApp Business Account ID;
phone number ID;
business/display name;
business verification information;
message-template information;
authorization/access tokens;
inbound messages;
outbound messages;
message media;
delivery statuses;
read statuses;
other information necessary to provide WhatsApp functionality.
We use this information to provide the WhatsApp functionality requested by the business.
The business using VaakuOS remains responsible for ensuring that its WhatsApp communications comply with applicable law and Meta's applicable requirements.
4.2 Facebook Lead Ads
When a business connects Facebook Lead Ads to VaakuOS, we may process:
Facebook Page identifiers;
authorization information;
lead-form identifiers;
lead submissions;
information contained in those lead forms.
Depending on the form configured by the business, this may include:
name;
email address;
phone number;
other information requested by the business.
The business is responsible for determining the purposes for which lead information is collected and used and for providing appropriate notices and obtaining any required permissions.
4.3 Shopify
When a business connects Shopify to VaakuOS, we may process information made available through the permissions granted to VaakuOS, including, where applicable:
store name;
store/domain information;
Shopify identifiers;
products;
catalog information;
customers;
orders;
checkouts;
carts;
fulfillment information;
webhook events.
The exact information processed depends on the permissions and functionality enabled by the merchant.
4.4 WooCommerce
When a business connects WooCommerce to VaakuOS, we may process information made available through the integration, including, where applicable:
store information;
products;
catalog information;
customers;
orders;
carts;
checkout information;
webhook events.
The exact information processed depends on the merchant's configuration.
4.5 Other integrations
If you connect another CRM, spreadsheet, helpdesk, payment system, store, marketing service, or other platform, we process the information necessary to provide the functionality you have enabled.
The third-party service may independently process information under its own privacy policy.
5. Customer Data Processed on Behalf of Businesses
Businesses may use VaakuOS to collect, store, synchronize, organize, and process Customer Data.
Depending on how a business configures VaakuOS, Customer Data may include:
5.1 Contact information
names;
phone numbers;
email addresses;
tags;
custom properties;
communication preferences;
opt-in/opt-out information;
conversation history.
5.2 Messages and communications
WhatsApp messages;
other supported-channel conversations;
media;
message templates;
campaign content;
delivery information;
read information;
communication metadata.
5.3 Shopping and commerce activity
Through store integrations and VaakuOS tracking functionality, Customer Data may include:
page views;
product views;
search activity;
cart contents;
cart value;
checkout steps;
purchases;
referrer information;
UTM and campaign parameters;
visitor identifiers;
cart identifiers.
5.4 Shopper information
Depending on the merchant's implementation, VaakuOS may receive:
name;
phone number;
email address;
information entered into merchant-controlled forms.
VaakuOS's tracking functionality is designed not to intentionally collect:
passwords;
payment-card numbers;
CVV values.
Merchants are responsible for ensuring that sensitive payment and authentication fields are not unnecessarily transmitted to VaakuOS.
5.5 Chat widget
Where a merchant uses a VaakuOS chat widget, we may process:
messages;
name;
email;
phone;
custom fields configured by the merchant.
5.6 Support and automation information
VaakuOS may process:
support tickets;
internal notes;
automation workflows;
campaigns;
tags;
tasks;
team activity;
configuration information.
6. Merchant Responsibilities
When a business uses VaakuOS to process Customer Data, the business is responsible for ensuring that its processing complies with applicable law.
This may include responsibility for:
providing an appropriate privacy notice;
identifying the applicable legal basis for processing;
obtaining consent where required;
using personal data only for permitted purposes;
obtaining required permissions for marketing communications;
complying with WhatsApp and Meta requirements;
configuring tracking appropriately;
honouring customer opt-outs;
responding to customer privacy requests;
ensuring imported customer data was lawfully obtained;
determining appropriate retention periods.
VaakuOS provides software and technical functionality to help businesses manage these activities but does not replace the business's own legal responsibilities.
7. Abandoned-Cart and Website Tracking
A business may install VaakuOS plugins, scripts, or tracking functionality on its website.
Depending on the configuration, this functionality may process:
pages viewed;
products viewed;
search terms;
cart contents;
cart value;
checkout activity;
purchase information;
referrer information;
UTM/campaign parameters;
visitor identifiers;
cart identifiers;
email or phone information where made available to VaakuOS.
A visitor or cart identifier may be stored in browser local storage or similar browser storage.
The business using VaakuOS is responsible for determining whether consent or another lawful basis is required for its tracking activities and for providing the required notice to its visitors.
Where provided, VaakuOS may provide technical mechanisms such as reset or opt-out functionality to help the business honour a shopper's choices.
8. How VaakuOS Uses Personal Data
We may use personal data for the following purposes.
8.1 Providing and operating VaakuOS
We may process information to:
create and manage accounts;
authenticate users;
provide requested Services;
connect integrations;
synchronize information;
send and receive messages;
operate campaigns;
run automations;
provide abandoned-cart functionality;
provide dashboards and reports;
provide support.
8.2 Billing and payments
We may process information to:
manage subscriptions;
process payments through payment providers;
issue invoices;
maintain billing records;
comply with tax and accounting requirements;
detect payment-related fraud.
8.3 AI-assisted features
When you use an AI-assisted feature such as improving, translating, or summarising text, the content required to perform that request may be processed by VaakuOS and sent to the AI service provider used for that feature.
VaakuOS does not intentionally use Customer Data to train general-purpose AI models unless such use is expressly authorized by the applicable business agreement or otherwise permitted by applicable law.
Before publication, VaakuOS will maintain an accurate list of AI providers used for these functions.
8.4 Security and fraud prevention
We may process information to:
protect accounts;
detect unauthorized access;
detect spam;
detect fraud;
prevent abuse;
investigate security incidents;
monitor system performance;
maintain service reliability.
8.5 Product improvement
We may use information about how users interact with VaakuOS to:
understand feature usage;
identify problems;
improve usability;
improve performance;
develop and test features.
We do not use Customer Data from one merchant to create marketing profiles or customer databases for another merchant.
8.6 Communications
We may send:
service notifications;
security alerts;
billing messages;
account-related communications;
support responses;
product updates;
marketing communications where permitted.
You may opt out of non-essential marketing communications.
8.7 Legal compliance
We may process information where necessary to:
comply with applicable law;
comply with legal obligations;
respond to lawful government requests;
establish or defend legal claims;
protect our rights, users, systems, or property.
9. Customer Data Restrictions
For Customer Data processed on behalf of a business:
VaakuOS does not sell Customer Data.
Unless expressly authorized by the applicable business agreement or required by law, VaakuOS does not:
use Customer Data for VaakuOS's own marketing;
sell Customer Data to third parties;
create cross-merchant customer profiles;
combine Customer Data from different businesses for advertising purposes;
use Customer Data to build advertising audiences for VaakuOS;
intentionally use Customer Data to train general-purpose AI models.
Customer Data may be processed as necessary to provide the Services, maintain security, prevent fraud and abuse, provide support, operate authorized integrations, comply with law, or follow the instructions of the business that controls the data.
10. How We Share Personal Data
We may share or provide access to personal data in the following circumstances.
10.1 Service providers
We use third-party providers to help operate VaakuOS, including providers for:
cloud hosting;
databases;
infrastructure;
payments;
authentication;
messaging;
email;
analytics;
error monitoring;
AI services;
security;
customer support.
Where a service provider processes Customer Data on our behalf, we require appropriate contractual and security measures appropriate to the nature of the processing.
A current list of relevant subprocessors may be provided separately.
10.2 Integrations
When a business connects an integration, information may be exchanged with that third-party service as necessary to provide the requested functionality.
10.3 Authorized users
Information in a business's VaakuOS workspace may be accessible to:
account owners;
administrators;
authorized team members;
authorized agencies or service providers given access by the business.
Businesses are responsible for managing their own workspace permissions.
10.4 Legal and safety requirements
We may disclose information where reasonably necessary to:
comply with applicable law;
respond to valid legal processes;
respond to lawful government requests;
investigate fraud or abuse;
protect our rights or property;
protect users or the public.
10.5 Business transactions
If VaakuOS is involved in a merger, acquisition, restructuring, financing, sale of assets, or similar transaction, personal data may be transferred as part of that transaction, subject to applicable law.
11. International Processing
Although VaakuOS is based in India, some service providers used by VaakuOS may process information outside India.
Where personal data is processed outside India, VaakuOS will take steps required by applicable Indian law and the applicable contractual and regulatory requirements governing such processing.
The specific countries and providers involved may change as our infrastructure and service providers change.
Where required, we will provide appropriate information regarding such processing.
12. Cookies and Similar Technologies
VaakuOS may use:
cookies;
local storage;
session storage;
pixels;
scripts;
similar technologies.
We use these technologies for purposes such as:
Essential functionality
authentication;
maintaining sessions;
account security;
application functionality.
Functional preferences
interface preferences;
theme;
layout;
dashboard settings;
saved filters;
other user preferences.
Analytics
Depending on configuration, we may use services such as:
Google Analytics;
Mixpanel;
Microsoft Clarity.
Advertising and measurement
Depending on configuration, we may use technologies such as:
Meta Pixel.
Where applicable, non-essential tracking will be operated in accordance with the consent and privacy requirements applicable to the relevant user and processing activity.
For more information, see our Cookie Policy.
13. Consent
Where VaakuOS relies on consent as the applicable basis for processing personal data, consent will be requested in a manner appropriate to the applicable law.
Under the DPDP Act, consent is intended to be free, specific, informed, and unambiguous, with clear affirmative action.
Where applicable, you may withdraw consent.
Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.
Where processing can continue under another lawful basis or legitimate use permitted by applicable law, we may continue processing to the extent permitted.
14. Your Rights as a Data Principal
Subject to applicable law and any applicable exceptions, you may have rights including:
14.1 Right to access information
You may request information regarding the personal data being processed by VaakuOS and relevant processing activities, as provided by applicable law.
14.2 Right to correction and updating
You may request correction, completion, or updating of inaccurate or incomplete personal data.
14.3 Right to erasure
You may request deletion of personal data where applicable under law.
Deletion may be subject to legal, contractual, security, or other lawful requirements requiring us to retain certain information.
14.4 Right to withdraw consent
Where processing is based on consent, you may withdraw that consent.
Withdrawal may affect our ability to provide certain Services where that processing is necessary to provide them.
14.5 Right to grievance redressal
You may raise a grievance regarding the processing of your personal data.
You can contact us using the details in Section 18.
14.6 Right to nominate
Where applicable under Indian law, you may have the right to nominate another individual to exercise specified rights on your behalf in the event of your death or incapacity.
15. Exercising Your Rights
You may submit privacy requests to:
We may request information necessary to verify your identity before processing a request.
We will process requests within the time period required by applicable law.
Where a request concerns Customer Data controlled by a business using VaakuOS, we may refer you to that business.
16. Customer Data Requests
If you are a customer, shopper, lead, or contact of a business using VaakuOS, that business generally determines the purposes for which your personal data is processed.
For example, if you purchased something from an online store that uses VaakuOS, you should normally contact that store for requests concerning:
your customer profile;
your orders;
your WhatsApp conversations;
your marketing preferences;
your lead information;
your abandoned-cart information.
The business may then instruct VaakuOS to assist with the applicable request.
If you contact VaakuOS directly, we may forward or refer the request to the relevant business where appropriate.
17. Data Retention
VaakuOS retains personal data only for as long as reasonably necessary for the purposes for which it is processed, unless a longer period is required or permitted by applicable law.
Retention may be necessary for:
providing the Services;
maintaining accounts;
security;
fraud prevention;
dispute resolution;
enforcing agreements;
legal compliance;
tax and accounting requirements;
maintaining required business records.
Customer Data
Customer Data processed on behalf of a business is generally retained according to:
the business's instructions;
the applicable agreement;
the enabled VaakuOS functionality;
applicable legal requirements.
When a business requests deletion of Customer Data, VaakuOS will delete or return the data according to the applicable agreement, subject to lawful retention requirements and backup processes.
Backups
Deleted data may remain temporarily in encrypted backups until those backups are overwritten or securely deleted according to our backup lifecycle.
Logs
Application, security, and diagnostic logs may be retained for periods appropriate for security, troubleshooting, operational, and legal purposes.
Billing and tax records
Certain billing, invoice, tax, and accounting records may be retained for longer periods where required by applicable law.
We do not intentionally retain personal data indefinitely where there is no lawful or operational reason to retain it.
18. Security
VaakuOS uses reasonable technical, organizational, and administrative measures appropriate to the nature and risks of the personal data we process.
These measures may include:
HTTPS/TLS encryption;
encryption of access tokens and credentials at rest;
password hashing;
role-based access controls;
workspace/tenant authorization controls;
audit logging;
restricted employee access;
authentication controls;
infrastructure security controls;
monitoring and logging;
backup protections;
incident-response procedures.
Access to personal data is limited to persons who require access for legitimate business or operational purposes.
No system can be guaranteed to be completely secure.
19. Personal Data Breaches
If VaakuOS becomes aware of a personal data breach, we will take reasonable steps to:
identify and assess the incident;
contain and remediate the incident;
assess the impact on personal data;
notify affected parties or authorities where required by applicable law; and
take steps to prevent recurrence.
Where VaakuOS acts as a Data Processor, we will notify the relevant business according to the applicable agreement and applicable law.
20. Children's Privacy
VaakuOS is a business-to-business service and is not intended for children to create or maintain their own VaakuOS accounts.
We do not knowingly seek to collect personal data directly from children for the purpose of providing them with VaakuOS accounts.
However, businesses using VaakuOS may process information relating to their own customers, including individuals who may be minors.
Where VaakuOS processes such information as a Data Processor, the relevant business remains responsible for complying with applicable requirements concerning children and minors.
21. Third-Party Services
VaakuOS integrates with third-party services including, depending on the features used:
Meta;
WhatsApp;
Shopify;
WooCommerce;
Google;
Razorpay;
analytics providers;
AI providers;
CRM and other business tools.
Those services may process information under their own terms and privacy policies.
VaakuOS does not control the privacy practices of third parties operating independently from VaakuOS.
22. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect:
changes to our Services;
changes to our data-processing practices;
changes to applicable law;
changes to our service providers;
changes to our security or privacy practices.
The Last Updated date at the beginning of this Privacy Policy will indicate when the Policy was last revised.
Where required, we will provide notice of material changes through appropriate means, including email, an in-app notification, or a notice on our website.
23. Contact Us
For questions concerning this Privacy Policy or VaakuOS's privacy practices, contact:
Unsolved Technology LLP
Operating as: VaakuOS
Email: privacy@vaakuos.com
24. Related Documents
This Privacy Policy should be read together with the following documents, where applicable:
VaakuOS Terms of Service;
VaakuOS Data Processing Agreement;
VaakuOS Cookie Policy;
VaakuOS Subprocessor List;
applicable merchant agreements;
applicable Meta/WhatsApp terms;
applicable third-party integration terms.
25. Important Scope Statement
This Privacy Policy is intended for VaakuOS's processing of personal data in India.
It does not attempt to provide jurisdiction-specific disclosures for jurisdictions outside India.
If VaakuOS begins actively offering its Services to individuals or businesses in jurisdictions with additional privacy requirements, this Policy may be supplemented or replaced with additional jurisdiction-specific privacy notices.