Privacy Policy
Patherle is a multilingual AI chatbot platform for Indian small businesses. Here is what this policy means for you - no legal jargon:
Your data stays yours. We never sell it, rent it, or trade it to advertisers.
We collect what we need. Nothing more. Every data point has a documented reason.
You can delete everything. Settings → Account & Data → Delete Account. It happens immediately.
You can export your data as a JSON file from Settings at any time.
Conversation text is auto-deleted after 30 days. We built this into the database itself.
Indian law applies. Your rights under the DPDP Act 2023 and IT Act 2000 are fully honoured.
1. Who We Are & Data Fiduciary Designation
Patherle is a B2B SaaS platform that enables Indian micro, small and medium enterprises (MSMEs) to deploy AI-powered chatbots on WhatsApp, Telegram, and their own websites. Businesses use Patherle to automate customer enquiries, manage leads, sync product catalogues, and communicate with customers in 23 Indian languages.
As a Data Fiduciary under the Digital Personal Data Protection Act 2023 (DPDP Act), we determine the purpose and means of processing your personal data. Where we engage third-party service providers to process data on our behalf, they act as Data Processors under our written instructions.
2. Definitions
These terms have the meanings assigned under the DPDP Act 2023 unless the context requires otherwise:
| Term | Meaning |
|---|---|
| Personal Data | Any data about an individual who is identifiable by or in relation to such data. |
| Sensitive Personal Data (SPDI) | As defined under Rule 3 of the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011: passwords; financial information; health data; sexual orientation; biometric data; and physical, physiological, and mental health conditions. |
| Data Fiduciary | Any person who, alone or in conjunction with other persons, determines the purpose and means of processing of personal data - i.e., Patherle / Meow Creative Haus. |
| Data Principal | The individual to whom the personal data relates - i.e., you, the registered user or any individual whose data you provide to us. |
| Data Processor | Any person who processes personal data on behalf of a Data Fiduciary - i.e., our third-party service providers. |
| Consent | A free, specific, informed, unconditional, and unambiguous indication of the Data Principal's wishes, given through a clear affirmative action. |
| Processing | Wholly or partially automated operations on personal data - including collection, recording, organisation, structuring, storage, adaptation, retrieval, use, disclosure, erasure, or destruction. |
| Breach | Any unauthorised processing of personal data, or accidental disclosure, acquisition, sharing, use, alteration, destruction of personal data that compromises its confidentiality, integrity, or availability. |
3. Data We Collect
We apply strict data minimisation: every field in the table below is necessary for the stated purpose. We do not collect data speculatively or for future purposes we have not yet defined.
3.1 Account & Identity Data
| Data | Why We Need It | Is It Mandatory? |
|---|---|---|
| Email address | Primary account identifier; email verification; password reset; service notifications | Mandatory |
| Password hash | Authentication. We store a bcrypt hash - the original password is never stored. | Mandatory |
| Company name, industry sector, website URL | Personalising your workspace, bot responses, and the Patherle interface for your business type | Mandatory |
| Full name (optional) | Personalising communications; support interactions | Optional |
3.2 Channel Credentials (Sensitive Personal Data)
| Data | Why We Need It | Where It Goes |
|---|---|---|
| WhatsApp Business API Access Token, Phone Number ID, Business Account ID | Sending and receiving messages via your WhatsApp Business Account | Meta (WhatsApp Cloud API) only |
| Telegram Bot Token, Bot Username | Sending and receiving messages via your Telegram Bot | Telegram Bot API only |
| ERP OAuth Tokens & API Keys (Zoho Books, QuickBooks, Tally, etc.) | Syncing products and inventory between your ERP system and Patherle's knowledge base | Your ERP provider only; tokens are refreshed server-side |
| Google Sheets OAuth Token | Writing synthesised business data to your Google Spreadsheet | Google Drive API only; drive.file scope (we can only access files we created) |
3.3 Operational & Customer Data (Your Business Data)
This is data you upload or generate while operating Patherle. You own this data. We process it only to deliver the service.
| Data | Why We Need It | Retention |
|---|---|---|
| Customer query text (conversation logs) | Generating AI responses; HITL (human-in-the-loop) review by you; quality monitoring | 30 days - automatically nullified by a scheduled database job after 30 days |
| Product / inventory / pricing data | Training your bot's knowledge base; ERP sync; product showcase feature | Until you delete or your account is closed |
| Lead data (customer name, phone, email, tags) | CRM module - stored only if you use the Leads feature | Until you delete or your account is closed |
| Form submissions (respondent phone/chat ID, answers) | Customer enquiry forms you build and publish via Patherle | Until you delete or your account is closed |
| Chatflows & response scripts | Defining your bot's conversational logic | Until you delete or your account is closed |
| Uploaded documents (PDFs, product sheets) | Building the vector knowledge base for your bot | Until you delete or your account is closed |
| Outbound campaign data (recipient list, message templates) | Sending broadcast messages via WhatsApp or Telegram | Until you delete or your account is closed |
3.4 Technical & Usage Data
| Data | Why We Need It | Retention |
|---|---|---|
| IP address, approximate geolocation (city) | Fraud prevention; rate limiting; abuse detection; security logging | 90 days from collection |
| Browser type, device type (from user-agent string) | Debugging compatibility issues; measuring platform reach | 13 months (PostHog default) |
| Feature usage events (page views, clicks, feature activations) | Understanding how the platform is used; prioritising roadmap improvements | 13 months (PostHog); pseudonymised |
| Error/crash reports (stack traces, request metadata) | Diagnosing and fixing bugs | 90 days (Sentry) |
3.5 Billing Data
| Data | Why We Need It | Retention |
|---|---|---|
| Subscription plan, plan start/end dates | Determining feature access; billing calculations | 7 years (GST Act, Section 35) |
| Transaction ID, payment status, invoice data (via Razorpay) | Payment verification; GST invoicing; dispute resolution | 7 years (GST Act) |
| Payment card details | We do not store card numbers. They are handled entirely by Razorpay (PCI-DSS Level 1 compliant). | Not stored by us |
4. How We Use Your Data
We use personal data strictly for the following purposes. We do not use your data to train general AI models, nor do we share it with advertisers.
- Service delivery - operating, maintaining, and improving the Patherle platform
- Bot operation - generating AI responses to your customers' WhatsApp and Telegram messages
- HITL workflow - presenting unresolved queries to you (the business owner) for manual review and approval
- ERP sync - reading your product catalogue from connected ERP systems and pushing it to the bot knowledge base
- Analytics - providing you with usage dashboards about your bot's performance (this is your data, processed to surface insights to you)
- Security & fraud prevention - detecting unusual login activity, rate-limit enforcement, abuse detection
- Legal compliance - meeting obligations under the IT Act 2000, DPDP Act 2023, and GST laws
- Customer communications - sending transactional emails (plan alerts, password resets, material policy changes)
- Product improvement - analysing aggregated, anonymised usage patterns to decide which features to build next
5. Legal Basis for Processing
Under the DPDP Act 2023, every act of processing must have a lawful basis. Here is ours:
| Processing Activity | Legal Basis | DPDP Act Provision |
|---|---|---|
| Creating and maintaining your account; running the bot service; storing your business data | Consent - obtained via the consent checkbox at sign-up (affirmative, informed, specific) | Section 6(1) - Consent of Data Principal |
| Security monitoring, IP logging, rate limiting, fraud prevention | Legitimate use - necessary to prevent unlawful activity and protect the platform | Section 7(d) - Legitimate Uses (Legal proceedings and security) |
| Billing records, GST invoices, transaction logs | Legal obligation - mandated by GST Act, Income Tax Act, and Companies Act | Section 7(b) - Compliance with law |
| Sending service-critical emails (security alerts, data breach notices) | Legitimate use - necessary for safety and service continuity | Section 7(d) |
Consent withdrawal: You may withdraw your consent at any time by deleting your account via Settings → Account & Data. Withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal, or processing required under legal obligation.
6. Third Parties & Sub-Processors
We engage the following Data Processors under data processing agreements. Each receives only the data strictly necessary to perform their function.
| Provider | Role | Data Received | Location | Privacy Policy |
|---|---|---|---|---|
| Supabase Inc. | Database, authentication, file storage | All tenant data stored on the platform | US (AWS us-east-1) | supabase.com/privacy |
| Razorpay Software Pvt. Ltd. | Payment processing; GST invoicing | Email, plan amount, transaction metadata | India (RBI-regulated) | razorpay.com/privacy |
| PostHog Inc. | Product analytics | Pseudonymous usage events, IP (hashed), browser type | US / EU | posthog.com/privacy |
| Sentry Inc. | Error monitoring | Stack traces, request metadata, anonymised user ID | US | sentry.io/privacy |
| Meta Platforms, Inc. (WhatsApp Business API) | Message delivery over WhatsApp | Customer query messages; bot responses (passed through Cloud API) | US | WhatsApp Privacy Policy |
| Telegram Messenger Inc. | Message delivery over Telegram | Customer query messages; bot responses (passed through Bot API) | UAE / Dubai | telegram.org/privacy |
| Pinecone Systems Inc. | Vector database for knowledge base search | Text embeddings of your uploaded documents and products (not raw text) | US (AWS) | pinecone.io/privacy |
| Sarvam AI | Multilingual language processing for 23 Indian languages | Customer query text (for language detection and translation) | India | sarvam.ai/privacy |
| Railway Corp. | Backend API hosting | All data transiting the backend (encrypted in transit, not persisted by Railway) | US | railway.app/legal/privacy |
| Vercel Inc. | Frontend hosting and CDN | Static files; request metadata (IP, user-agent) for CDN routing | US / Global CDN | vercel.com/legal/privacy-policy |
| Google LLC (optional, if connected) | Google Sheets API for data export spreadsheets | Your product, lead, and analytics data written to Google Sheets you own | US | policies.google.com/privacy |
We do not permit any of the above processors to use your data for their own commercial purposes (advertising, model training, etc.) beyond what is necessary to provide their respective services to us.
6.1 Google API Services User Data Policy — Limited Use
When you connect Google Sheets to Patherle, our application accesses Google user data through the Google Sheets API and Google Drive API (using the drive.file scope — we can only read or write files our application created or files you explicitly opened with our app).
Patherle's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Specifically, data accessed via Google APIs (including Google Sheets and Google Drive) is:
- Used only to provide or improve user-facing features that are visible and prominent in the Patherle interface (writing your synthesised business data to a Google Spreadsheet you own).
- Not used to develop, improve, or train generalised AI or machine-learning models. Google user data never enters our embedding pipeline, our RAG knowledge base, or any third-party model training set.
- Not transferred to others, except as necessary to provide or improve the user-facing feature, to comply with applicable law, or as part of a merger, acquisition, or sale of assets with continued user notification.
- Not used or transferred for serving advertisements, including retargeting, personalised, or interest-based advertising.
- Accessible to humans only when (a) we have your explicit consent, (b) it is necessary for security purposes (such as investigating abuse), (c) we are required by applicable law to do so, or (d) the data has been aggregated and anonymised so that it can no longer be associated with an individual user.
You can revoke Patherle's access to your Google account at any time from your Google Account Permissions page, or by clicking Disconnect on the Patherle Integrations page in your dashboard. Upon disconnection, our stored OAuth tokens for your account are deleted within 24 hours.
7. Cross-Border Data Transfers
Several of our service providers are based outside India (primarily the United States). Where personal data is transferred across borders, we rely on the following safeguards:
- Data Processing Agreements (DPAs) - we have or require DPAs with each sub-processor that impose contractual obligations on data protection equivalent to Indian law standards.
- Encryption in transit - all data is encrypted using TLS 1.2 or higher before it leaves India's borders.
- Data minimisation at transfer - only the minimum data necessary for the processor's function is transmitted internationally.
- India-hosted processors where available - Sarvam AI (language processing) and Razorpay (payments) are India-based, keeping the most sensitive processing within Indian jurisdiction.
8. Data Retention Schedule
We keep your data only for as long as necessary. The schedule below is binding and implemented in our database systems.
| Data Category | Retention Period | Basis for Retention |
|---|---|---|
| Customer conversation / query text | 30 days - then auto-nullified by a nightly scheduled database job | DPDP Act data minimisation; operational necessity limited to HITL review window |
| IP address logs, device fingerprints | 90 days | Security monitoring; fraud detection within investigation window |
| Error/crash data (Sentry) | 90 days (Sentry default) | Bug resolution; reliability monitoring |
| Analytics events (PostHog) | 13 months (year-over-year comparison) | Product improvement; pseudonymised before retention |
| Account data, business data, leads, products | Until you delete it or close your account | Service delivery; you are in control of this data |
| Channel credentials (WhatsApp, Telegram, ERP tokens) | Until you disconnect the integration | Necessary for integration operation; deleted within 24 hours of disconnection |
| Billing records, GST invoices | 7 years | Goods and Services Tax Act 2017, Section 35; Income Tax Act 1961, Section 44AA |
When you delete your account via Settings, all data in the rows marked "until account closed" is deleted immediately (within seconds) using a cascade-delete mechanism. Billing records are retained for the statutory 7-year period even after account deletion.
9. Your Rights Under the DPDP Act 2023
As a Data Principal, the DPDP Act 2023 grants you the following rights. You can exercise most of them directly from your Settings page, or by contacting privacy@patherle.com. We will respond within 30 days of a verified request.
Right to Access
Know what personal data we hold about you and how it is being processed.
Right to Correction
Request correction or completion of inaccurate or incomplete personal data.
Right to Erasure
Have your personal data deleted when it is no longer necessary or you withdraw consent.
Right to Data Portability
Receive a copy of your personal data in a structured, machine-readable format (JSON).
Right to Withdraw Consent
Withdraw your consent to processing at any time. Withdrawal is effective immediately.
Right to Nominate
Nominate another person to exercise your rights in the event of your death or incapacity, as provided under Section 14 of the DPDP Act.
Right to Grievance Redressal
File a grievance with our appointed Grievance Officer. If unresolved, escalate to the Data Protection Board of India.
Right to Know About Breach
Be notified if a personal data breach occurs that is likely to result in harm to you.
10. Sensitive Personal Data - IT Act 2000 & SPDI Rules 2011
The IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011, issued under Section 43A of the IT Act 2000, impose additional obligations on us when we handle Sensitive Personal Data or Information (SPDI).
The following data we process qualifies as SPDI under Rule 3:
- Passwords - your account password (stored only as a bcrypt hash with cost factor 12)
- Financial information - billing records, transaction metadata (processed via Razorpay; we do not hold card numbers)
- API credentials and access tokens - functionally equivalent to financial account credentials as they grant access to WhatsApp Business Accounts and ERP systems
For SPDI, Rule 6 requires your explicit written consent before we collect it. This consent is obtained via the sign-up consent checkbox and, for channel integrations, via the in-app Settings page where you actively paste your own credentials. Rule 6(1) also requires that you be given an option to not provide SPDI - for channel credentials specifically, you may opt not to integrate WhatsApp or Telegram at any time without losing access to other Patherle features.
Grievance mechanism for SPDI: Under Rule 5(9), if you have a grievance regarding our handling of your SPDI, please contact our Grievance Officer (Section 16).
11. Security Measures
Under Rule 8 of the IT (SPDI) Rules 2011 and Section 11 of the DPDP Act 2023, we are required to implement reasonable security practices. Here is what we have implemented:
11.1 In Transit
- TLS 1.2 minimum enforced on all API and web endpoints (TLS 1.3 preferred)
- HTTP Strict Transport Security (HSTS) headers enabled
- All webhook endpoints verified with HMAC signatures
11.2 At Rest
- Supabase database encryption at rest (AES-256 via AWS RDS)
- API credentials, ERP OAuth tokens, and channel tokens stored in encrypted JSONB fields
- Row-level security (RLS) in Supabase - every database query is scoped to the authenticated tenant; no tenant can access another's data
- Passwords stored as bcrypt hashes (cost factor 12) - plaintext passwords are never stored
11.3 Access Controls
- Backend API requires a valid JWT on every authenticated endpoint
- Production database is accessible only from the Railway backend - no direct public database access
- CORS policy restricts API access to approved origins only
- IP-based rate limiting prevents brute-force attacks
11.4 Operational Security
- Automated conversation text purge runs nightly (DPDP data minimisation)
- Security dependency audits run on every deployment
- Production environment variables managed via Railway secrets vault - not in source code
12. Data Breach Response
Under Section 8(6) of the DPDP Act 2023 and Rule 12 of the IT (SPDI) Rules 2011, we have a documented breach response procedure:
- Detection & containment - Upon identifying a suspected breach, the incident is immediately contained (compromised credentials rotated, access revoked).
- Assessment - We determine the scope, nature of data affected, and risk of harm to Data Principals.
- Notification to Data Protection Board - We report to CERT-In (Computer Emergency Response Team, India) and, once constituted, the Data Protection Board of India, as required by law.
- Notification to you - If your personal data is affected and there is a risk of harm, we will email you at your registered address within 72 hours of becoming aware of the breach. The notice will describe: what data was affected; what we believe happened; what we have done to contain it; and what steps, if any, you should take.
- Post-incident review - We conduct a root-cause analysis and implement corrective measures.
13. Cookies & Tracking Technologies
We use a minimal set of cookies and tracking technologies:
| Cookie / Technology | Type | Purpose | Duration |
|---|---|---|---|
Supabase auth token (sb-*-auth-token) |
Strictly Necessary | Maintains your authenticated session. Without this, you cannot stay logged in. | Until sign-out or 1 hour (refresh token extends it) |
PostHog analytics (ph_*) |
Analytics (Pseudonymous) | Tracks feature usage, navigation flows, and product performance. No personally identifying information is attached. | 13 months |
We do not use:
- Marketing or advertising cookies (Google Ads, Meta Pixel, etc.)
- Cross-site tracking cookies
- Third-party retargeting pixels
- Browser fingerprinting for tracking purposes
To opt out of PostHog analytics, email privacy@patherle.com with "Opt out of analytics" in the subject. We will exclude your session from analytics collection within 48 hours.
14. Children's Privacy
Patherle is a B2B platform designed exclusively for registered businesses and their adult representatives. We do not knowingly collect personal data from any individual under the age of 18. Our sign-up consent explicitly requires confirmation that you are 18 or older.
Under Section 9 of the DPDP Act 2023, processing of personal data of children requires verifiable parental consent. If we become aware that we have inadvertently collected data from a minor, we will delete that account and all associated data within 24 hours. Please notify us immediately at privacy@patherle.com if you believe a minor has registered.
15. Changes to This Policy
We may update this Privacy Policy when our data practices change or when required by law. For material changes (changes that expand what data we collect, change how we use it, or affect your rights), we will:
- Email you at your registered email address
- Display a prominent notice within the Patherle app
- Provide at least 30 days' notice before the change takes effect
- For changes that require fresh consent under the DPDP Act, present a new consent request in the app
For non-material changes (typographical corrections, clarifications that do not alter your rights), we will update the "Last revised" date at the top of this page without additional notice. The current version of this policy is always available at www.patherle.com/privacy.
16. Grievance Officer
Under Rule 3(11) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021, every intermediary shall designate a Grievance Officer and publish their contact information. In compliance:
Your grievance must include: your registered email address; a description of the grievance; and, where relevant, the specific data or processing activity you are complaining about. For complex matters involving SPDI, please attach relevant supporting evidence.
If your grievance is not resolved to your satisfaction within 30 days, you have the right to escalate to the Data Protection Board of India (Section 25, DPDP Act 2023) once it is constituted by the Central Government. For IT Act complaints, you may approach the Adjudicating Officer (Section 46, IT Act 2000) at the Ministry of Electronics and Information Technology.
For full grievance procedures, see our dedicated Grievance Redressal page.
17. Contact
For all privacy matters that are not grievances, contact:
This Privacy Policy is governed by the laws of the Republic of India. Any dispute arising in connection with this Policy, or with our collection, use, or handling of your personal data, shall be subject to the exclusive jurisdiction of the competent courts in Mumbai, Maharashtra, India, without prejudice to your right to approach the Data Protection Board of India or CERT-In under applicable statutory provisions.
Related documents: Terms of Service · Grievance Redressal