Privacy Policy

1.1. The personal data we collect depends on how you interact with us. Some of this information you provide directly; other information is collected automatically or generated by the service providers we use.

1.2. Website visitors and prospects:

• 1.2.1. Name, email address, phone number, and company details you submit through contact or ticket forms;
• 1.2.2. Device data (IP address, browser type, operating system) and service data (pages viewed, links clicked, referring site, session duration) collected via cookies and similar technologies — see our Cookie Policy for detail;
• 1.2.3. Profile and company information gathered from third-party sources such as contact-enrichment or lead-generation providers.

1.3. Customers using the ChakraHQ web dashboard and their authorized Users:

• 1.3.1. Registration and account information (name, email, phone number, company name, role);
• 1.3.2. Billing information (billing address, payment method details, transaction history — processed by our payment processor, not stored in full by us);
• 1.3.3. Conversation data processed through the Service on your behalf, including WhatsApp and chat messages, message metadata, and AI chatbot conversation logs (see our Additional Product Terms for how AI features process this data);
• 1.3.4. Usage data (login activity, feature usage, tags applied within the dashboard, IP address, browser and device information).

1.4. ChakraHQ Android and iOS app users:

• 1.4.1. Account and registration information you provide when signing in to the Apps;
• 1.4.2. App usage and diagnostic data collected via Firebase Analytics and Firebase Crashlytics, described further in the "Mobile App Data" section below.

2.1. The ChakraHQ Android and iOS apps use two third-party SDKs, both provided by Google:

• 2.1.1. Firebase Analytics — collects app usage and interaction data (screens viewed, features used, session length, in-app events), device identifiers, and general device information (device model, operating system version, language settings) to help us understand how the Apps are used and to improve them. Learn more at Firebase Analytics Privacy Policy.
• 2.1.2. Firebase Crashlytics — collects crash logs and diagnostic information (device model, operating system version, app version, and the state of the app at the time of a crash) so we can identify and fix stability issues. Learn more at Crashlytics Privacy Policy.

2.2. We do not use any other third-party analytics, advertising, or tracking SDKs in the Apps. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

3.1. Some of the information we collect automatically on our Sites and web dashboard is captured using cookies and similar technologies, as described in our Cookie Policy. We currently do not respond to browser "Do Not Track" signals.

4.1. We collect and process your personal data for the following purposes and, if you are located in the EEA, the UK, or Switzerland, on the following legal bases:

• 4.1.1. Providing and facilitating the Service: to perform our contract with you (or, before a contract is entered into, in reliance on our legitimate interests) — for example, to create and administer your account and deliver WhatsApp/AI chatbot functionality.
• 4.1.2. Communicating with you and providing support: in reliance on our legitimate interests in administering the Service, or to fulfill our contractual obligations to you.
• 4.1.3. Improving the Service: in reliance on our legitimate interests in understanding usage patterns, diagnosing crashes, and developing new features, or with your consent where required.
• 4.1.4. Sending marketing communications: in reliance on our legitimate interests or your consent, as applicable. You can opt out at any time — see "Your Privacy Rights and Choices" below.
• 4.1.5. Artificial intelligence: we and our AI service providers use machine learning and generative AI technologies to power AI chatbot features, in reliance on our legitimate interest in delivering the Service you have requested or, where required, your consent.
• 4.1.6. Maintaining security: in reliance on our legitimate interests in detecting, investigating, and preventing fraud, abuse, and security threats.
• 4.1.7. Complying with legal obligations: where necessary to comply with applicable law, respond to lawful requests from public authorities, or protect against imminent harm.

4.2. These legal bases apply only if you are located in the EEA, the UK, or Switzerland. If you have questions about the legal basis for our processing of your personal data, please contact us using the details in the "Contact Us" section below.

5.1. We may disclose your personal data to the following categories of recipients:

• 5.1.1. Service providers: vendors we engage to support our provision of the Service, such as cloud hosting, WhatsApp Business Platform messaging (Meta), AI model providers, payment processing, email delivery, and analytics/crash reporting (Google Firebase).
• 5.1.2. Professional advisors: lawyers, auditors, and insurers, in the course of the professional services they render to us.
• 5.1.3. Compliance with law: to comply with applicable laws, lawful requests, and legal process; to protect our, your, or others’ rights, privacy, safety, or property; and to enforce our agreements.
• 5.1.4. Business transfers: parties to an actual or potential corporate transaction (merger, acquisition, reorganization, or sale of assets), and their professional advisors.

5.2. We do not sell your personal data, and we do not share it with third parties for their own independent marketing purposes. Aggregated or anonymized information that does not identify you may be shared for any purpose. A current list of the third-party subprocessors that may process personal data on our behalf is available in our Subprocessors List.

6.1. We retain personal data only for as long as necessary to fulfill the purposes described in this Privacy Policy, or as required to comply with our legal obligations, resolve disputes, and enforce our agreements.

• 6.1.1. The contents of closed accounts are deleted within 60 days of the date of closure;
• 6.1.2. Server archival backups are retained for 90 days after deletion from live systems.

6.2. When we no longer have an ongoing legitimate business need to process your personal data, we will delete or anonymize it, or, where that is not possible (for example, because it is held in backup archives), we will securely isolate it from further processing until deletion is possible.

7.1. Chakrasoft Private Limited is based in India, and the Service is primarily operated and hosted from there. If you are located outside India, your personal data will be transferred to, and processed in, India and other countries where our service providers operate (including the United States, for certain hosting and AI-processing subprocessors). These countries may not have data protection laws equivalent to those in your home jurisdiction.

7.2. If you are a resident of the EEA, the UK, or Switzerland, we ensure that any such transfer of your personal data outside those regions is protected by appropriate safeguards, such as the European Commission’s Standard Contractual Clauses (or the UK International Data Transfer Addendum, as applicable), entered into between ChakraHQ and the relevant recipient. You can request more information about these safeguards by contacting us — see "Contact Us" below.

8.1. Depending on your location, you may have some or all of the following rights regarding your personal data. If you are a resident of the EEA, the UK, or Switzerland, you have the right to:

• 8.1.1. Access, correct, update, or request deletion of your personal data at any time;
• 8.1.2. Object to our processing of your personal data, or ask us to restrict such processing;
• 8.1.3. Request portability of your personal data;
• 8.1.4. Withdraw consent at any time, where we rely on consent to process your personal data — this will not affect the lawfulness of processing carried out before your withdrawal;
• 8.1.5. Opt out of marketing communications at any time, by using the "unsubscribe" link in our emails or by contacting us directly;
• 8.1.6. Lodge a complaint with your local data protection authority.

8.2. You can exercise any of these rights by contacting us at legal@chakrahq.com. We may need to verify your identity before responding to your request.

9.1. If you are a California resident, this section supplements the rest of this Privacy Policy and applies to "Personal Information" as defined by the California Consumer Privacy Act ("CCPA") and the California Privacy Rights Act ("CPRA"), as amended from time to time. You have the following rights:

• 9.1.1. Right to Know/Access: request the categories and specific pieces of Personal Information we have collected about you, the sources of that information, and the purposes for which we use it, over the past 12 months.
• 9.1.2. Right to Correction: request that we correct inaccurate Personal Information we hold about you.
• 9.1.3. Right to Deletion: request that we delete Personal Information we have collected from you, subject to certain exceptions.
• 9.1.4. Right to Opt Out of Sale/Sharing: we do not sell Personal Information for monetary or other valuable consideration, and have not done so in the preceding 12 months. To the extent our use of advertising cookies is considered "sharing" under the CCPA, you may opt out via our cookie preference controls described in our Cookie Policy.
• 9.1.5. Right to Non-Discrimination: you will not be discriminated against for exercising any of these rights.

9.2. You can exercise these rights by contacting us at legal@chakrahq.com. We will need to verify your identity before processing your request, and, where you use an authorized agent to submit a request on your behalf, we may require proof of the agent’s authority to act for you.

10.1. We use commercially reasonable administrative, technical, and physical safeguards designed to protect your personal data. However, no method of transmission over the internet or method of electronic storage is 100% secure, and we cannot guarantee absolute security.

11.1. The Service may contain links to third-party websites that we do not own or operate. This Privacy Policy applies solely to information processed by us. We encourage you to review the privacy policies of any third-party sites you visit.

12.1. The Service is intended for use by businesses and professionals and is not directed at, or intended for use by, children. We do not knowingly collect personal data from anyone under the age of 16. If we become aware that we have collected personal data from a child under 16 without verified parental consent, we will take steps to delete that information. If you believe a child has provided us with personal data, please contact us using the details below.

13.1. We may update this Privacy Policy from time to time in response to changing legal, technical, or business developments. We encourage you to review this page periodically. Material changes will be effective immediately upon posting the updated Privacy Policy on this page.

14.1. If you have any questions, comments, or concerns about this Privacy Policy or our processing of your personal data, please contact us at legal@chakrahq.com.