Privacy Policy

1. Introduction

Welcome to BetaXLab LLP ("we," "our," or "us"). We operate the website www.betaxlab.com and provide SaaS-based WhatsApp automation, CRM integrations, business messaging, and related software services (collectively, the "Services").

This Privacy Policy explains what personal information we collect, why we collect it, how we use and protect it, and the rights you have over your data. By accessing our website or using our Services, you agree to the practices described in this Privacy Policy. If you do not agree, please discontinue use of our website and Services immediately.

This Policy is published in compliance with:

• The Information Technology Act, 2000 (India)
• The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (SPDI Rules)
• The Digital Personal Data Protection Act, 2023 (DPDPA), to the extent applicable
• The General Data Protection Regulation (GDPR) for data subjects in the European Economic Area
• Meta Platform Terms, WhatsApp Business Platform policies, and applicable API usage guidelines

2. Business Legal Identity & Independence Disclaimer

Legal Entity: BetaXLab LLP
Entity Type: Limited Liability Partnership registered under the Limited Liability Partnership Act, 2008 (India)
Country of Incorporation: India
Registered Email: info@betaxlab.com
Website: https://www.betaxlab.com

Independence Disclaimer: BetaXLab LLP is an independent software and technology company. We are not affiliated with, endorsed by, or officially partnered with Meta Platforms, Inc., WhatsApp LLC, Facebook, Inc., Google LLC, or any of their subsidiaries or affiliates, unless a specific and current written authorization or partnership agreement explicitly states otherwise.

All third-party trademarks, service marks, product names, and company names referenced on this website — including but not limited to "WhatsApp," "Meta," "Facebook," and "Google" — are the property of their respective owners. References to these platforms are made solely to describe the nature of our integration services and do not imply any official partnership, sponsorship, or endorsement.

3. Information We Collect

3.1 Customer Account Data

When you register for our Services, we collect:

• Full name and designation
• Business / company name
• Email address and phone number (including WhatsApp number)
• Username and encrypted password
• Account preferences and settings

3.2 Contact & Communication Data

When you contact us via forms, email, WhatsApp, or live chat:

• Name, email address, phone number
• Message content, attachments, and support ticket history
• Records of previous interactions with our team

3.3 Billing & Payment Data

We collect billing information required to process subscriptions and invoices. We do not store raw credit/debit card numbers on our servers. Payment processing is handled by PCI-DSS compliant third-party payment gateways (e.g., Razorpay, Stripe). We collect and store:

• Billing name and address
• Selected subscription plan and billing cycle
• Invoice history and transaction IDs
• Payment status (success, pending, failed)

3.4 GST & Business Details

For Indian customers requiring GST-compliant invoices:

• GST Identification Number (GSTIN)
• Registered business name and address
• State of registration

3.5 Device, Browser & Technical Data

Automatically collected when you visit our website:

• IP address and approximate geolocation (city/country level)
• Browser type, version, and language
• Operating system and device type
• Screen resolution and timezone
• Pages visited, time on page, clicks, and scroll depth
• Referring URL and exit pages
• Session identifiers and access timestamps

3.6 Cookies & Analytics Data

We use cookies and similar technologies including:

• Essential Cookies: Required for login sessions, security tokens, and core site functionality
• Performance Cookies: Google Analytics, Firebase Analytics — aggregate traffic data to improve our website
• Functional Cookies: Remember your preferences, language, and dashboard settings
• Marketing Cookies: Meta Pixel and Google Tag Manager — to measure ad campaign performance (not for behavioural profiling without consent)

You may manage cookie preferences through your browser settings. Disabling essential cookies may impair your ability to use the Services.

3.7 WhatsApp & Meta Platform Integration Data

When you connect your WhatsApp Business Account or Meta Business Suite to our platform, we may access and process:

• WhatsApp Business Account ID and phone number(s)
• Message templates submitted for Meta approval
• Message metadata: delivery status, read receipts, timestamps (not end-to-end message content, which remains encrypted by WhatsApp)
• Contact lists and opt-in records you upload or sync
• Campaign performance metrics (delivery rate, read rate)
• Meta Ads account data if connected for campaign management

This data is processed strictly to deliver the Services you have subscribed to. We comply fully with WhatsApp Business Platform policies and Meta Platform Terms governing the use of API data.

3.8 CRM Integration Data

If you connect third-party CRM or business tools (e.g., Zoho, HubSpot, Google Sheets) we may access:

• Contact records and lead data you authorize us to sync
• Deal stages, tags, and custom fields defined by you
• Workflow trigger events and automation logs

Access is limited to what you explicitly authorize via OAuth or API keys. We do not access CRM data beyond what is required for the specific integration you activate.

3.9 Support & Communication Records

• Support tickets, chat transcripts, and email threads
• Feedback, feature requests, and bug reports
• Call recordings (where applicable and with prior notice)

3.10 Sensitive Personal Information

We do not intentionally collect sensitive personal information such as biometric data, health/medical records, racial or ethnic origin, political opinions, religious beliefs, sexual orientation, or financial account credentials (other than payment processing data handled by third-party gateways). If such data is inadvertently submitted, it will be deleted upon discovery.

4. How We Use Your Information

• Service Delivery: Provisioning, operating, and maintaining your account and subscriptions
• Billing & Invoicing: Processing payments, generating GST-compliant invoices, managing subscription renewals
• Customer Support: Responding to queries, resolving issues, and providing technical assistance
• Product Improvement: Analyzing usage patterns to improve features, fix bugs, and optimize performance
• Security & Fraud Prevention: Monitoring for unauthorized access, abuse, or policy violations
• Legal Compliance: Meeting obligations under Indian law, regulatory requirements, and platform policies
• Marketing Communications: Sending product updates, newsletters, and promotional offers — only with your consent, and you may opt out at any time
• Platform Compliance: Verifying that your use of WhatsApp/Meta integrations complies with Meta Platform Terms and WhatsApp Business Policy

All data is used strictly for internal business purposes. We do not sell, rent, or monetize your personal data to advertisers or data brokers.

5. Data Sharing Policy

We do not sell, rent, or trade your personal information. We share data only in the following limited circumstances:

5.1 Third-Party Processors

We engage trusted service providers who process data on our behalf, bound by data processing agreements:

• Cloud Hosting & Infrastructure: Amazon Web Services (AWS), Google Cloud Platform, or equivalent — for hosting, storage, and computing
• Payment Processing: Razorpay, Stripe — for secure payment handling
• Email Services: SendGrid, Mailgun, or similar — for transactional and marketing emails
• Analytics: Google Analytics, Firebase — for website and product analytics
• Customer Support: Freshdesk, Intercom, or similar — for ticket management
• WhatsApp Business API: Meta-approved Business Solution Providers (BSPs) — for message delivery infrastructure

5.2 Meta & WhatsApp Platform

Data necessary to operate WhatsApp Business API integrations is shared with Meta Platforms, Inc. and its subsidiaries in accordance with Meta's Platform Terms and WhatsApp Business Policy. You acknowledge and accept Meta's own privacy practices when you use WhatsApp-connected features.

5.3 Legal Requirements

We may disclose your information if required by:

• A valid court order, subpoena, or government directive under Indian law
• Applicable laws, regulations, or regulatory authority requests
• Protection of our legal rights or defense of claims
• Prevention of imminent harm, fraud, or illegal activities

5.4 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of our business, your data may be transferred to the successor entity subject to equivalent privacy protections.

5.5 With Your Explicit Consent

We may share your data with third parties when you provide explicit, informed consent.

6. Data Retention

We retain personal information only as long as necessary to fulfil the purposes described in this Policy or as required by applicable law:

• Active Account Data: Retained for the duration of your subscription plus 3 years after account closure
• Billing & Invoice Records: 8 years — as required under the Income Tax Act, 1961 and GST laws of India
• Marketing Preferences & Consents: Until you withdraw consent or unsubscribe
• Support Communications: 2 years from last interaction
• WhatsApp Message Metadata: 90 days, unless required longer for legal or compliance purposes
• Website Analytics (Aggregated): Up to 26 months (Google Analytics default)
• Security & Audit Logs: 12 months

Upon expiry of the applicable retention period, data is securely deleted or irreversibly anonymized.

7. Security Practices

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, disclosure, alteration, or destruction.

7.1 Encryption

• All data in transit is encrypted using TLS 1.2 or higher (HTTPS)
• Sensitive data at rest (e.g., passwords) is encrypted using industry-standard algorithms
• Passwords are hashed using bcrypt or equivalent one-way hashing

7.2 Access Control

• Role-based access controls (RBAC) — employees access only data required for their job function
• Multi-factor authentication (MFA) enforced for all internal admin systems
• API keys and secrets stored in encrypted secret management systems

7.3 Infrastructure & Backups

• Hosted on enterprise-grade cloud infrastructure with SOC 2 / ISO 27001 certifications
• Regular automated backups with encrypted storage
• Disaster recovery and business continuity procedures in place

7.4 Breach Response

In the event of a confirmed personal data breach that poses risk to your rights, we will:

• Notify affected users within 72 hours of becoming aware of the breach
• Report to the appropriate authority under applicable Indian law
• Provide details of the breach, data affected, and remediation steps taken

No method of electronic transmission or storage is 100% secure. While we take commercially reasonable steps, we cannot guarantee absolute security.

8. Cookies & Tracking Technologies

We use cookies, pixels, web beacons, and local storage to enhance your experience. You can control cookie preferences through your browser settings. Opting out of non-essential cookies will not affect core Service functionality but may limit personalization and analytics features.

Our website may use Meta Pixel to measure advertising effectiveness. This pixel does not give Meta access to your personal account data on our platform. It tracks only standard browsing events (page views, form submissions) for ad attribution purposes in line with Meta's Business Tools Terms.

9. Your Rights

Subject to applicable law, you have the following rights over your personal data:

• Right to Access: Request a copy of the personal data we hold about you
• Right to Correction: Request correction of inaccurate or incomplete data
• Right to Deletion: Request deletion of your personal data (see Section 10)
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Object: Object to processing based on legitimate interests or for direct marketing
• Right to Withdraw Consent: Withdraw consent at any time without affecting lawfulness of prior processing
• Right to Restrict Processing: Request restriction of processing in specific circumstances

To exercise any of these rights, contact us at info@betaxlab.com. We will respond within 30 days. Certain exceptions apply under Indian law (e.g., legal holds, statutory retention requirements).

10. Data Deletion Request

You have the right to request deletion of all personal data we hold about you. This right applies to data collected through our website, WhatsApp Business API integrations, CRM connections, and any other Services.

How to submit a Data Deletion Request:

• Send an email to info@betaxlab.com with the subject line: "Data Deletion Request"
• Include your registered name, email address, and phone number so we can locate your records
• We will confirm receipt within 5 business days
• Deletion will be completed within 30 days, subject to any legal retention obligations (e.g., GST invoices retained for 8 years as required by law)
• We will notify you once deletion is complete and specify any data retained for legal reasons

11. Consent Withdrawal

Where processing is based on your consent (e.g., marketing emails, promotional WhatsApp messages), you may withdraw consent at any time by:

• Clicking the "Unsubscribe" link in any marketing email we send
• Replying "STOP" or "OPT OUT" to any promotional WhatsApp message
• Emailing info@betaxlab.com with the subject line "Withdraw Consent"

Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal. It will not affect processing necessary for service delivery under our contract with you.

12. Grievance Officer

In accordance with the Information Technology Act, 2000 and the SPDI Rules, 2011, we have designated a Grievance Officer to address privacy-related complaints and concerns:

Complaints must be submitted in writing (email is acceptable) and should clearly describe the nature of the grievance. We are committed to resolving all legitimate privacy complaints promptly and fairly.

13. Children's Privacy

Our Services are designed for businesses and professionals. We do not knowingly collect personal information from individuals under the age of 18. If you are a parent or guardian and believe your child has submitted personal information to us, please contact us immediately at info@betaxlab.com. We will delete such information promptly upon verification.

14. Response to Legal Requests

We may disclose your personal information in response to lawful requests by public authorities, courts, or government agencies in India. We will make reasonable efforts to:

• Notify affected users prior to disclosure where permitted by law
• Challenge overbroad or legally deficient requests
• Limit disclosure to only the data explicitly required by the request

15. International Data Transfers

Our primary data storage is within India. Where data is processed or stored outside India (e.g., by cloud providers with global infrastructure), we ensure appropriate safeguards are in place, including data processing agreements with standard contractual clauses. Users in the EEA have additional rights under GDPR, which we honour upon request.

16. Policy Updates

We may update this Privacy Policy from time to time to reflect changes in law, our practices, or our Services. When we make material changes, we will:

• Update the "Last Updated" date at the top of this page
• Send an email notification to all registered account holders
• Display a prominent notice on our website for at least 30 days

Your continued use of our Services after the effective date of a revised Policy constitutes your acceptance of the changes.

17. Contact Information

For any questions, requests, or concerns regarding this Privacy Policy or our data practices, please contact:

18. Legal Disclaimer

BetaXLab LLP is an independent technology company and is not affiliated with, sponsored by, or officially authorized by Meta Platforms, Inc., WhatsApp LLC, Facebook, Inc., Google LLC, or any of their parent companies, subsidiaries, or affiliates. All product names, logos, and trademarks used herein are the property of their respective owners. Any references to third-party platforms are made solely for descriptive purposes to explain service integrations.

Use of our Services does not confer any rights or privileges under Meta's or WhatsApp's intellectual property. Customers are responsible for ensuring their own compliance with Meta Platform Terms and WhatsApp Business Policy when using our API-based integration services.