Privacy Policy

This Privacy Policy explains how the company that operates RapBooster, named under Company information at the end of this page ("RapBooster", "we", "us"), collects, uses, shares and protects personal data when you visit rapbooster.com, sign up, use the RapBooster apps or contact us, and the rights you have. We process personal data under India's Digital Personal Data Protection Act, 2023 and its rules (the "DPDP Act") and the Information Technology Act, 2000, and, where they apply to you, other data protection laws such as the GDPR.

1. Who is responsible

• For our own customers, sign-ups and website visitors, we decide why and how your personal data is processed: we are the data fiduciary (controller) for it.
• For the data a business puts into its RapBooster workspace (its contacts, leads, customers, messages and staff records), that business is the data fiduciary and we are its data processor: we process that data only on the business's instructions to provide the Service. If you are a contact of one of our customers and want to use your rights over that data, please contact that business first; we will help it respond.

2. What we collect

You give us:

• Account and profile data: name, mobile number, email, business name, role, address, GST or tax details and profile photo.
• Sign-up data: your mobile number and each sign-up step you complete (see section 3).
• Billing data: plans bought, invoices, payment status and billing contact. Card and bank details are entered on our payment gateways' pages and are not stored by us.
• Form and message data: what you send us through the website forms (demo, contact, quote, consultation, partner, careers), chat, WhatsApp, email, calls and support tickets, including call recordings where you are told about them.
• Job applications: your résumé and the details you give when you apply for a job with us.

We collect automatically:

• Usage and device data: pages and features used, actions taken, IP address, browser, device and operating system, approximate location from the IP address, and the date and time of each request, kept in logs for security and troubleshooting.
• Cookies and similar technologies, as our Cookie Policy explains. Analytics and advertising tools run only with your consent where consent is required.
• Visit measurement: our own cookie rb_vid holds a random visitor number, set on your first visit (before you make a choice on the cookie banner) and kept for 13 months from your last visit. With it we record the pages you view on our website, the site or campaign that brought you, and your IP address only as a hash that can be matched within one day (never the IP itself). No third party receives it. When you sign up or sign in, we link this visitor number to your account, so we know which visits and campaigns led to your account and purchases; from then on these visit records are personal data about you. Visit records are deleted 13 months after your last visit; the source credited to a sign-up or purchase is kept with that record. Clearing your cookies starts a new visitor number; you can also ask us to delete the link (section 9).

From others: payment status from payment gateways, delivery and read status from messaging providers, and information from a person who refers you to us or invites you to a workspace.

3. Sign-up data is kept from the first step

When you type your mobile number on our sign-up page, we record it straight away, before you verify the OTP and even if you never finish signing up, together with the time and the sign-up steps you complete: number entered, OTP verified, profile filled, workspace created and plan bought. This record is a lead in our own CRM. We use it to help you finish signing up, to answer questions and to follow up about RapBooster by call, WhatsApp, SMS or email. When you create a workspace, the same record becomes your customer record. You can ask us at any time to stop contacting you or to delete this record (section 9).

4. Why we use it, and on what basis

Purpose	Basis
Create and secure your account, sign you in with an OTP, run your workspace and provide the apps you use	Your consent when you sign up, and performance of our agreement with you
Start and manage plans, bill you, collect payment and keep tax records	Performance of the agreement and our legal obligations (GST and accounting law)
Support, onboarding help and service messages (renewal reminders, the notices after a plan ends, warnings before an inactive workspace is deleted, security alerts)	Performance of the agreement and legitimate uses the DPDP Act allows
Follow up on a sign-up you started or a form you sent	Your consent, given when you enter your number or tick the consent box on the form
Marketing about our products and offers	Your consent, which you can withdraw at any time
Measure and improve the website and our ads	Your consent through the cookie banner where it is required
Keep the Service safe: prevent fraud, spam and abuse, investigate incidents	Legitimate uses and our legal obligations
Comply with the law, court orders and requests of authorities	Our legal obligations

Where we rely on consent, you can withdraw it as easily as you gave it (section 9). Withdrawal does not affect processing already done and may mean we can no longer provide part of the Service.

5. Messages we send about your plan and your workspace

When a paid plan is about to end, and when it has ended and the workspace is on the Free plan, we send you service messages by email and WhatsApp. If nobody signs in to a workspace, we also warn the owner by email and WhatsApp before it is deleted: on days 20, 27 and 29 for a workspace that has never had a paid plan, and on days 60, 80 and 89 for one that has. These tell you what happens to your data and how to keep it. You may ask us to stop them; we will then send only the notices the law requires.

6. Rappy and AI providers

When you use Rappy, the AI assistant, or another AI feature, the request and the workspace data needed to answer it are sent to third-party AI model providers to generate the response. We send only what the request needs and do not sell it. Do not enter sensitive personal data into an AI feature unless you need to.

7. Who we share it with

We do not sell personal data. We share it only with:

• Service providers who work for us, under contract and only for the purposes above: cloud hosting and storage, backups, email, SMS, OTP and telecom providers, the WhatsApp Business Platform, RCS providers, payment gateways, AI model providers, analytics and advertising tools (with consent), and customer support tools.
• Our team, on a need-to-know basis. Support staff open a workspace only for a stated reason, for a limited time, and every access is logged.
• Authorities, when the law, a court or a government body lawfully requires it, or to protect the rights, safety or property of our users, the public or us.
• A buyer or successor, if our business or part of it is merged, sold or reorganised, under the same protections.

Some providers process data outside India. We transfer personal data abroad only as the DPDP Act permits and, for visitors covered by the GDPR, with appropriate safeguards.

8. How long we keep it

• Workspace data: while the workspace is active (any member signs in). A workspace that has never had a paid plan and has no sign-in for 30 days is permanently deleted. A workspace that has had a paid plan at any time is permanently deleted after 90 days without a sign-in. Deletion includes credit and Rappy token balances. When a paid plan ends the workspace falls back to the Free plan and nothing is deleted at that point; numbers and mailboxes paused above the Free limits are kept for 90 days and then disconnected. Backup copies are overwritten in their normal cycle.
• Sign-up leads that did not become a workspace, and form enquiries: as long as needed to follow up and for up to 3 years after our last contact, unless you ask us to delete them sooner.
• Customer, invoice and payment records: for the period tax and accounting law requires (in India, generally 8 years from the end of the relevant financial year).
• Security logs: for the period our security and legal needs require, normally up to 1 year, longer where an incident needs it.
• Job applications: up to 1 year after the role is filled, unless you agree to a longer period.

9. Your rights

Under the DPDP Act you have the right to:

• access a summary of the personal data we process about you and the processing activities, and the identities of those we shared it with;
• correct, complete and update your personal data;
• erase personal data that is no longer needed for the purpose it was collected for, unless the law requires us to keep it;
• withdraw consent at any time, as easily as you gave it;
• grievance redressal: have your complaint answered by us; and
• nominate another person to use your rights if you die or become incapable.

If you are covered by the GDPR, you also have the rights to object to processing, restrict it, data portability and to complain to your local supervisory authority.

To use a right, write to [email protected] or to the Grievance Officer below from the mobile number or email linked to your account, or tell us how we can verify who you are. We may ask for proof of identity. We will reply within 30 days, or sooner where the law requires. If you are not satisfied with our answer, you may complain to the Data Protection Board of India.

Please note: a workspace with no sign-in is deleted after 30 or 90 days (see our Terms and section 8). Export the data you need with the apps' export tools before then.

10. Security

We protect personal data with reasonable security safeguards, including a separate database for every workspace, encryption of data in transit, role-based access control, approvals and an audit log in the apps, OTP sign-in, logged and time-limited support access, monitoring and nightly backups. No system is perfectly secure. If a personal data breach occurs, we will inform the affected persons and the Data Protection Board as the DPDP Act requires, and our customers without undue delay where it affects data we process for them.

11. Children

Our Service is for businesses and is not meant for anyone under 18. We do not knowingly process the personal data of children. If you believe a child has given us personal data, contact us and we will delete it.

12. Links to other sites

Our website and apps may link to other websites and platforms. Their own privacy policies apply to them, not this one.

13. Changes to this policy

We may update this policy. Each version is published on this page with the date it comes into force. For a material change we tell account owners by email or in the app before it comes into force.

14. Contact and grievances

Grievance Officer: Punit Agarwal, at the registered address shown under Company information, email [email protected].

We acknowledge grievances within 48 hours and resolve them within 30 days. General questions: [email protected], or call or message us on WhatsApp at +91 96804 40022.