Privacy Policy & Data Protection
This Privacy Policy governs your use of Growxa Ai (accessible at growxa.in). We are committed to processing personal data in full compliance with the Digital Personal Data Protection Act, 2023 (“DPDP Act”) of India, the Information Technology Act, 2000, and Google API Services User Data Policies.
Table of Contents
1.Statutory Notice Under Sections 5 & 6 of the DPDP Act, 2023
Under Section 5 of the Digital Personal Data Protection Act, 2023, before or at the time of requesting your consent for processing personal data, Growxa Ai is required to furnish you with a clear, plain-language notice informing you of:
- The personal data sought to be collected and the specific, lawful purpose for which such data will be processed.
- The manner in which you may exercise your rights under Chapter III of the DPDP Act (including right to access, right to correction, right to erasure, and right to grievance redressal).
- The manner in which you may make a complaint to the Data Protection Board of India.
- Your unconditional right to withdraw consent at any time, with the withdrawal taking effect promptly without affecting the legality of processing performed prior to the withdrawal.
2.Data Fiduciary Details
For personal data provided when registering for an account, subscribing, or submitting inquiries, Growxa Ai (“Growxa”) operates as the Data Fiduciary:
3.Categories of Personal Data We Process
We collect and process only the minimal personal data necessary for our autonomous local business marketing services:
A. Account & Business Principal Data
Business owner full name, authorized email address, mobile number, business store name, category, and address provided during registration or onboarding.
B. Google Business Profile Authorization Data
OAuth 2.0 access and refresh tokens, Google Account location ID, public customer reviews, star ratings, and Google Maps performance metrics. We store tokens encrypted at rest using AES-256 / Fernet encryption.
C. Customer Engagement & Inbound Chat Data
Customer mobile numbers interacting with your WhatsApp bot are masked in dashboard interfaces (e.g. +91 ******3210) and Fernet-encrypted at rest. Inbound customer queries are used strictly to provide grounded catalog answers.
4.Google API Services User Data Policy Compliance
Growxa Ai uses Google APIs to connect your Google Business Profile. Growxa Ai’s use and transfer to any other app of information received from Google APIs adheres strictly to the Google API Services User Data Policy, including the Limited Use requirements:
- No Third-Party Resale: We never sell, rent, or trade Google user data to advertising platforms, data brokers, or information resellers.
- No LLM Training on Private Data: We do NOT use your Google Business Profile personal data to train generalized AI foundation models without explicit authorization.
- Strict Human-in-the-Loop Gate: Google data is accessed solely to draft local updates, calculate GeoGrid metrics, and prepare review replies, which require your explicit approval before publishing.
- Core Field Protection: We never alter your core GBP identity fields (Business Name, Address, Category, Phone) through automated routines.
5.WhatsApp CRM & Anti-Spam Safeguards
For businesses utilizing Growxa Ai’s WhatsApp Customer Engagement engine:
- Consent Verification: Outbound retention broadcasts are dispatched exclusively to contacts who have expressly opted in (`consent_given: true`). Contacts without verifiable consent are unconditionally skipped.
- Immediate Opt-Out: Every marketing communication includes clear opt-out instructions (“Reply STOP to unsubscribe”). Opt-outs are recorded and enforced in real time.
- Zero Unverified Price Promises: All automated replies run through an anti-hallucination grounding checker against your verified catalog before transmission.
6.Your Statutory Rights Under Chapter III of DPDP Act, 2023
As a Data Principal residing in India, you are endowed with non-derogable legal rights:
Right to Access (Section 11)
You may obtain a summary of your personal data being processed and the identities of data fiduciaries with whom it has been shared.
Right to Correction & Erasure (Section 12)
You may demand correction of inaccurate data, completion of incomplete data, or complete erasure of your data when no longer needed.
Right of Grievance Redressal (Section 13)
You have the right to accessible grievance redressal from Growxa Ai within 30 days, before approaching the Data Protection Board.
Right to Nominate (Section 14)
You may nominate an individual who shall, in the event of your death or incapacity, exercise your data rights on your behalf.
To exercise any of these rights, email our Grievance Officer at [email protected] or use the in-app Account Settings deletion button.
7.Data Retention & Complete Erasure
Personal data is retained solely for the period necessary to satisfy the purpose for which it was obtained or as mandated by applicable tax and accounting laws in India (e.g. GST and Income Tax regulations).
Upon account termination or verified erasure request under Section 12(3) of the DPDP Act, all OAuth tokens, customer leads, and business context memory are wiped from active operational databases within 7 business days.
8.Designated Grievance Redressal Officer (DPDP Act Section 12)
In accordance with Section 12 of the Digital Personal Data Protection Act, 2023 and Rule 3(2) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, the contact details of our Data Protection Grievance Officer are published below:
If your grievance is not resolved within 30 days or you are aggrieved by the decision of our Grievance Officer, you may prefer an appeal to the Data Protection Board of India in accordance with Section 13(3) of the DPDP Act.