Draft for review by counsel. Not yet in force. Written from the product's requirements so a lawyer has a starting point. Items in square brackets must be decided before publishing.
Who we are
RawDrive Marketing is operated by [legal entity name and registered address]. For questions about this notice, contact [privacy contact].
Two kinds of data
Data about you as our customer or visitor: your name, business details, sign-in details and how you use the product. For this data we decide why and how it is used.
Data your business puts into the product: your clients' names, phone numbers, consent records and messages. Your business decides why this data is used; we process it on your instructions. [Counsel to confirm our role under the DPDP Act and Rules, and the data processing agreement each business signs before joining.]
What we use your data for
- Providing the product: sending the messages your business approves, receiving replies, and keeping consent and spend records.
- Security and audit: logging sign-ins and sensitive actions.
- Early-access requests: contacting you about access, only if you ticked the box to agree.
How long we keep it
| Data | Kept for |
|---|---|
| Contact profiles | While active, plus 24 months after last interaction |
| Messages and conversations | 24 months |
| Media | 12 months |
| Consent proof | Life of the consent, plus 3 years |
| Raw delivery data from Meta | 30 days |
| Exports | 7 days |
| Application logs | 90 days, never message text |
| Audit log | 3 years, personal fields masked after deletion |
| Backups | 35 days, rolling |
[Periods are proposed defaults and must be confirmed with counsel.]
Who we share it with
Meta, to deliver WhatsApp messages and receive replies and delivery data. [Hosting provider and region, once decided.] [Any business messaging provider, if one is used.] We do not sell personal data.
Your rights
You can ask to see, correct or delete your data, or withdraw consent. We complete requests within 30 days. If you are a client of a business that uses RawDrive Marketing, contact that business first; we help it respond. [Grievance officer details and the route to the Data Protection Board.]
Security
Two-step sign-in for admins, encrypted access to Meta accounts, separate data for each business, a three-year audit log, and an external security test before each release.
Changes
We will post changes here and, for material changes, tell customers in advance. Last updated: [date].