Privacy Policy

This Privacy Policy applies to all personal data processed by HelloBotz through:

• Our website (paleturquoise-eagle-534704.hostingersite.com) and subdomains
• Our web-based platform, admin dashboards and mobile applications
• Our AI chatbot, WhatsApp automation, Education ERP and other products
• Any communication with us via phone, email, WhatsApp or forms

We collect the following categories of information:

* Student and parent data is uploaded by the institute client — we act as a processor. The institute is responsible for obtaining appropriate consent from parents/guardians.

We use the information we collect for the following purposes:

• Providing the service: Deliver, maintain and improve our AI automation, ERP and engagement platform
• Account management: Create and secure your account, process payments, send invoices and receipts
• AI training & personalisation: Train AI chatbots and voice agents on your course and fee data — only for your account
• Communication: Send product updates, security alerts, support responses and renewal reminders
• Analytics: Understand how our platform is used to improve features and performance
• Legal compliance: Comply with tax, audit and regulatory obligations (including DLT/TRAI, DPDP Act)
• Security: Detect, prevent and address fraud, abuse, security incidents and technical issues
• Marketing (with consent): Send newsletters, webinars and product announcements — you can opt out anytime

Under the DPDP Act, 2023, we process personal data on the following legal bases:

• Consent: You have given us clear, informed consent to process your data for specific purposes. You may withdraw consent at any time.
• Contractual necessity: Processing is required to deliver the services you've purchased from us.
• Legal obligation: Processing is required to comply with laws (GST, tax, TRAI, DLT, court orders).
• Legitimate use: For fraud prevention, security, product improvement and internal analytics — with appropriate safeguards.

Where we rely on consent, you have the right to withdraw it at any time by emailing info@hellobotz.com. Withdrawal does not affect the lawfulness of processing done before withdrawal.

We use cookies and similar technologies to keep you logged in, remember preferences and understand how our platform is used. You can manage cookies via your browser settings.

Disabling cookies may affect certain platform features. For more details, see our Cookie Policy.

We only share personal data with the following categories of recipients — and only to the extent necessary:

• Cloud & hosting providers: AWS, Google Cloud or similar — to host our platform securely
• Messaging & communication partners: Meta (WhatsApp Business API), Google (RCS), DLT-registered SMS gateways, email service providers
• Payment gateways: PCI-DSS compliant partners such as Razorpay, Stripe or PayU for processing transactions
• AI service providers: LLM and voice-model partners — under strict data-use restrictions and no-training clauses
• Analytics providers: Google Analytics, Microsoft Clarity (with IP anonymisation enabled)
• Professional advisors: Auditors, lawyers, accountants — under confidentiality obligations
• Government authorities: When legally required (court orders, tax authorities, law enforcement)

We implement industry-standard security measures to protect your data:

• Encryption in transit: All data transmitted via HTTPS/TLS 1.2 or higher
• Encryption at rest: Databases and backups encrypted using AES-256
• Access control: Role-based permissions, least-privilege principle, audit logs
• Authentication: Strong password hashing (bcrypt), optional 2FA, session timeout
• Regular backups: Daily encrypted backups with 30-day retention
• Security monitoring: Continuous monitoring for anomalies, intrusion attempts and vulnerabilities
• Employee training: All staff undergo security and privacy training
• Vendor audits: Annual security reviews of critical vendors

While we follow best practices, no system is 100% secure. If you suspect any security issue, email us at info@hellobotz.com immediately.

We retain personal data only as long as necessary for the purposes described in this policy:

After expiry, data is either permanently deleted or irreversibly anonymised.

Under the DPDP Act, 2023, you have the following rights:

• Right to Access: Request a summary of personal data we hold about you and how it's being processed
• Right to Correction: Request correction of inaccurate, incomplete or outdated data
• Right to Erasure: Request deletion of your personal data, subject to legal retention requirements
• Right to Withdraw Consent: Withdraw previously given consent at any time
• Right to Grievance Redressal: File a complaint with us or escalate to the Data Protection Board of India
• Right to Nominate: Nominate someone to exercise your rights in case of death or incapacity
• Right to Data Portability: Receive your data in a structured, machine-readable format

To exercise any of these rights, email info@hellobotz.com. We will respond within 30 days. We may need to verify your identity before acting on the request.

Because we serve the education sector, some personal data we process relates to children (minors under 18 years). We take this responsibility very seriously.

Our safeguards for children's data include:

• No behavioural or targeted advertising to minors
• No tracking, monitoring or profiling for commercial purposes
• Strict access controls — only authorised institute staff and our support team (with client approval) can access this data
• Additional deletion safeguards when accounts close

Our primary data storage and processing servers are located in India. However, some of our service providers (cloud hosting, AI models, analytics) may process data outside India.

When we transfer personal data outside India, we ensure:

• The destination country offers an adequate level of data protection, or
• We have Standard Contractual Clauses or equivalent safeguards in place, or
• We rely on your explicit consent for the specific transfer

We do not transfer data to countries blacklisted by the Government of India or the Data Protection Board of India.

Our platform integrates with and links to third-party services (Meta, Google, payment gateways, cloud providers). These services have their own privacy policies, and we are not responsible for their content or practices.

We encourage you to review the privacy policies of any third-party service before using it:

• Meta / WhatsApp Privacy Policy
• Google Privacy Policy
• Payment gateway privacy policies (Razorpay, Stripe, PayU and similar)

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements or business operations.

When we make material changes:

• We will update the "Last Updated" date at the top of this page
• We will notify you by email or in-app notification at least 7 days before the change takes effect
• For significant changes, we may ask for your renewed consent

Your continued use of our platform after the effective date of the change constitutes acceptance of the updated policy.

For any questions, concerns or complaints regarding this Privacy Policy or our data practices, please reach out to us:

If you are not satisfied with our response, you have the right to file a complaint with the Data Protection Board of India at dpb.gov.in.