This policy explains how SoftSync Lab (“SoftSync Lab”, “we”, “us”) collects, uses, shares and protects personal data when you:
- visit softsyncsolutions.in or contact us;
- use a product we operate, such as RoSync for CA and ClinicDost;
- use software we build and run for a business (“client software”), such as a CRM, HRMS or ERP; or
- message, or are messaged by, a business that uses our services on the WhatsApp Business Platform, where SoftSync Lab acts as a Meta Tech Provider.
Some products have their own privacy notice with more detail (for example, RoSync for CA at ca.softsyncsolutions.in/privacy). Where a product notice is more specific, it applies alongside this policy.
1. Our role: Data Fiduciary or Data Processor
Under India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”):
- We are the Data Fiduciary for personal data we collect for our own purposes: website visitors and enquiries, people who contact us, and the user accounts of our own clients’ staff.
- We are a Data Processor for personal data our client businesses put into, or receive through, the software we run for them. This includes their customers’ details, their WhatsApp conversations, their records and their documents. Each client business is the Data Fiduciary for that data and decides why and how it is used; we process it only on their instructions and under our agreement with them.
If you are a customer of one of our client businesses (for example, you chatted with a business on WhatsApp), please contact that business first about your data. You may also write to us (section 12) and we will help or pass your request on.
2. What we collect
From you directly
- Contact and enquiry details: name, business name, phone number, email, city, and what you write to us.
- Account details for people who use our products: name, email, phone number, role, and sign-in information.
Data our client businesses put into their software
- Customer and contact records: names, phone numbers, email addresses, business details, addresses, GSTIN or PAN where the business records them.
- Business records: leads, quotations, invoices, orders, payments due, tasks, calendar entries and notes.
- Notes, journal entries and voice notes the business’s own staff choose to record.
- For clinics using ClinicDost: appointment and patient details the clinic enters. Health information is processed only for the clinic and only to provide the service.
WhatsApp Business Platform data (when a business connects its WhatsApp account through us)
- The business’s WhatsApp Business account details, phone number, display name and message templates.
- Messages exchanged between the business and its customers: text, photos, documents and voice notes, with their time, delivery and read status.
- Customers’ WhatsApp phone numbers and profile names.
- Where the business chooses to connect its existing WhatsApp Business app (“coexistence”), its recent chat history (up to the last 6 months, as provided by Meta) and its contacts, so its customer history appears in its own software.
- When a business owner connects through Meta’s sign-up window (“Embedded Signup”): their name, email and the access Meta grants to the business’s WhatsApp assets. We do not receive the owner’s Facebook password.
Technical data
- Log records, IP address, device and browser information, and app crash reports, used for security and to fix problems.
- On mobile apps we provide: a notification token so the business’s staff can receive alerts, and the app version.
- Cookies and similar technologies on our website, described in section 5.
3. Why we use it
- To provide each service: storing records, sending and receiving the business’s WhatsApp messages, reminders, quotations, invoices and notifications, and showing the business its own data.
- Automated replies: where a business switches on an AI assistant, incoming customer messages and the business’s own product, price and policy information are used to draft replies on the business’s behalf. The business can turn this off and can take over any chat. Replies are based on the business’s own information, not general knowledge.
- To keep accounts and data secure, prevent misuse, and investigate problems.
- To reply to enquiries and provide support.
- To understand how visitors use our website and improve it.
- To meet legal obligations.
We do not sell personal data. We do not use our clients’ customers’ data for advertising. We do not use WhatsApp messages or client data to train AI models.
4. Who we share it with
We share personal data only as needed to run the services, with:
- Meta Platforms (WhatsApp Business Platform / Cloud API): message content and phone numbers are transmitted to and processed by Meta to deliver WhatsApp messages. Meta’s own terms and privacy policy apply to its processing.
- Hosting and infrastructure: Supabase (database, file storage and server functions), Vercel (websites and web apps), and Google Firebase (mobile push notifications).
- AI providers, only where a business uses an AI feature: Google (Gemini API) and Anthropic (Claude API). They process the text, images or audio needed to produce a reply, under their business API terms, which do not allow them to use this data to train their models.
- Website analytics and advertising providers listed in section 5, for website visitors only.
- Email and messaging providers we use to send account emails.
- Authorities, where the law requires it.
Each provider is bound by its terms to protect the data and use it only to provide its service.
5. Cookies, analytics and advertising on our website
This section applies to visitors of softsyncsolutions.in only. It does not apply to client software or WhatsApp data, which is never used for advertising.
- Analytics: we use Google Tag Manager, Microsoft Clarity, Contentsquare and Vercel Web Analytics to understand how visitors use the site (pages visited, clicks, scrolling and device type). Microsoft Clarity and Contentsquare may record anonymised sessions of how you interact with pages. They use cookies or similar technologies to do this.
- Advertising: our website shows ads served by Google AdSense. Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this and other websites. Google’s use of advertising cookies enables it and its partners to serve ads to you based on your visits to our site and/or other sites on the Internet.
You can opt out of personalised advertising by visiting Google Ads Settings or www.aboutads.info. You can also block or delete cookies in your browser settings; the site will still work. Learn more in how Google uses data from sites that use its services and the Microsoft Privacy Statement.
6. Where data is stored
Data may be stored and processed on servers outside India (for example in Singapore or the United States) by the providers above. We choose providers with strong security practices and use them only for the purposes in this policy.
7. How long we keep it
- Client software data: for as long as the client’s account is active. After an account is closed, we delete it within 90 days, unless the client asks us to return it first or the law requires us to keep it longer.
- WhatsApp messages and media: kept in the business’s own software for as long as the business keeps its account, under the business’s control. The business can delete conversations.
- Enquiries and contact details: up to 2 years after our last contact, unless you become a client.
- Security logs: up to 180 days.
8. Security
We use encrypted connections, access controls, row-level security that keeps each business’s data separate, private storage for files, and secrets kept on servers rather than in apps. No system is perfectly secure; if a breach affecting your personal data occurs, we will notify the affected client businesses and, where required, the Data Protection Board of India.
9. Your rights
Subject to the DPDP Act, you can ask to:
- access a summary of your personal data and how it is processed;
- correct or update it;
- erase it, where it is no longer needed or you withdraw consent;
- withdraw consent you gave us;
- nominate someone to exercise your rights if you cannot; and
- raise a grievance (section 12).
If your data is held for one of our client businesses, we will pass your request to that business and support it.
WhatsApp messages: you can stop receiving a business’s messages by replying STOP or by telling the business. Businesses using our services only send template messages to customers who have agreed to receive them.
10. Deleting your data
To request deletion, email contact@softsyncsolutions.in with the subject “Data deletion request”, the phone number or email linked to your data, and the business or product concerned. We confirm the request within 7 days and complete it within 30 days, unless the law requires us to keep some data. For data held for a client business, we act on that business’s instructions.
Step-by-step instructions, including how a business can disconnect its WhatsApp account, are on our Data Deletion page.
11. Children
Our services are for businesses and are not directed at children under 18. We do not knowingly collect children’s data for our own purposes. Client businesses are responsible for the data they choose to enter.
12. Contact and Grievance Officer
SoftSync Lab
3rd, 22nd & 23rd Cross Road, Sri Nandi Garments, T. Dasarahalli, Bengaluru, Karnataka 560057, India
Email: contact@softsyncsolutions.in
Grievance Officer: Rohith P M — contact@softsyncsolutions.in
We acknowledge grievances within 7 days and resolve them within 30 days. If you are not satisfied, you may approach the Data Protection Board of India.
13. Changes to this policy
We may update this policy when our services or the law change. The “Last updated” date shows the latest version; for significant changes we will notify our client businesses.
This policy is governed by the laws of India; courts in Bengaluru have jurisdiction.