Privacy Policy

1. Who we are

POST (“POST”, “we”, “us”, “our”) is a WhatsApp-native AI operations assistant for Indian small and medium businesses, available at usepost.in. This policy applies to the POST marketing website, web dashboard, APIs and related services (together, the “Service”).

POST is not incorporated. It is built and run day to day by its founder and operated by Nupur Tehanguria, an individual based in India, who is responsible for the Service under this policy and collects payment for subscriptions. If a company is registered to run POST, this policy will be updated to name it.

2. Roles: who controls the data

Two kinds of personal data flow through POST, and our role differs for each:

• Your account data — information about you, our business customer. For this, we act as the data controller / data fiduciary.
• Your customers’ conversation data — messages, voice notes and contact details your end-customers send to your WhatsApp number. For this, you are the controller and POST is a processor acting on your instructions. You are responsible for having a lawful basis (such as consent) to message your customers.

3. Information we collect

Account data

Your name, work email, mobile number, business / workspace name, role, a securely hashed password, and the business and AI settings you configure.

Billing data

Your plan, billing contact and GST details, and payment metadata. Card / UPI / net-banking details are collected and processed by our payment processor (Razorpay) — POST does not store full payment-instrument details.

Usage data

How you interact with the Service: features used, requests and timestamps, approximate location derived from IP address, device and browser type, and aggregate usage counters used to enforce plan limits and calculate billing.

Conversation & content data (processed on your behalf)

WhatsApp messages and voice notes exchanged between your business and your customers, customer phone numbers and WhatsApp profile names, the lead records and notes POST generates, and any documents you upload to your knowledge base.

4. How we use information

• To provide, operate, secure and improve the Service.
• To authenticate you and maintain your session.
• To generate AI replies, transcriptions, lead scores and automations.
• To enforce plan limits and process subscriptions and billing.
• To provide support and send service / transactional messages.
• To monitor performance, debug errors, and prevent abuse and fraud.
• To comply with legal obligations.

We do not sell your personal data, and we do not use your or your customers’ conversation content to advertise to you.

5. Cookies & local storage

POST is designed to use the minimum necessary. We store your authentication token and preferences (such as light / dark theme) in your browser’s local storage to keep you signed in and remember your settings, and we use strictly-necessary cookies for security and session integrity. We do not use third-party advertising or cross-site tracking cookies. You can clear cookies and local storage in your browser at any time; doing so will sign you out.

6. Analytics

POST does not currently use third-party product-analytics or advertising tools. We keep server logs to operate and secure the Service. We may add an error-monitoring tool (for example, Sentry) to diagnose failures; if we do, it will process technical data — not your customers’ message content — and will be listed in “Third-party providers” below.

7. AI processing

POST uses large-language and voice models to understand messages and generate replies:

• Text is processed by Anthropic (Claude) as the primary provider, with OpenAI as a fallback.
• Voice notes are transcribed by OpenAI (Whisper). Where a workspace turns on spoken replies, they are synthesised by ElevenLabs or Sarvam.
• Search & memory: to let the assistant recall your business facts and documents, POST stores numerical representations (“embeddings”) of that text, created with OpenAI and held in a vector database (Qdrant Cloud).

Message content and relevant context (such as your knowledge-base documents) are sent to these providers solely to generate a response for you. Under these providers’ API terms, your inputs and outputs are not used to train their models. AI output can be imperfect — you remain responsible for reviewing AI-assisted communications. See our Terms of Service.

8. WhatsApp integration

POST connects to WhatsApp through Meta’s official WhatsApp Business Cloud API. Messages between your business and your customers are transmitted and processed by Meta under the WhatsApp Business Terms and Meta’s policies, in addition to this policy. You must comply with WhatsApp’s Business and Commerce policies and obtain any opt-in required before messaging your customers.

9. Third-party providers (sub-processors)

We share data with vetted providers only to operate the Service:

We require each provider to protect the data and use it only for the contracted purpose.

10. Data retention

We keep account and billing data for as long as your account is active and as required for legal, tax and accounting purposes. Conversation, lead and knowledge-base data are retained while your workspace is active; you can delete individual records, and we delete or anonymise your data after account closure within a reasonable period, except where retention is legally required. Backups are purged on a rolling schedule.

11. Data security

We apply reasonable technical and organisational safeguards, including encryption in transit, hashed passwords (bcrypt), signed session tokens, role-based access control, and strict per-tenant isolation (database row-level security) so one workspace cannot access another’s data. No system is perfectly secure; please use a strong, unique password and keep your credentials confidential.

12. International transfers

Several providers above process data outside India. Today our primary database is hosted in Singapore, our vector database in the United Kingdom, and our AI, email and hosting providers operate largely from the United States. We rely on each provider’s contractual and security commitments for these transfers.

13. Your rights

Subject to applicable law (including India’s Digital Personal Data Protection Act, 2023), you may:

• access the personal data we hold about you;
• correct or update inaccurate data;
• request deletion of your account data;
• export your data;
• withdraw consent where processing is based on consent; and
• raise a grievance with our Grievance Officer.

To exercise these rights, email post@usepost.in. For your customers’ personal data, your customers should contact you (the controller); we will assist you as processor.

14. Deleting your data

POST does not yet have a self-serve “delete account” button, so deletion is by request:

1. Email post@usepost.in from the address on your POST account, with the subject “Delete my data” and your workspace name.
2. We confirm the request came from the account owner before deleting anything.
3. We then delete your account, workspace, conversations, leads, uploaded documents and the embeddings made from them, and disconnect any WhatsApp, Instagram, ads or commerce connections. We aim to finish within 30 days and will email you when it is done.

Records we must keep by law (for example, payment and invoice records) are retained only for the period the law requires. If you are a customer of a business that uses POST, contact that business first; we will help them act on your request. This section is also our data deletion instructions for Meta (Facebook, Instagram and WhatsApp) platform data.

15. Grievances

Our Grievance Officer is Medhansh Tehanguria, reachable at post@usepost.in. We aim to acknowledge grievances within 7 days.

16. Children

The Service is intended for businesses and is not directed to individuals under 18. We do not knowingly collect personal data from children.

17. Changes to this policy

We may update this policy from time to time. Material changes will be notified through the Service or by email, and the “Last updated” date above will change. Continuing to use the Service after changes take effect means you accept the updated policy.

18. Contact

Questions about privacy? Email post@usepost.in or visit our Contact page.