Privacy policy

1. Who we are

Sendmint ("we", "us" or "our") is a WhatsApp marketing service for small businesses in India. Sendmint is operated by Nadaf Traders, India.

Businesses use Sendmint to connect their WhatsApp number, import contacts, create message templates, send broadcast campaigns, reply to customers from a shared team inbox and set up auto-replies. In this policy, "you" means a person who uses Sendmint, such as a business owner or a team member.

2. Our role under the DPDP Act

We play two different roles, depending on the data:

• Account and workspace data. For the data about you and your business that we need to run your account, Sendmint is the Data Fiduciary. We decide why and how this data is used.
• Your customers' contacts and messages. For the contacts you upload and the WhatsApp messages you send and receive, your business is the Data Fiduciary. Sendmint processes this data only on your behalf and on your instructions, as a Data Processor.

If you use Sendmint to message your customers, you are responsible for having their consent (opt-in) before you message them, and for honouring opt-outs, such as when a customer replies "STOP".

3. What we collect

Account data

• Your name, email address and mobile number.
• Your password, stored only as a secure hash. We never store your password in plain text and cannot see it.
• If you sign in with Google: your name, email address and profile picture from your Google profile.

Workspace data

• Your business name, your plan and your settings.
• Your team members, their roles (Owner, Admin or Agent) and pending invites.
• The message templates, campaigns and auto-replies you create.

Contacts you upload

• Your customers' names, phone numbers, tags and opt-in status.

WhatsApp messages and status data

• Messages you send and receive through Sendmint, and the conversation history in your team inbox.
• Delivery and read status updates that Meta sends us for each message.
• Details of your connected WhatsApp number and business account, and the access token Meta gives us to send messages for you.

Payment data

Payments for Sendmint plans are handled by Razorpay. We receive your subscription status and limited payment details (such as the payment method type and the last few digits of a card). We never see or store full card numbers.

Technical data

• Your IP address, device and browser type, recorded in our server logs.
• An audit log of security events, such as sign-ups, logins, failed logins, logouts and role changes, with the IP address used.

Contact form messages

If you write to us through the contact form, we keep what you send: the topic, your name, business name, email address, WhatsApp number (if you give it) and your message. We use it only to reply to you.

Cookies

• Essential session cookie. Keeps you logged in. It is secure and cannot be read by scripts on the page.
• Preference cookies. Small cookies that remember choices in the app, such as whether the sidebar is collapsed or the contact panel is open.

We do not use advertising cookies or third-party tracking cookies at the moment.

4. Why we use your data

• To provide the service: create your account, connect your WhatsApp number, send your campaigns, show your inbox and run your auto-replies.
• For security and fraud prevention: protect accounts, detect suspicious logins and keep each business's data safe.
• For billing: manage your free trial, subscription and invoices.
• For support: answer your questions and fix problems.
• For service emails: send you emails you need, such as login help, team invites, billing notices and important changes.
• To meet legal obligations: for example, keeping billing records under Indian tax laws and responding to lawful requests.

5. Legal basis and consent

We process your account and workspace data on the basis of the consent you give when you sign up, and for legitimate uses allowed by the DPDP Act, such as using data you have given us voluntarily for the service you asked for, and meeting our legal obligations.

You can withdraw your consent at any time by emailing support@sendmint.in. Withdrawing consent does not affect processing that happened before. If you withdraw consent for data we need to run your account, we may not be able to continue providing the service, and we will close your account.

For your customers' contacts and messages, your business must have a valid legal basis, such as your customers' opt-in consent. We process that data only to provide the service to you.

6. Who we share data with

We share data only with service providers who help us run Sendmint, and only as much as they need:

• Meta Platforms, to send and receive WhatsApp messages through the official WhatsApp Business Platform (Cloud API).
• Our hosting provider, which runs the cloud servers where Sendmint and its database are hosted.
• Razorpay, to process subscription payments.
• Google, only if you choose to sign in with Google.
• Resend, to send emails, such as the messages from our contact form to our support team.

These providers may process data outside India, in the countries where they operate. When that happens, we use providers with appropriate safeguards and follow any transfer restrictions set by the Government of India under the DPDP Act.

We may also share data if the law requires it, for example in response to a valid order from a court or a government authority.

We do not sell personal data. We do not use your customers' contacts or messages for our own marketing.

7. How long we keep data

• Account and workspace data: kept while your account is active. When your account is closed, we delete it within 30 days, except what the law requires us to keep.
• Paused accounts: if your trial or paid plan ends and you do not choose a plan, your account is paused and we keep its data for 90 days so you can come back or export it. We remind the owner before the end; after 90 days we delete it.
• Invoices and billing records: kept for at least 8 years, as required by Indian tax laws.
• Security logs and the audit log: kept for up to 1 year.
• Contact form messages: kept for up to 1 year after we last reply, then deleted.
• Backups: rotated, so deleted data is removed from backups within 30 days.

8. How we protect data

• All connections to Sendmint use HTTPS, and our pages send standard security headers.
• Passwords are hashed, never stored in plain text.
• When you choose a new password, we check it against lists of known breached passwords using the Have I Been Pwned service. Only the first 5 characters of a hash of your password are sent. Your password itself is never sent.
• Meta access tokens are stored encrypted (AES-256-GCM).
• Team members get access based on their role (Owner, Admin or Agent), so each person sees only what their role allows.
• Each business's data is kept separate from every other business's data.
• We keep an audit log of security events, such as logins, failed logins and role changes.

No system is completely secure. If a personal data breach happens, we will inform affected users and the Data Protection Board of India as required by the DPDP Act.

9. Deleting your account

You can ask us to delete your account and your workspace data at any time. See our data deletion instructions for how to do it and what gets deleted.

10. Your rights

Under the DPDP Act, 2023, you have the right to:

• Access: get a summary of the personal data we hold about you, how we use it and who we have shared it with.
• Correction and completion: ask us to correct data that is wrong or complete data that is missing. You can also update most details yourself in the app.
• Erasure: ask us to delete your data, unless we need to keep it by law.
• Withdraw consent: at any time, as easily as you gave it.
• Grievance redressal: raise a complaint with us and get a response.
• Nominate: name another person to use these rights for you if you die or become unable to act.

To use any of these rights, email support@sendmint.in from the email address of your account. We may ask you to confirm your identity before we act on the request.

If you are a customer of a business that uses Sendmint

If a business has messaged you through Sendmint, that business controls your data. Please contact the business first to access, correct or delete your data. You can also email us at support@sendmint.in, and we will help the business respond. To stop messages from a business, you can reply "STOP" to its WhatsApp message.

11. Children

Sendmint is a service for businesses. It is not meant for anyone under 18, and we do not knowingly collect data from children to create accounts. If you believe a child has created an account, email us and we will delete it.

12. Grievance officer

If you have a complaint about how we handle personal data, contact our grievance officer:

• Grievance Officer, Sendmint
• Email: support@sendmint.in

We will respond within the time limits set by the DPDP Act and its rules. We aim to acknowledge your complaint within 7 days and resolve it within 30 days.

If you are not satisfied with our response, you can complain to the Data Protection Board of India.

13. Changes to this policy

We may update this policy from time to time. When we do, we will post the new version on this page with a new "Last updated" date. For significant changes, we will tell account owners by email or in the app at least 15 days before the changes take effect.

See also our Terms of service.