Privacy Policy

1. Overview

Baat is a B2B SaaS platform. We act as a data processor on behalf of our customers (businesses) who are the data controllers for their end-user data. This policy covers both the data we collect about our customers and the data processed on their behalf.

We are committed to handling all personal data in accordance with applicable data protection laws, including India's Digital Personal Data Protection Act (DPDPA), the EU General Data Protection Regulation (GDPR) where applicable, and other regional regulations.

2. Data We Collect

Account & registration data

• Name, email address, and password when you create an account
• Company name, size, and industry
• Billing information (processed securely via our payment provider — we do not store full card details)
• WhatsApp Business Account (WABA) details and phone number

Usage & platform data

• Feature usage, page views, and in-app actions (via PostHog analytics)
• API call logs and webhook delivery records
• Broadcast campaign statistics (sent, delivered, read counts)
• AI Agent conversation logs within the platform

Customer end-user data (processed on your behalf)

• Contact names and WhatsApp phone numbers you import or sync
• Message content exchanged between your business and your customers
• Custom attributes and tags you apply to contacts
• Order data synced from Shopify or other integrated platforms

Technical data

• IP address, browser type, operating system
• Device identifiers and session tokens
• Error logs and performance diagnostics

3. How We Use Data

We use the data we collect to:

• Provide, operate, and improve the Baat platform
• Process payments and manage subscriptions
• Send transactional emails (account verification, invoices, password resets)
• Provide customer support and respond to enquiries
• Monitor platform security and prevent fraud or abuse
• Send product updates and feature announcements (you can opt out at any time)
• Analyse aggregate usage patterns to improve product features
• Comply with legal obligations

We do not sell your personal data or your customers' data to third parties. We do not use your customers' message content to train AI models.

4. Data Sharing

We share data only with the following categories of third parties, and only as necessary to provide the Services:

• Meta Platforms: Message content and contact data is transmitted through WhatsApp's Business API, operated by Meta. Meta's own Privacy Policy applies to this data.
• Payment processors: Billing data is handled by our payment provider (Razorpay for INR, Stripe for USD) under their respective privacy policies.
• Cloud infrastructure: We use Amazon Web Services (AWS) to host and store data. Data is encrypted at rest and in transit.
• Analytics: We use PostHog (self-hosted) for product analytics. No personal data is shared with PostHog's cloud.
• Email delivery: Transactional emails are sent via a reputable email service provider.
• Legal requirements: We may disclose data if required by law, court order, or to protect the rights and safety of Baat, our users, or the public.

All third-party processors are bound by data processing agreements (DPAs) ensuring equivalent data protection standards.

5. WhatsApp & Meta

Baat is an official WhatsApp Business Solution Provider. When you use Baat to send and receive WhatsApp messages, your message data passes through Meta's infrastructure in accordance with WhatsApp's Business Policy.

You are responsible for ensuring your WhatsApp messaging complies with Meta's policies and applicable laws, including obtaining opt-in consent from your customers before messaging them.

Meta may retain message metadata as described in their Privacy Policy. Baat stores message content on your behalf solely to provide the inbox, search, and analytics features of the platform.

6. Data Retention

We retain data for as long as your account is active or as needed to provide the Services:

• Account data: Retained for the duration of your subscription plus 30 days after cancellation.
• Message history: Retained according to your plan limits. You can export or delete message history at any time from the dashboard.
• Contact data: Retained until you delete contacts or close your account.
• Billing records: Retained for 7 years as required by financial regulations.
• Usage logs: Retained for 90 days for security and debugging purposes.

After account deletion, all personal data is permanently purged within 30 days, except where retention is legally required.

7. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your personal data ("right to be forgotten").
• Portability: Request your data in a machine-readable format.
• Objection: Object to processing based on legitimate interests.
• Withdrawal of consent: Withdraw consent for marketing communications at any time.
• Restriction: Request restriction of processing in certain circumstances.

To exercise any of these rights, email us at support@baat.ai. We will respond within 30 days. For requests relating to your customers' data, please direct them to the business that collected their information.

8. Cookies

We use cookies and similar technologies to:

• Keep you logged in to your account (session cookies)
• Remember your currency preference (baat_currency cookie)
• Collect anonymised product analytics (PostHog)

Essential cookies are required for the platform to function. You can control non-essential cookies through your browser settings. Disabling cookies may affect your ability to use certain features.

We do not use third-party advertising cookies or sell cookie data to ad networks.

9. Security

We take the security of your data seriously and implement appropriate technical and organisational measures including:

• TLS/HTTPS encryption for all data in transit
• AES-256 encryption for data at rest
• Role-based access controls and principle of least privilege
• Regular security audits and penetration testing
• Two-factor authentication available for all accounts
• SOC 2-compliant infrastructure (AWS)

No method of transmission over the internet is 100% secure. If you discover a security vulnerability, please report it responsibly to support@baat.ai.

10. Children's Privacy

Baat is a business-to-business platform intended for use by adults operating commercial entities. We do not knowingly collect personal data from individuals under the age of 18. If you believe we have inadvertently collected such data, please contact us immediately and we will delete it.

11. International Data Transfers

Baat is headquartered in India. Your data may be processed in countries outside your own, including India, the United States (AWS infrastructure), and other locations where our service providers operate.

Where we transfer data internationally, we ensure appropriate safeguards are in place, including standard contractual clauses (SCCs) for transfers from the EU/EEA, and compliance with India's DPDPA cross-border transfer requirements.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email and by posting a prominent notice on the platform at least 14 days before the changes take effect.

Your continued use of the Services after the effective date constitutes your acceptance of the updated policy.

13. Contact Us

For privacy-related questions, requests, or complaints, contact our Data Protection contact:

If you are located in the EU and are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority.