Privacy Policy

Shopranch serves two different groups of people, and we collect different data about each:

• Business Owners ("you", "Subscribers") — the shop, clinic, boutique or service business that signs up for a Shopranch account and uses our dashboard.
• End Customers— the people who message a Business Owner on WhatsApp. Shopranch processes their messages on the Business Owner's behalf so the AI assistant can reply.

For Business Owners, Shopranch is the data fiduciary (controller) of your account data. For End Customer conversation data, Shopranch acts as a data processoron behalf of the Business Owner, who is the data fiduciary for their own customers' data — see Section 10.

2.1 Account & business information (Business Owners)

• Name, email address and profile photo from Google Sign-In.
• Phone number and address you add to your profile.
• Business details: name, type, logo, hours, address, contact phone/email.
• Your WhatsApp Business Account connection (phone number, WhatsApp Business Account ID, and an access token we store encrypted).
• Products, prices, images, stock levels and your knowledge-base documents (PDFs/text files you upload).
• Custom fields you configure for orders/appointments.

2.2 Payment information — your Shopranch subscription

Subscription payments are processed by our payment partner, Razorpay. Shopranch does not receive or store your full card, UPI or bank details — Razorpay handles this in line with its own PCI-DSS compliant systems. We store only your plan, subscription status, billing dates and Razorpay-issued reference IDs.

2.3 Payment integrations you connect (e.g. your own Razorpay account)

Separately from Section 2.2 above, you can connect your own payment gateway account — currently Razorpay — under Dashboard → Integrations, so your assistant or your staff can send customers a payment link for a prepaid order. When you do, we store the API credentials you provide (e.g. your Razorpay Key ID and Key Secret) encrypted at rest, the same way we protect your WhatsApp access token — see Section 6. We use these credentials only to call the provider's API on your instructions (for example, to create a payment link); we never see, receive, or hold the resulting funds — money paid through a link you send settles directly into your own connected account, not Shopranch's. You can disconnect an integration at any time from the Integrations page, which stops us from using its credentials and deletes them from our systems.

2.4 Conversation data (End Customers)

When someone messages a Shopranch-powered business on WhatsApp, we process, on that business's behalf:

• Their phone number/handle and WhatsApp-provided display name.
• The text of their messages, and any images, videos, voice notes or documents they send (stored privately, never made public). This can include a payment-proof screenshot a customer sends as evidence of paying the Business Owner directly (for example, a UPI transfer) — Shopranch does not process card or bank payments through chat itself; see Section 4 for the guidance we give customers about not sharing sensitive payment details this way.
• Orders and appointments they place: items, quantities, prices, delivery/contact details, and status.
• Metadata such as message timestamps and delivery status.

2.5 Automatically collected data

Like most web services, we log technical data for security and reliability: IP address, browser/device type, pages visited, and timestamps. We do not currently use third-party advertising or analytics trackers on our website.

2.6 Cookies

We use one essential, strictly-necessary cookie to keep you signed in to your dashboard session. We do not use advertising or cross-site tracking cookies.

• To provide the Service — operate your dashboard and run your AI assistant on WhatsApp.
• To process orders and appointments your customers place in chat.
• To answer customer questions using your knowledge base and product catalog.
• To process subscription payments and manage billing.
• To provide analytics about your own business's conversations, orders and customers.
• To detect abuse, secure accounts, and enforce our Terms.
• To communicate with you about your account, billing, or material changes to the Service.

We do not sell personal data, and we do not use End Customer conversation content to train general-purpose AI models or for advertising.

Shopranch's assistant is powered by large language models hosted on Amazon Web Services (AWS Bedrock). Understanding what a customer is asking, taking orders, booking appointments, and answering FAQs is handled by Anthropic's Claude (Haiku) model. A separate, smaller model (Amazon Nova Lite) is used only to produce a short, factual description of a photo or video a customer sends (for example, "a blue running shoe") — Shopranch does not send raw images or video to the main conversational model; only that short description is passed along as text. To generate a reply, relevant conversation text (and, on supporting plans, a photo/video description or a voice-note transcript) is sent to the model along with the Business Owner's configured business data (hours, catalog, FAQs). Responses are generated automatically; a human at the Business Owner reviews conversations only if they choose to take over a chat. No decision with a significant legal or similarly significant effect on an End Customer is made by AI alone without the option of human review by the Business Owner.

Under AWS's published policy for Amazon Bedrock, the prompts, images, and responses processed on our behalf are not used by AWS or the underlying model provider to train their models, and are not shared with other AWS customers. Some content may be held very briefly — for example, within a short prompt-caching window used purely to speed up and reduce the cost of repeated requests — but this is not a form of retention for training or any other purpose, and it is not accessible to the model provider.

Because chat is handled by an AI rather than a person by default, we send End Customers a one-time notice at the start of each chat session (a fresh conversation, or one resuming after a period of inactivity) reminding them not to share One-Time Passwords (OTPs), passwords, or full card/bank account details in chat, and to hide or blank out sensitive numbers — such as a full card number — before sending a payment-proof screenshot. This is a safety practice, not a guarantee: a Business Owner can take over a conversation from a human at any time, but until they do, messages are read and responded to by the AI as described above, and we cannot control what a customer chooses to type or send despite the notice.

We share personal data only with service providers who help us run Shopranch ("sub-processors"), and only to the extent needed to provide the Service. We do not sell personal data to third parties.

A note on integrations you connect yourself:if you connect your own Razorpay account under Dashboard → Integrations to accept prepaid payments from your customers (Section 2.3), that is your account and your own agreement with Razorpay — not a sub-processor relationship Shopranch entered into on your behalf, and separate from the subscription-payment row in the table above. Shopranch only calls Razorpay's API using the credentials you provide, on your instructions, and never touches the resulting funds.

A note on Meta's own costs: Shopranch is registered with Meta as a Technology Provider, which means Meta bills the connected WhatsApp Business Account directly— not Shopranch. You add your own payment method in your own Meta Business Manager account, and Meta invoices you independently, at rates it sets and can change. Under Meta's current pricing, day-to-day assistant replies (sent within 24 hours of a customer message) aren't billed by Meta at all; charges apply only to proactive template messages, a feature Shopranch doesn't currently offer. See Third-party services & costs in our Terms & Conditions for full details.

We may also disclose information if required by law, to enforce our Terms, or to protect the rights, safety or property of Shopranch, our users, or others.

Data is stored in a PostgreSQL database and, for files/media, in Amazon S3, both primarily hosted in AWS's Mumbai (ap-south-1) region. We use tenant isolation so one business can never see another's data, encrypt WhatsApp access tokens and any third-party integration credentials you connect (e.g. your Razorpay Key Secret — Section 2.3) at rest, use TLS encryption in transit, verify inbound WhatsApp webhook signatures, and apply least-privilege access controls internally. No method of storage or transmission is 100% secure, and we cannot guarantee absolute security.

Data breach notification. If we become aware of a personal data breach that is likely to affect Business Owners or End Customers, we will notify the Data Protection Board of India and the affected individuals without undue delay, and in any event within the timeframe required under the DPDP Act, 2023 and its Rules — regardless of whether our internal investigation is complete at that point — and take reasonable steps to contain, assess and remediate the breach.

Because our sub-processors (Google, Meta, AWS) are global companies, some processing occurs outside India as part of their standard infrastructure. In particular, AI-generated replies (Section 5) are processed by AWS Bedrock, which — for the specific model we use — currently only supports worldwide request routing rather than an India- or Asia-only option, so a reply to a customer message may be generated in a data center outside India. This is limited to generating the reply itself: AWS does not retain this content by default or use it to train its models (Section 4).

• Business Owner account data is retained for as long as your account is active, plus a reasonable period after closure to comply with legal, accounting and dispute-resolution obligations.
• Conversation history is shown in your dashboard for a window based on your plan (30/180/365 days, or unlimited on Custom); it is not permanently deleted at that point, only no longer shown in the default list, and reappears if the same customer messages again.
• Order and appointment records are retained as business/financial records for as long as your account is active.
• Account deletion. You can delete your account yourself at any time from your dashboard (Profile → Delete account). When you do, your account is closed immediately and your business, product, knowledge-base, conversation and customer data is scheduled for permanent erasure after a 15-day grace period. During those 15 days the data is retained only so you can change your mind — email us from your registered address and we will restore your account. After the grace period the data is permanently deleted, except the minimum we are legally required to keep (e.g. tax/accounting records) and anonymised or aggregated data that no longer identifies anyone.
• Disconnecting WhatsApp. You can disconnect your WhatsApp number at any time (Connect WhatsApp → Disconnect). This stops Shopranch from receiving or processing any further messages for that number and switches your assistant off; previously stored conversation data follows the retention rules above.
• You may also request earlier deletion of specific data at any time — see Section 8.

Subject to applicable law, you have the right to:

• Access a summary of the personal data we hold about you.
• Correct inaccurate or incomplete personal data.
• Erase personal data we no longer need to retain for the purposes it was collected, or where you withdraw consent.
• Withdraw consent at any time, where processing is based on consent (this won't affect processing carried out before withdrawal, and may mean we can no longer provide parts of the Service).
• Nominate another individual to exercise these rights on your behalf in the event of death or incapacity.
• Grievance redressal — raise a complaint with us (Section 12) and, if unresolved, with the Data Protection Board of India once it is operational.

End Customers who wish to exercise these rights over data collected through a WhatsApp conversation can contact either the Business Owner they messaged directly, or us at the email below — we will route the request appropriately.

The Service is intended for use by businesses and their adult representatives, and is not directed at children. We do not knowingly collect personal data from individuals under 18 for the purpose of creating a Shopranch account. If you believe a child has provided us personal data, contact us and we will take steps to delete it.

If you are a Business Owner using Shopranch, you are the data fiduciary (controller) for the personal data of your own customers who message you. This means you are responsible for:

• Having a lawful basis and, where required, valid opt-in consent before messaging customers on WhatsApp, per WhatsApp's own Business Messaging Policy.
• Responding accurately and lawfully to your own customers' data-rights requests, with Shopranch's support as your processor.
• Not uploading personal data you are not legally permitted to process (e.g. sensitive personal data you have no basis to collect).

Shopranch processes End Customer data strictly on your instructions, as configured through your dashboard.

We may update this Privacy Policy from time to time. If we make material changes, we will notify Business Owners by email or an in-dashboard notice before the changes take effect. The "Last updated" date at the top of this page always reflects the current version.

For any questions, complaints or requests relating to this Privacy Policy or your personal data — including as our designated Grievance Officer contact — please write to:

Shopranch — Privacy / Grievance Officer
Email: support@shopranch.in
Phone: +91 63790 99784
Jurisdiction: India

You can also reach us through our Contact page. We aim to acknowledge privacy requests within 7 days and resolve them within 30 days.