Privacy policy

1. Two kinds of data, two roles

Account data is about you, the person or business that signs up: name, email, business name, password (stored only as a hash), plan and payment history. For this we are the data fiduciary (controller).

Customer data is what you put into baseNode about your own customers: phone numbers, names, messages, tags, orders and appointments. For this you decide the purpose and we act as your data processor. You are responsible for having a lawful basis, including consent for marketing messages.

2. What we collect

Account and billing details; technical data such as IP address, device and browser for security and rate-limiting; messages and files that pass through your connected WhatsApp number; and records you create in the app (contacts, templates, campaigns, deals, appointments, forms).

We do not receive or store card or UPI details. Payments are handled by Razorpay, who send us only the order status, amount and a reference.

3. How we use it

To provide the service: deliver and receive WhatsApp messages through Meta's WhatsApp Business Platform, run campaigns and automations, show reports and send you the email summaries you turn on.

To keep it safe: authentication, two-step login, audit logs, abuse and fraud prevention. To meet legal duties such as tax records. We do not sell personal data and we do not use your customers' messages to train AI models.

4. Who we share it with

Meta (WhatsApp) to send and receive messages; Razorpay for payments; our hosting and database providers (Vercel, Railway and Neon, or equivalents) to run the service; an email provider if you enable summaries; and an AI provider only if you switch on AI features with your own key, in which case the text you choose to process goes to that provider.

We may disclose data when required by law or to protect rights and safety. These providers act under contracts that limit their use of the data.

5. Retention

Account data is kept while your account is active and for the period the law requires after closure. Customer data is kept until you delete it. You can set an automatic message-retention period in Security, and message content older than that is deleted daily. Backups are overwritten on the provider's normal cycle.

6. Security

Secrets such as WhatsApp tokens and 2FA seeds are encrypted at rest; traffic is encrypted in transit; access is separated per workspace; sensitive actions are logged. See our Security and trust page for details. No system is perfectly secure, and we will notify affected customers and the authorities of a breach as the law requires.

7. Your rights under the DPDP Act, 2023

You can ask to access, correct or erase your personal data, withdraw consent, and raise a grievance. If you are an end customer of a business that uses baseNode, please contact that business first; they control that data. Businesses can export or erase any contact from the app and export their whole workspace.

To exercise your rights regarding account data, use the contact details below. We respond within the period the law allows.

8. Children

baseNode is for businesses. It is not directed at children, and you must not use it to knowingly collect data from children without verifiable parental consent.

9. Cookies and similar technology

We use browser storage to keep you signed in and remember preferences such as light or dark mode, and a service worker for notifications and offline messages. We do not use advertising trackers.

10. Changes and contact

We will post changes here and update the date; for material changes we will notify account owners. Questions or grievances: contact us using the details below, or use the contact form.