Privacy Policy

• —Legal entity: Techcora Corporation Private Limited
• —CIN: U62011TZ2023PTC030074
• —Registered office: 12/180, Makkamoola, Municipality, MT NGR PO, Gudalur Bazaar, Gudalur, The Nilgiris, Tamil Nadu 643212, India
• —Contact: info@techcoracorp.com

Our obligations depend on whose data is involved, so it is worth separating the two cases up front.

• —As a data fiduciary (controller). For visitors to our websites, people who contact us, and the staff of our client businesses who use our software, we decide why and how the data is processed. This policy governs that processing.
• —As a data processor. When we run advertising or messaging for a client — for example, sending invoices over WhatsApp on a client's behalf, or managing a client's ad campaigns — the client's own customers' data belongs to the client. We process it only on that client's documented instructions. The client's privacy policy governs how that data may be used; ours governs how we safeguard it.

From website visitors

• —Technical data: IP address, browser and device type, operating system, referring page, and pages viewed.
• —Usage data: interactions with the site, collected in aggregate to understand what is useful.
• —Anything you volunteer through a contact form or by emailing or messaging us — typically your name, email address, phone number and the content of your enquiry.

From clients and their personnel

• —Account and identity data: name, work email, phone number, role, and login credentials.
• —Business data: company name, registered details, tax identifiers, billing address and payment records.
• —Platform credentials and access tokens issued by third-party platforms (such as Meta) that authorise us to act on the client's behalf. These are stored encrypted and are never shared between clients.
• —Support correspondence and records of configuration changes made in our software.

Processed on behalf of clients

When a client engages us for advertising or messaging services, we handle data belonging to that client's business and its customers. Depending on the service, this can include:

• —Advertising and campaign data: ad account identifiers, campaign structure, budgets, spend, creative assets, and aggregated performance and audience insights returned by the platform.
• —Messaging data: end-customer phone numbers, message content and attachments, message templates, delivery and read receipts, and opt-in and opt-out records.
• —Social content data: posts, captions, media, comments and direct messages on accounts the client has authorised us to manage.
• —Commercial records supplied by the client for a specific purpose — for instance invoice details, where we are engaged to deliver invoices to that client's customers.

• —To provide, operate, maintain and improve our products and services.
• —To perform the services a client has contracted us for, strictly within the scope of that engagement.
• —To authenticate users and keep accounts and platform connections secure.
• —To communicate about your account, service changes, security notices and support requests.
• —To bill for our services and keep the accounting records the law requires.
• —To detect, investigate and prevent fraud, abuse, and breaches of our terms or of platform policies.
• —To comply with legal obligations and to establish, exercise or defend legal claims.

We do not use personal data to train machine learning models that serve anyone other than the client the data came from, and we do not use client or end-customer data to train general-purpose models.

Techcora is registered with Meta as a technology provider. With a client's explicit authorisation, we access their Meta business assets — such as Facebook Pages, Instagram professional accounts, ad accounts and WhatsApp Business Accounts — through Meta's official APIs.

• —Access is granted by the client through Meta's own authorisation flow. The client can review or revoke it at any time in their Meta Business Suite settings, without our involvement.
• —We request only the permissions the contracted service requires, and we use data obtained through Meta's APIs solely to deliver that service to the client it belongs to.
• —We do not transfer data obtained through Meta's APIs to any data broker, advertising network, or other party that would use it for its own purposes.
• —Our use of information received from Meta APIs adheres to the Meta Platform Terms and Developer Policies, including their restrictions on the use, storage and transfer of platform data.
• —If a client ends their engagement or revokes our access, we stop processing their platform data and delete or return it as described in Section 9.

Where we build or operate WhatsApp messaging for a client, messages are sent from the client's own WhatsApp Business Account and display the client's business name — not ours. We act purely as the technology provider behind that connection.

• —The client is responsible for obtaining and recording valid opt-in from every recipient before any message is sent, as WhatsApp Business Messaging Policy requires.
• —We process recipient phone numbers, message content, and delivery and read status only to transmit messages the client has instructed us to send, and to report back on delivery.
• —Message content is transmitted through Meta's WhatsApp Business Platform and is subject to Meta's own handling of that data.
• —We retain message logs only as long as the client needs them for delivery confirmation and support, or as the client's instructions and applicable law require.
• —Recipients can opt out at any time by replying to stop messages, or by contacting the business that messaged them. Opt-outs are honoured and recorded.

Depending on the data and the jurisdiction, we rely on one or more of the following:

• —Performance of a contract — to deliver the services a client has engaged us for.
• —Consent — for marketing communications, and wherever consent is the applicable basis under the Digital Personal Data Protection Act, 2023 or other applicable law.
• —Legitimate interests — to secure our systems, prevent abuse, and improve our products, where those interests are not overridden by your rights.
• —Legal obligation — to meet statutory, tax, accounting and regulatory requirements.

We share personal data only in these circumstances:

• —Platform providers. Meta Platforms, Inc. and its affiliates, where the service runs on Meta infrastructure (advertising delivery, WhatsApp message transmission, Instagram publishing).
• —Infrastructure and service providers. Cloud hosting, database, object storage, error monitoring and communication providers who process data on our behalf under contract. They may act only on our instructions.
• —The client the data belongs to. Where we process data on a client's behalf, that client has access to it.
• —Professional advisers. Auditors, accountants and lawyers, bound by confidentiality.
• —Legal and safety. Where disclosure is required by law, court order or a valid governmental request, or is necessary to protect our rights, our users, or the public.
• —Business transfer. In connection with a merger, acquisition or sale of assets, subject to this policy continuing to apply.

We keep personal data only as long as it is needed for the purpose it was collected for, or as long as the law requires.

• —Website and enquiry data: up to 24 months from your last interaction with us.
• —Client account and configuration data: for the duration of the engagement, then up to 12 months to allow for reinstatement and dispute resolution.
• —Data processed on behalf of a client: for the duration of the engagement, or for the period the client instructs. On termination we delete or return it within 90 days, unless we are legally required to keep it.
• —Billing, tax and statutory records: for the period required under Indian law, which is generally eight years.

We apply technical and organisational measures appropriate to the risk, including encryption of data in transit and at rest, encrypted storage of platform access tokens, role-based access control with least-privilege defaults, multi-factor authentication on administrative accounts, network isolation between client workloads, and logging of access to sensitive systems.

No system is perfectly secure. If a personal data breach occurs that is likely to cause harm, we will notify affected parties and the relevant authorities as required by applicable law.

We are based in India. Some of our providers — including Meta — operate infrastructure outside India, so your data may be transferred to and processed in other countries. Where we make such transfers we use providers that offer appropriate safeguards, and we transfer only what is necessary to deliver the service.

Subject to applicable law, including the Digital Personal Data Protection Act, 2023 in India and the GDPR where it applies, you may:

• —Ask what personal data we hold about you and obtain a copy.
• —Ask us to correct data that is inaccurate, incomplete or out of date.
• —Ask us to erase your personal data — see the Data Deletion page.
• —Withdraw consent where our processing relies on it, without affecting processing already carried out.
• —Object to, or ask us to restrict, certain processing.
• —Ask us to transfer your data to another provider in a machine-readable format.
• —Nominate another person to exercise these rights on your behalf in the event of your death or incapacity.
• —Complain to the relevant data protection authority.

To exercise any of these, write to info@techcoracorp.com. We respond within 30 days. If your request concerns data we process on behalf of a client, we will forward it to that client and support them in responding, since the decision is theirs to make.

Full instructions, including how to disconnect our app from your Meta account, are on our Data Deletion page.

Our website uses cookies and similar technologies that are necessary for the site to function and to understand aggregate usage. You can block or delete cookies through your browser settings; some parts of the site may not work correctly if you do.

Our services are built for businesses and are not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, contact us and we will delete it.

We may update this policy as our services or the law change. We will revise the effective date at the top of this page, and where the change is significant we will give notice through our services or by email before it takes effect.

For any question about this policy, or to raise a grievance about how we have handled your personal data, contact:

• —Grievance Officer, Techcora Corporation Private Limited
• —info@techcoracorp.com
• —12/180, Makkamoola, Municipality, MT NGR PO, Gudalur Bazaar, Gudalur, The Nilgiris, Tamil Nadu 643212, India

We acknowledge grievances within 7 days and aim to resolve them within 30 days. If you are not satisfied with our response, you may escalate to the Data Protection Board of India.