Privacy Policy
Last updated: 27 October 2026
RapiTalk is operated by Sabyasachi Panigrahi, proprietor of RAPITALK (a sole proprietorship; Udyam Registration No. UDYAM-CG-12-0030928), 132, Jagat Vihar Colony, Ward No. 27, Mahasamund, Chhattisgarh 493445, India.
This policy explains what personal data RapiTalk ("we", "us") processes, why, for how long, who we share it with, and the rights you have. We wrote it in plain language. If anything is unclear, write to our Grievance Officer at support@rapitalk.com.
1. Two different roles
RapiTalk is software that businesses and creators (our "customers") use to talk to their own customers on Instagram, Facebook Messenger, WhatsApp, Telegram, email and SMS. Depending on whose data it is, our role differs:
- We decide (Data Fiduciary / controller) for the data of our customers and their team members (accounts, billing, security), visitors to rapitalk.com and app.rapitalk.com, and people who contact us.
- We act on a customer's instructions (Data Processor) for the people our customers talk to through RapiTalk (their "contacts"). For that data the customer is the Data Fiduciary (controller): the customer decides why and how it is used, must have a lawful basis or consent, and answers requests from its contacts. Our Data Processing Agreement sets out what we do for customers.
If you messaged a business that uses RapiTalk, please contact that business first. You can also write to us and we will pass your request on and help (section 9).
2. What data we process and why
| Data | Purpose | Legal basis |
|---|---|---|
| Account data: name, email, password (stored only as a one-way hash), sign-in provider identifiers (Google, Facebook, your company's single sign-on), two-step sign-in settings | Create and secure your account, sign you in | Your consent and our contract with you (DPDP s.6, s.7(a); GDPR art. 6(1)(a), (b)) |
| Workspace and team data: organization and workspace names, roles, invitations, settings | Provide the service you signed up for | Contract; your consent |
| Connected channel data: account identifiers and access tokens (stored encrypted); messages, comments, story mentions, files and profile details (name, username, picture) of people who interact with a connected account | Receive and send messages, run the customer's automations, show the inbox. We process this as the customer's processor. | The customer's instructions (DPA); the customer's own basis toward its contacts |
| Contact data customers add or import: tags, custom fields, notes, consent status and its history | Same as above, as processor | The customer's instructions |
| Billing data: billing name, email, phone, state, GSTIN, plan, invoices, payment status. Card, UPI and bank details are entered on Cashfree Payments' pages and never reach us. | Charge for plans and packs, issue invoices, meet tax law | Contract; legal obligation (GST, Income-tax) |
| Security and technical data: IP address, browser and device type, sign-in times, sessions, audit logs, access logs, error reports | Keep the service secure, detect and investigate abuse and breaches, fix problems, meet CERT-In and DPDP log rules | Legitimate uses and legal obligation (DPDP s.7; Rules r.6; CERT-In Directions 2022; GDPR art. 6(1)(c), (f)) |
| AI requests (only when a workspace uses AI steps): the text sent to the AI provider and its answer | Generate replies, classify and extract details as the customer configured | The customer's instructions |
| Cookie choice and a random browser id | Remember and prove your cookie choice | Legal obligation; consent |
| Support, privacy and sales messages you send us | Answer you and keep a record | Your consent; legal obligation for privacy requests |
| Referral and affiliate data (only with cookie consent or a code you type) | Credit the person who referred you, pay partner commissions | Consent; contract with partners |
We do not sell personal data, do not use messages for advertising, and do not build advertising profiles. Data received from Meta platforms is used only to provide the messaging features the connected account owner turned on, in line with Meta's Platform Terms.
You do not have to give us your data, but without account data we cannot provide the service. Optional cookies are off unless you allow them.
3. Automated replies and AI
Customers build automations that reply to their contacts automatically. Some steps can use AI (Google Gemini by default, or a provider the customer chooses). By default, the first AI-written message in a conversation tells the person that an AI wrote it (EU AI Act art. 50). AI answers can be wrong; they never make decisions with legal or similarly significant effects about anyone, and a person in the business can take over any conversation. AI providers receive only the text needed for the step and process it under their API terms to return a result.
4. Who receives data
Only the service providers we need, each under a contract and only for its part of the service. The full, current list is on the Sub-processors page: hosting, email delivery, payments, bot protection, AI providers, and the messaging platforms a customer chooses to connect. We may also disclose data when Indian law requires it (for example a lawful request from a court, CERT-In or another authority), to protect people from harm, or in a merger or sale of the business (you will be told before your data comes under a different privacy policy).
5. Transfers outside India
RapiTalk's servers, database and backups are in India (Mumbai, hosted by Bluehost). Some providers process data in other countries: email delivery (Hostinger), bot protection (Cloudflare), the default AI provider (Google) and the messaging platforms a customer connects (for example Meta and Telegram). The DPDP Act allows transfers except to countries the Government of India restricts; we will stop transfers to any such country. For people in the EU or UK, transfers rely on the European Commission's Standard Contractual Clauses (and the UK addendum) or the provider's certification under the EU-US Data Privacy Framework, together with the security measures in section 7.
6. How long we keep data
| Data | Kept for |
|---|---|
| Contacts, conversations, messages, automations | While the workspace exists (the customer can delete them at any time) |
| A deleted contact, workspace, organization or account | 30 days so it can be restored, then erased permanently (a contact can be erased at once) |
| Raw notifications received from messaging platforms | 30 days |
| Automation step logs | 90 days |
| AI request text | 30 days |
| Analytics events | 13 months |
| Security, access and audit logs | At least 1 year (DPDP Rules r.6 and r.8; CERT-In requires 180 days); audit logs 2 years |
| Signed-out sessions and used sign-in links | 30 days after they end |
| Accounts that never confirmed their email | Deleted after 7 days |
| Privacy requests and cookie choices (proof of what was asked and chosen) | 3 years |
| Invoices and payment records | 8 years (tax law) |
When we erase data because its purpose is over, we tell you at least 48 hours before, where the law requires it (DPDP Rules r.8).
7. Security
Data is encrypted in transit (HTTPS/TLS). Passwords are hashed; channel tokens, payment-gateway keys, AI keys and other secrets are encrypted at rest (AES-256-GCM). Access is limited by roles; our staff use multi-factor authentication and every privileged action is logged. We keep access and security logs for at least one year, take nightly encrypted backups (kept 14 days), monitor for abuse and errors, and follow a written incident response plan. No system is perfectly secure; if a personal data breach happens we inform the Data Protection Board of India and the affected people as the DPDP Rules require (and CERT-In within 6 hours where its directions apply), describing what happened, the likely consequences, what we did and what you can do.
8. Children
RapiTalk is for adults. You must be 18 or older to create an account, and we ask you to confirm it. We do not knowingly process personal data of children as account holders, and we do not track or target advertising at children. If you believe a child has an account, write to us and we will delete it. Customers must not use RapiTalk to message children without verifiable consent of a parent or guardian where the law requires it.
9. Your rights and how to use them
Under the DPDP Act (and, if they apply to you, the EU/UK GDPR and US state privacy laws) you can:
- Get a summary or a copy of the personal data we process about you and who we shared it with.
- Correct, complete or update it.
- Erase it, unless we must keep it by law (for example invoices).
- Withdraw consent at any time, as easily as you gave it (for example Cookie settings in every footer; deleting your account). Withdrawal does not affect what was lawfully done before.
- Nominate a person to use your rights if you die or cannot (Account > Nominee, or by request).
- Raise a grievance with us and, if not satisfied, complain to the Data Protection Board of India. People in the EU or UK can also complain to their data protection authority, and can object to processing based on legitimate interests and ask for data portability.
Most of this you can do yourself in the app: export a workspace or one contact, delete a contact, workspace, organization or your account, change your profile and sign-in methods. Otherwise use the privacy request form or email support@rapitalk.com. We confirm your email address first, may ask you to prove your identity, and reply within 15 days (the law allows up to 90 days in India and one month in the EU/UK). Using these rights is free. We never discriminate against you for using them.
Your duties under the DPDP Act (s.15): give true information, do not impersonate anyone, and do not file false or frivolous complaints.
10. Cookies
We use only essential cookies by default and ask before anything else. Details are in the Cookie Policy; you can change your choice at any time with Cookie settings.
11. Grievance Officer and contact
Sabyasachi Panigrahi, Proprietor, Grievance Officer and data protection contact
RAPITALK, 132, Jagat Vihar Colony, Ward No. 27, Mahasamund, Chhattisgarh 493445, India
Email: support@rapitalk.com · Monday to Saturday, 10:00 to 18:00 IST
We acknowledge grievances within 24 hours and resolve them within 15 days (see Grievance Redressal).
12. Changes to this policy
When we change this policy materially, we tell you in advance by email or in the app and ask signed-in users to accept the new version. The date at the top shows the current version.