PRIVACY POLICY
Governing the collection, processing, storage, security, and deletion of personal data
Effective Date: May 1, 2026
www.chatvault.in | legal@chatvault.in
DPDP Act 2023 | IT Act 2000 | IT Rules 2011 | Consumer Protection Act 2019
PLAIN LANGUAGE SUMMARY (legally binding):
- We do NOT read your WhatsApp messages - ever.
- Your media files go directly to your Google Drive.
- Our servers never receive or store any media file content at any point.
- We collect only the minimum data needed to run the service.
- We do NOT sell your personal data to anyone.
- You can disconnect any WhatsApp number, revoke Drive access, or delete your account at any time.
- If there is ever a data breach, we will notify you as required by law.
1. STATUTORY NOTICE
THIS DOCUMENT IS YOUR FORMAL NOTICE UNDER SECTION 5 OF THE DIGITAL PERSONAL DATA PROTECTION ACT, 2023 AND RULE 4 OF THE IT (REASONABLE SECURITY PRACTICES) RULES, 2011. BY CREATING AN ACCOUNT, CONNECTING A WHATSAPP NUMBER, ACCESSING THE SERVICE, OR USING ANY FEATURE OF THE CHATVAULT PLATFORM, YOU PROVIDE YOUR FREE, SPECIFIC, INFORMED, UNCONDITIONAL, AND UNAMBIGUOUS CONSENT TO THE PROCESSING OF YOUR PERSONAL DATA AS DESCRIBED IN THIS POLICY.
2. COMPANY IDENTITY AND GRIEVANCE OFFICER
Published on the website footer, Privacy Policy page, and Platform dashboard as required by Indian law:
| Detail | Information |
|---|---|
| Business Name | ChatVault |
| Website | www.chatvault.in |
| City | Jabalpur, Madhya Pradesh, India |
| Support Email | support@chatvault.in |
| Legal Email | legal@chatvault.in |
| Grievance Officer Email | grievance@chatvault.in |
| Effective Date | May 1, 2026 |
Grievance Officer - Mandatory Published Contact (IT Rules 2011, Rule 5(9) & DPDP Act 2023)
Name / Role: Grievance Officer - ChatVault
Email: grievance@chatvault.in
Address: Jabalpur, Madhya Pradesh, India
Working Hours: Monday – Friday, 10:00 AM – 6:00 PM IST
Acknowledgement: Within 3 working days
Resolution: Within 30 days
Escalation: Data Protection Board of India → Consumer Disputes Redressal Commission → Adjudicating Officer (IT Act 2000, Section 46)
3. DEFINITIONS
| Term | Meaning |
|---|---|
| "AccountDeletionRequest" | Formal request via Dashboard > Settings > Delete Account triggering the Company's data deletion protocol. |
| "Communication Metadata" | Data captured per WhatsApp media message event: sender phone number, sender display name, WhatsApp Message ID, message timestamp, and file size. Does NOT include message text content or media file content. |
| "Connection" | A single WhatsApp number authenticated to the Platform by a User. |
| "Consent Record" | Immutable timestamped log of each consent action - stored 5 years. |
| "Data Fiduciary" | ChatVault - the entity determining the purpose and means of processing your Personal Data (DPDP Act 2023, Section 2(i)). |
| "Data Principal" | You - the individual whose Personal Data is processed. |
| "Cloud File Reference" | ChatVault may retain a reference associated with files stored in the User's connected cloud-storage account to support file organization, activity tracking, and related Service functionality. |
| "Cloud Storage Organization" | Files may be organized within the User's connected cloud-storage account according to the User's selected organization preferences. |
| "Google ID" | Unique identifier from Google LLC for Users who log in via Google OAuth. |
| "Temporary Processing" | ChatVault may temporarily process certain information as required to provide the Service. Such temporary processing does not constitute permanent storage of the User's files by ChatVault. |
| "Media Metadata" | Descriptive data about a media file stored in ChatVault's database: original filename, Google Drive File ID, media type (image/video/document/audio), upload timestamp, and file size. Does NOT include actual file content. |
| "Platform" | www.chatvault.in, applications, backend services, and Operational Dashboard. |
4. HOW CHATVAULT WORKS - SERVICE DESCRIPTION
This section describes exactly how media files are handled. Understanding this is important because it directly affects what data ChatVault collects and where it is stored.
4.1 What ChatVault Does NOT Do
ChatVault NEVER: (1) receives or stores media file content on its servers - files go directly to your Google Drive; (2) reads your WhatsApp messages or conversation text; (3) reads, modifies, or deletes any existing files in your Google Drive; (4) accesses your Google Drive except to create folders and issue upload tokens; (5) sends WhatsApp messages of any kind - the application only processes media files from the specific groups you have explicitly chosen to monitor; (6) accesses your WhatsApp contact list.
5. WHAT DATA WE COLLECT
5.1 Account and Identity Data
| Data Item | Purpose | Legal Basis | Retention |
|---|---|---|---|
| Full name | Account display and identification | Consent | While active; deleted within 90 days of AccountDeletionRequest |
| Business name | Account identification; invoicing | Consent | Same |
| Email address | Authentication, notifications, invoices | Consent + Contract | Same |
| WhatsApp number (at registration) | Account ID and Connection ownership verification | Consent | Same |
| Google ID (if using Google login) | Links Google account to ChatVault | Consent | Same; revocable by revoking Google OAuth |
| Hashed password (bcrypt) | Authentication - actual password never stored | Contract | Same |
| Email / WhatsApp verification status | Account security | Legitimate interest | Same |
5.2 Technical and Device Data
| Data Item | Purpose | Legal Basis | Retention |
|---|---|---|---|
| Device and system information | Service security, compatibility, troubleshooting and reliable operation | Legitimate use / applicable legal basis | As required for these purposes |
| IP address and connection information | Security, fraud prevention and service protection | Legitimate use / applicable legal basis | As required for these purposes |
| Application and browser information | Compatibility, service improvements and security | Legitimate use / applicable legal basis | As required for these purposes |
| Session and authentication information | Maintaining secure access to your ChatVault account and connected services | Contract / applicable legal basis | For the period necessary to maintain secure access |
| Application version and related technical information | Updates, compatibility, troubleshooting and service reliability | Legitimate use / applicable legal basis | As required for these purposes |
5.3 WhatsApp Connection and Group Data
| Data Item | Purpose | Legal Basis | Retention |
|---|---|---|---|
| Connection nickname (you assign this) | Connection identification in dashboard | Consent per Connection | While active; 90 days postAccountDeletionRequest |
| Connected phone number | Technical ID of the WhatsApp account | Consent | Same |
| Connection status | Service delivery and dashboard display | Consent | Same |
| WhatsApp Group IDs (selected groups only) | Technical ID of monitored groups | Consent | Same |
| WhatsApp Group Names (selected groups only) | Dashboard display; Drive Folder Structure naming | Consent | Same |
| Group monitoring status (on/off per group) | Service configuration | Consent | Same |
WE DO NOT READ YOUR MESSAGES. ChatVault never intercepts, accesses, reads, stores, or transmits the content of any WhatsApp message or conversation. We only capture file-level metadata about media files in groups you specifically select for monitoring.
5.4 Communication Metadata (captured per media message event)
IMPORTANT - THIRD PARTY DATA: This metadata includes the phone number and display name of the WhatsApp group member who sent the media file. This person is a third party. You, as ChatVault User and Data Fiduciary under DPDP Act 2023, are responsible for ensuring they have been informed and consented to this capture.
| Data Item | Purpose | Legal Basis | Retention |
|---|---|---|---|
| Sender phone number | We collect standard messaging metadata necessary to maintain and display your transaction history on your user dashboard. | Consent per Connection | While active; 90 days postAccountDeletionRequest |
| Sender display name | We collect standard messaging metadata necessary to maintain and display your transaction history on your user dashboard. | Consent | Same |
| WhatsApp Message ID | We collect standard messaging metadata necessary to maintain and display your transaction history on your user dashboard. | Consent | Same |
| Message timestamp | We collect standard messaging metadata necessary to maintain and display your transaction history on your user dashboard. | Consent | Same |
| File size (bytes) | Storage quota tracking | Consent | Same |
5.5 Media Metadata (stored permanently in ChatVault database)
This is what ChatVault stores after a successful upload. It is reference data only - not the file content.
| Data Item | Purpose | Legal Basis | Retention |
|---|---|---|---|
| Original filename | Upload log display and file identification | Consent | While active; 90 days postAccountDeletionRequest |
| Google Drive File ID | Reference to the file in your Google Drive for your dashboard history | Consent | Same |
| Media type (image/video/document/audio) | Dashboard filtering and display | Consent | Same |
| Upload timestamp | Audit trail | Consent | Same |
| File size | Storage consumption tracking | Consent | Same |
5.6 Cloud Storage Integration Data
| Data Item | Purpose | Legal Basis | Retention |
|---|---|---|---|
| Connected cloud account information | To identify and maintain the User's connected cloud-storage account | Consent / applicable legal basis | While the connection remains active or as otherwise required |
| Cloud connection and access information | To securely maintain the connection and provide requested Service functionality | Consent / contract, as applicable | As necessary to maintain the connection or until revoked |
| Connection and folder organization information | To maintain the User's selected organization preferences and provide the requested Service | Consent / contract, as applicable | Until the connection is revoked, the information is no longer required, or as otherwise required by law |
5.7 Billing and Usage Data
| Data Item | Purpose | Legal Basis | Retention |
|---|---|---|---|
| Subscription plan and status | Access control | Contract | 7 years (GST / Companies Act 2013) |
| Ledger entries (billing history, credits) | Billing accuracy and disputes | Contract + Legal | 7 years |
| API request counts | Usage quota enforcement | Contract | 2 years |
| Media storage consumption metrics | Quota tracking | Contract | 2 years |
| Manual Payment Reference (UPI ID) | Payment processing linkage | Contract | 7 years |
| Invoice IDs and payment amounts | GST compliance | Legal obligation | 7 years |
5.8 Support and Custom Plan Requests
| Data Item | Purpose | Retention |
|---|---|---|
| Support ticket content and messages | Grievance resolution | 2 years |
| Custom plan request details | Commercial negotiations | 2 years |
5.9 Audit Logs and Consent Records
| Data Item | Purpose | Retention |
|---|---|---|
| Consent Records (type, timestamp, IP, notice text) | DPDP Act 2023 compliance | 5 years |
| Login events (timestamp, IP, success/failure) | Security | 2 years |
| Connection and upload events | Audit trail | 2 years |
| AccountDeletionRequest records | Proof of compliance | 5 years post-deletion |
6. WHAT WE DO NOT COLLECT
ChatVault does NOT collect: (1) Media file content - files go directly to your Google Drive; our servers never receive any file content at any point. (2) WhatsApp message text content - processed only to detect media; never sent to our servers. (3) WhatsApp contact lists or address books. (4) Phone numbers of group members other than the specific sender at the time of a media message. (5) Group member rosters. (6) Payment card details - ChatVault uses manual payments (UPI/cash) and never asks for or stores card data. (7) Government IDs (Aadhaar, PAN, passport). (8) Biometric data. (9) Health or medical information. (10) Location data beyond city-level IP geolocation for security purposes.
7. WHERE DATA IS STORED
| Storage Environment | What May Be Stored or Processed |
|---|---|
| ChatVault Services | Account information, connection-related information, service-related metadata, billing information, consent records, and other information necessary to provide and maintain the Service. |
| User Device | Certain information or files may be temporarily processed or stored on the User's device as required to provide the Service. |
| User's Connected Cloud Storage | Files that the User chooses to organize or save through the Service may be stored in the User's connected cloud-storage account, subject to the terms and policies of that provider. |
| Service Backups and Security Systems | Certain service information may be retained in backups or security systems for operational, security, legal, or continuity purposes, subject to applicable retention requirements. |
Our cloud infrastructure may be located outside India. By accepting this Policy, you consent to international processing of your Personal Data. We maintain contractual safeguards with infrastructure providers consistent with Indian law.
8. SECURITY SAFEGUARDS
ChatVault maintains appropriate technical and organisational safeguards designed to protect personal data against unauthorised access, loss, misuse, alteration, disclosure, or other forms of unauthorised processing.
| Security Measure | Purpose |
|---|---|
| Data Protection | Appropriate safeguards are used to protect personal data during processing and storage. |
| Access Controls | Access to systems and personal data is restricted to authorised access based on operational requirements. |
| Authentication and Account Security | Measures are used to help protect user accounts and connected services from unauthorised access. |
| Monitoring and Logging | Relevant activity may be monitored and logged for security, operational, troubleshooting, and incident-response purposes. |
| Backup and Continuity Measures | Appropriate measures are maintained to support the availability and continuity of relevant services and data. |
| Security Management | Technical and organisational measures are reviewed and maintained as appropriate to the nature of the Service and the risks involved. |
Personal Data Breach
In the event of a personal data breach, ChatVault will take the actions required under applicable law, including applicable notification and mitigation requirements.
9. DATA SHARING
ChatVault does NOT sell, rent, trade, or commercially exploit your Personal Data.
| Who We Share With | What Data | Why and Basis |
|---|---|---|
| Secure cloud infrastructure | Account data, metadata, audit logs - NO media file content | Hosting our platform - data processing agreement |
| Manual Payment Processing | Billing metadata only - NOT card details | Payment processing - contract |
| Email delivery service | Your email address only | Transactional emails - contract |
| Analytics tool | Anonymised usage data only | Service improvement - consent |
| Google Drive API | Short-lived access tokens to allow the service to upload to your own Drive | Your explicit OAuth authorisation - governed by Google's terms |
| Courts, law enforcement, regulators | As legally required - account data and metadata only, never media file content | Compliance with Indian law or court order |
| Successor entity (in merger/acquisition) | Account data and metadata - you will be notified before transfer | Business transfer - your option to delete account before transfer |
10. DATA RETENTION SCHEDULE
| Data Category | Retention Period | Legal Basis / Reason |
|---|---|---|
| Account identity data | While active + 90 days after AccountDeletionRequest | Business necessity |
| Connection and group metadata | While active + 90 days after AccountDeletionRequest | Business necessity |
| Communication Metadata (sender data) | While active + 90 days after AccountDeletionRequest | Business necessity |
| Media Metadata (Drive File ID + descriptors) | While active + 90 days after AccountDeletionRequest | Business necessity |
| OAuth2 tokens | Until you revoke + 24 hours | Consent |
| Media files on ChatVault servers | NEVER STORED - files go directly to your Drive | Architecture - not applicable |
| Billing and financial records | 7 years | Companies Act 2013 + GST law (mandatory) |
| API request counts + storage metrics | 2 years | Contractual |
| Audit logs | 2 years | Security and compliance |
| Consent Records | 5 years | DPDP Act 2023 |
| AccountDeletionRequest records | 5 years post-deletion | Proof of compliance |
| Anonymised analytics | Indefinite | Not Personal Data - no individual linkage |
| Media files in your Google Drive | Permanent - you control your Drive | Your property |
11. YOUR RIGHTS (DPDP ACT 2023)
| Right | How to Exercise | Timeframe |
|---|---|---|
| Section 11 - Right to Access | Email grievance@chatvault.in - subject: 'Data Access Request' | 30 days |
| Section 12(a) - Right to Correction | Dashboard > Settings > Profile, or email grievance@chatvault.in | 30 days |
| Section 12(b) - Right to Erasure | Dashboard > Delete Account, or email grievance@chatvault.in | 90 days processing |
| Section 13 - Right to Grievance Redressal | Email grievance@chatvault.in | Ack: 3 days; Resolved: 30 days |
| Section 14 - Right to Nominate | Email grievance@chatvault.in with nominee details | On receipt |
| Section 6(4) - Right to Withdraw Consent | See Section 12.3 of Notice & Consent section | 30 days |
12. NOTICE AND CONSENT
12.1 How We Deliver Notice
- Website footer: business name, city, phone, email, all policy links - on every page
- Registration form: mandatory unticked consent checkbox - registration blocked until ticked
- Post-registration email: links to all policies and Grievance Officer contact
- Dashboard 'Help & Legal' menu: all policies and Grievance contact - on every dashboard page
- Connection setup screen: specific notice before each new Connection explaining what data will be captured
- Cloud Drive connection screen: specific notice before OAuth authorisation
- Cookie consent banner: before any non-essential cookies are set on first visit
- Desktop Application first launch: non-skippable privacy and risk notice before login
- Policy-change email: sent at least 15 days before any material change
12.2 Consent Records
For every consent action, we store a Consent Record: User ID, consent type, timestamp (UTC), IP address, Platform version, and the exact text of the notice shown. Retained 5 years.
12.3 How You Withdraw Consent
- Dashboard > Settings > Delete Account (full withdrawal - triggers AccountDeletionRequest)
- Dashboard > Connections > Disconnect (per-Connection withdrawal)
- Dashboard > Connections > Cloud Drive Settings > Revoke Access (per Drive withdrawal)
- Unsubscribe link in any marketing email
- Written request to grievance@chatvault.in
13. CHILDREN'S DATA (DPDP ACT 2023, SECTION 9)
ChatVault is not for children under 18. We do not knowingly collect data from minors without verifiable parental consent. If such data is collected inadvertently, we will delete it within 30 days.
14. ACCOUNT DELETION - AccountDeletionRequest
How to delete: Dashboard > Settings > Account > Delete Account, or email grievance@chatvault.in.
| Action | Timeline | Notes |
|---|---|---|
| All WhatsApp Connections disconnected | Immediately | No further captures |
| All Cloud Drive access revoked and tokens deleted | Within 24 hours | Encrypted tokens purged |
| Account identity data deleted/anonymised | Within 90 days | |
| Communication Metadata deleted | Within 90 days | |
| Media Metadata (Drive File IDs + descriptors) deleted | Within 90 days | Note: deleting the Drive File ID from our DB does not delete the actual file from your Drive - that belongs to you |
| Billing records retained | 7 years | Legal obligation - cannot be deleted |
| Audit logs retained | 2 years | Legal obligation |
| Consent Records retained | 5 years | Legal obligation |
| Your files in your Google Drive | Not affected - permanently in your Drive | You control your Drive; we only ever held a reference, not the file |
15. WHATSAPP — NON-AFFILIATION NOTICE
ChatVault is not affiliated with, endorsed by, sponsored by, authorised by, or otherwise connected with WhatsApp LLC or Meta Platforms, Inc.
WhatsApp and related names, trademarks, and services belong to their respective owners. ChatVault is an independent third-party service.
Users are responsible for ensuring that their use of ChatVault and their WhatsApp account complies with the applicable WhatsApp Terms of Service and other applicable policies.
ChatVault does not represent itself as an official WhatsApp product, service, partner, or integration.
16. CHANGES TO THIS POLICY
Material changes will be emailed to all registered Users at least 15 days before they take effect. The updated Policy will be posted on the website with the revised Effective Date. Continued use after the effective date constitutes acceptance.
17. CONTACT
Grievance Officer: grievance@chatvault.in
Legal Notices: legal@chatvault.in
Support: support@chatvault.in
Address: Jabalpur, Madhya Pradesh, India
ANNEXURE PP-III
DPDP ACT 2023 - COMPLIANCE CHECKLIST
| DPDP Act Requirement | Section | ChatVault Compliance |
|---|---|---|
| Notice before data collection | S5 | Registration checkbox, Connection notice, Drive notice, first-launch modal, cookie banner |
| Free, specific, informed consent | S6 | Separate unticked checkboxes per processing activity |
| Withdrawal of consent with equal ease | S6(4) | Dashboard disconnect, revoke, delete functions |
| Data minimisation | S8(3) | Only metadata collected; file content never reaches servers - see Annexure PP-II |
| Accuracy of data | S8(1) | Users can correct via dashboard |
| Purpose limitation | S8(2) | Data used only for purposes in Section 11 |
| Security safeguards | S8(4) | Section 8 security programme |
| Storage limitation / deletion | S8(5) | Retention schedule in Section 10; AccountDeletionRequest protocol |
| Breach notification | S8(6) | Documented incident response; Board and User notification |
| Grievance mechanism | S8(7) | Grievance Officer in Section 2; 30-day resolution |
| Children's data protection | S9 | Section 13; no minor data without parental consent |
| Right to access | S11 | Section 11 |
| Right to correction and erasure | S12 | Dashboard + AccountDeletionRequest |
| Right to grievance redressal | S13 | Grievance Officer; escalation to Data Protection Board |
| Right to nominate | S14 | Written request to Grievance Officer |