PRIVACY POLICY
Governing the collection, processing, storage, security, and deletion of personal data
Effective Date: May 1, 2026
www.chatvault.in | legal@chatvault.in | +91-9009580245
DPDP Act 2023 | IT Act 2000 | IT Rules 2011 | Consumer Protection Act 2019
PLAIN LANGUAGE SUMMARY (legally binding):
- We do NOT read your WhatsApp messages - ever.
- Your media files go directly from your computer to your Google Drive.
- Our servers never receive or store any media file content at any point.
- We collect only the minimum data needed to run the service.
- We do NOT sell your personal data to anyone.
- You can disconnect any WhatsApp number, revoke Drive access, or delete your account at any time.
- If there is ever a data breach, we will notify you as required by law.
1. STATUTORY NOTICE
THIS DOCUMENT IS YOUR FORMAL NOTICE UNDER SECTION 5 OF THE DIGITAL PERSONAL DATA PROTECTION ACT, 2023 AND RULE 4 OF THE IT (REASONABLE SECURITY PRACTICES) RULES, 2011. BY CREATING AN ACCOUNT, CONNECTING A WHATSAPP NUMBER, INSTALLING THE DESKTOP APPLICATION, OR USING ANY FEATURE OF THE CHATVAULT PLATFORM, YOU PROVIDE YOUR FREE, SPECIFIC, INFORMED, UNCONDITIONAL, AND UNAMBIGUOUS CONSENT TO THE PROCESSING OF YOUR PERSONAL DATA AS DESCRIBED IN THIS POLICY.
2. COMPANY IDENTITY AND GRIEVANCE OFFICER
Published on the website footer, Privacy Policy page, and Platform dashboard as required by Indian law:
| Detail | Information |
|---|---|
| Business Name | ChatVault |
| Website | www.chatvault.in |
| City | Jabalpur, Madhya Pradesh, India |
| Phone | +91-9009580245 |
| Support Email | support@chatvault.in |
| Legal Email | legal@chatvault.in |
| Grievance Officer Email | grievance@chatvault.in |
| Effective Date | May 1, 2026 |
Grievance Officer - Mandatory Published Contact (IT Rules 2011, Rule 5(9) & DPDP Act 2023)
Name / Role: Grievance Officer - ChatVault
Email: grievance@chatvault.in | Phone: +91-9009580245
Address: Jabalpur, Madhya Pradesh, India
Working Hours: Monday – Friday, 10:00 AM – 6:00 PM IST
Acknowledgement: Within 3 working days
Resolution: Within 30 days
Escalation: Data Protection Board of India → Consumer Disputes Redressal Commission → Adjudicating Officer (IT Act 2000, Section 46)
3. DEFINITIONS
| Term | Meaning |
|---|---|
| "AccountDeletionRequest" | Formal request via Dashboard > Settings > Delete Account triggering the Company's data deletion protocol. |
| "Communication Metadata" | Data captured per WhatsApp media message event: sender phone number, sender display name, WhatsApp Message ID, message timestamp, and file size. Does NOT include message text content or media file content. |
| "Connection" | A single WhatsApp number authenticated to the Platform by a User. |
| "Consent Record" | Immutable timestamped log of each consent action - stored 5 years. |
| "Data Fiduciary" | ChatVault - the entity determining the purpose and means of processing your Personal Data (DPDP Act 2023, Section 2(i)). |
| "Data Principal" | You - the individual whose Personal Data is processed. |
| "Drive File ID" | The unique reference identifier assigned by Google Drive to a file after it has been uploaded. This is the only file-related information stored on ChatVault servers - not the file itself. |
| "Drive Folder Structure" | Directory created in your Google Drive: ChatVault / [Connection Name] / [WhatsApp Group Name] /. |
| "Google ID" | Unique identifier from Google LLC for Users who log in via Google OAuth. |
| "your file storage in your computer" | A temporary directory on the User's own computer (ChatVault/spool/[connection_id]/) where the Desktop Application briefly stores a media file after downloading it from WhatsApp, before uploading it to Google Drive. This directory is on the User's machine - not on ChatVault's servers. |
| "Media Metadata" | Descriptive data about a media file stored in ChatVault's database: original filename, Google Drive File ID, media type (image/video/document/audio), upload timestamp, and file size. Does NOT include actual file content. |
| "Platform" | www.chatvault.in, Desktop Application, backend API, and Operational Dashboard. |
4. HOW CHATVAULT WORKS - ACCURATE TECHNICAL DESCRIPTION
This section describes exactly how media files are handled. Understanding this is important because it directly affects what data ChatVault collects and where it is stored.
4.1 What ChatVault Does NOT Do
ChatVault NEVER: (1) receives or stores media file content on its servers - files go directly from your computer to your Google Drive; (2) reads your WhatsApp messages or conversation text; (3) reads, modifies, or deletes any existing files in your Google Drive; (4) accesses your Google Drive except to create folders and issue upload tokens; (5) sends WhatsApp messages of any kind - the application only processes media files from the specific groups you have explicitly chosen to monitor; (6) accesses your WhatsApp contact list.
5. WHAT DATA WE COLLECT
5.1 Account and Identity Data
| Data Item | Purpose | Legal Basis | Retention |
|---|---|---|---|
| Full name | Account display and identification | Consent | While active; deleted within 90 days of AccountDeletionRequest |
| Business name | Account identification; invoicing | Consent | Same |
| Email address | Authentication, notifications, invoices | Consent + Contract | Same |
| WhatsApp number (at registration) | Account ID and Connection ownership verification | Consent | Same |
| Google ID (if using Google login) | Links Google account to ChatVault | Consent | Same; revocable by revoking Google OAuth |
| Hashed password (bcrypt) | Authentication - actual password never stored | Contract | Same |
| Email / WhatsApp verification status | Account security | Legitimate interest | Same |
5.2 Technical and Device Data
| Data Item | Purpose | Legal Basis | Retention |
|---|---|---|---|
| Generic device identifiers | Binds Desktop App to your authorised computer for security | Legitimate interest | While account active |
| IP address | Security and fraud prevention | Legitimate interest | 2 years |
| Browser type, OS, device type | Compatibility and security | Legitimate interest | 2 years |
| Application version (Desktop App) | Security updates and compatibility | Legitimate interest | While account active |
| Agent Token (JWT, 24-hour expiry) | Desktop App authentication session | Contract | 24 hours (auto-expires) |
| User JWT (7-day expiry) | Website login session | Contract | 7 days (auto-expires) |
5.3 WhatsApp Connection and Group Data
| Data Item | Purpose | Legal Basis | Retention |
|---|---|---|---|
| Connection nickname (you assign this) | Connection identification in dashboard | Consent per Connection | While active; 90 days postAccountDeletionRequest |
| Connected phone number | Technical ID of the WhatsApp account | Consent | Same |
| Connection status | Service delivery and dashboard display | Consent | Same |
| WhatsApp Group IDs (selected groups only) | Technical ID of monitored groups | Consent | Same |
| WhatsApp Group Names (selected groups only) | Dashboard display; Drive Folder Structure naming | Consent | Same |
| Group monitoring status (on/off per group) | Service configuration | Consent | Same |
WE DO NOT READ YOUR MESSAGES. ChatVault never intercepts, accesses, reads, stores, or transmits the content of any WhatsApp message or conversation. We only capture file-level metadata about media files in groups you specifically select for monitoring.
5.4 Communication Metadata (captured per media message event)
IMPORTANT - THIRD PARTY DATA: This metadata includes the phone number and display name of the WhatsApp group member who sent the media file. This person is a third party. You, as ChatVault User and Data Fiduciary under DPDP Act 2023, are responsible for ensuring they have been informed and consented to this capture.
| Data Item | Purpose | Legal Basis | Retention |
|---|---|---|---|
| Sender phone number | We collect standard messaging metadata necessary to maintain and display your transaction history on your user dashboard. | Consent per Connection | While active; 90 days postAccountDeletionRequest |
| Sender display name | We collect standard messaging metadata necessary to maintain and display your transaction history on your user dashboard. | Consent | Same |
| WhatsApp Message ID | We collect standard messaging metadata necessary to maintain and display your transaction history on your user dashboard. | Consent | Same |
| Message timestamp | We collect standard messaging metadata necessary to maintain and display your transaction history on your user dashboard. | Consent | Same |
| File size (bytes) | Storage quota tracking | Consent | Same |
5.5 Media Metadata (stored permanently in ChatVault database)
This is what ChatVault stores after a successful upload. It is reference data only - not the file content.
| Data Item | Purpose | Legal Basis | Retention |
|---|---|---|---|
| Original filename | Upload log display and file identification | Consent | While active; 90 days postAccountDeletionRequest |
| Google Drive File ID | Reference to the file in your Google Drive for your dashboard history | Consent | Same |
| Media type (image/video/document/audio) | Dashboard filtering and display | Consent | Same |
| Upload timestamp | Audit trail | Consent | Same |
| File size | Storage consumption tracking | Consent | Same |
5.6 Cloud Storage Integration Data
| Data Item | Purpose | Legal Basis | Retention |
|---|---|---|---|
| Cloud account email (Google Drive etc.) | Drive identification | Consent per Drive connection | Until access revoked |
| OAuth2 refresh token (AES-256 encrypted) | Used to generate short-lived access tokens for Drive uploads on your behalf | Consent | Until revoked; deleted within 24 hours of revocation |
| Drive-to-Connection folder mappings | Upload routing | Consent | Until revoked or AccountDeletionRequest |
5.7 Billing and Usage Data
| Data Item | Purpose | Legal Basis | Retention |
|---|---|---|---|
| Subscription plan and status | Access control | Contract | 7 years (GST / Companies Act 2013) |
| Ledger entries (billing history, credits) | Billing accuracy and disputes | Contract + Legal | 7 years |
| API request counts | Usage quota enforcement | Contract | 2 years |
| Media storage consumption metrics | Quota tracking | Contract | 2 years |
| Manual Payment Reference (UPI ID) | Payment processing linkage | Contract | 7 years |
| Invoice IDs and payment amounts | GST compliance | Legal obligation | 7 years |
5.8 Support and Custom Plan Requests
| Data Item | Purpose | Retention |
|---|---|---|
| Support ticket content and messages | Grievance resolution | 2 years |
| Custom plan request details | Commercial negotiations | 2 years |
5.9 Audit Logs and Consent Records
| Data Item | Purpose | Retention |
|---|---|---|
| Consent Records (type, timestamp, IP, notice text) | DPDP Act 2023 compliance | 5 years |
| Login events (timestamp, IP, success/failure) | Security | 2 years |
| Connection and upload events | Audit trail | 2 years |
| AccountDeletionRequest records | Proof of compliance | 5 years post-deletion |
6. WHAT WE DO NOT COLLECT
ChatVault does NOT collect: (1) Media file content - files go from your computer directly to your Google Drive; our servers never receive any file content at any point. (2) WhatsApp message text content - processed in-memory on your machine only to detect media; never sent to our servers. (3) WhatsApp contact lists or address books. (4) Phone numbers of group members other than the specific sender at the time of a media message. (5) Group member rosters. (6) Payment card details - ChatVault uses manual payments (UPI/cash) and never asks for or stores card data. (7) Government IDs (Aadhaar, PAN, passport). (8) Biometric data. (9) Health or medical information. (10) Location data beyond city-level IP geolocation for security purposes.
7. WHERE DATA IS STORED
| Storage Location | What is Stored | Security |
|---|---|---|
| ChatVault Backend Database | Account data, Connection metadata, Communication Metadata, Media Metadata (Drive File ID + descriptors), billing records, audit logs, Consent Records - NO media file content | Standard encrypted protocols |
| User's Own Computer (your file storage in your computer) | Media file temporarily during download from WhatsApp - deleted after upload to Drive is confirmed | On user's machine; not ChatVault's infrastructure |
| User's Google Drive | Actual media files (photos, videos, documents, audio) | Google's own security; governed by Google's terms |
| OAuth Token Storage (within DB) | OAuth2 refresh tokens | Standard encrypted protocols |
| Database Backups | Full database backup - NO media file content | Same encryption as primary; retained 30 days then purged |
Our cloud infrastructure may be located outside India. By accepting this Policy, you consent to international processing of your Personal Data. We maintain contractual safeguards with infrastructure providers consistent with Indian law.
8. SECURITY SAFEGUARDS (DPDP ACT 2023, SECTION 8(4))
We utilize secure, industry-leading cloud infrastructure and standard encrypted protocols to protect user data.
| Security Measure | What It Does | Standard |
|---|---|---|
| Standard Encrypted Protocols | Encrypts all communications and stored data | Industry standard |
| Industry-standard password hashing | Your actual password is never stored - irreversible hash only | Industry standard |
| Zero-trust architecture | Every request independently validated - no implicit trust between components | Industry standard |
| Machine binding | Desktop App bound to your registered computer - unregistered machines rejected | Proprietary implementation |
| Multi-tenant isolation | All DB queries filter by User ID - crossaccount access architecturally impossible | Data access layer enforcement |
| Role-based access control | Owner / Admin / Member / Viewer - least-privilege permissions | Industry standard |
| API rate limiting | Prevents brute-force and denial-of-service attacks | Per-IP and per-User limits |
| Short-lived Drive access tokens | OAuth access tokens generated fresh per upload request - 24-hour maximum validity | OAuth 2.0 standard |
BREACH NOTIFICATION (DPDP ACT 2023, SECTION 8(6)): In the event of a personal data breach likely to cause harm: (1) affected Users will be notified at their registered email without undue delay; (2) the Data Protection Board of India will be notified within the prescribed timeframe; (3) notification will describe the breach, data affected, and steps taken.
9. DATA SHARING
ChatVault does NOT sell, rent, trade, or commercially exploit your Personal Data.
| Who We Share With | What Data | Why and Basis |
|---|---|---|
| Secure cloud infrastructure | Account data, metadata, audit logs - NO media file content | Hosting our platform - data processing agreement |
| Manual Payment Processing | Billing metadata only - NOT card details | Payment processing - contract |
| Email delivery service | Your email address only | Transactional emails - contract |
| Analytics tool | Anonymised usage data only | Service improvement - consent |
| Google Drive API | Short-lived access tokens to allow Desktop App to upload to your own Drive | Your explicit OAuth authorisation - governed by Google's terms |
| Courts, law enforcement, regulators | As legally required - account data and metadata only, never media file content | Compliance with Indian law or court order |
| Successor entity (in merger/acquisition) | Account data and metadata - you will be notified before transfer | Business transfer - your option to delete account before transfer |
10. DATA RETENTION SCHEDULE
| Data Category | Retention Period | Legal Basis / Reason |
|---|---|---|
| Account identity data | While active + 90 days after AccountDeletionRequest | Business necessity |
| Connection and group metadata | While active + 90 days after AccountDeletionRequest | Business necessity |
| Communication Metadata (sender data) | While active + 90 days after AccountDeletionRequest | Business necessity |
| Media Metadata (Drive File ID + descriptors) | While active + 90 days after AccountDeletionRequest | Business necessity |
| OAuth2 tokens | Until you revoke + 24 hours | Consent |
| Media files on ChatVault servers | NEVER STORED - files go directly from your computer to your Drive | Architecture - not applicable |
| Media files on User's your file storage in your computer | Deleted by Desktop App after confirmed Drive upload | Local device - not ChatVault data |
| Billing and financial records | 7 years | Companies Act 2013 + GST law (mandatory) |
| API request counts + storage metrics | 2 years | Contractual |
| Audit logs | 2 years | Security and compliance |
| Consent Records | 5 years | DPDP Act 2023 |
| AccountDeletionRequest records | 5 years post-deletion | Proof of compliance |
| Anonymised analytics | Indefinite | Not Personal Data - no individual linkage |
| Media files in your Google Drive | Permanent - you control your Drive | Your property |
11. YOUR RIGHTS (DPDP ACT 2023)
| Right | How to Exercise | Timeframe |
|---|---|---|
| Section 11 - Right to Access | Email grievance@chatvault.in - subject: 'Data Access Request' | 30 days |
| Section 12(a) - Right to Correction | Dashboard > Settings > Profile, or email grievance@chatvault.in | 30 days |
| Section 12(b) - Right to Erasure | Dashboard > Delete Account, or email grievance@chatvault.in | 90 days processing |
| Section 13 - Right to Grievance Redressal | Email grievance@chatvault.in | Ack: 3 days; Resolved: 30 days |
| Section 14 - Right to Nominate | Email grievance@chatvault.in with nominee details | On receipt |
| Section 6(4) - Right to Withdraw Consent | See Section 12.3 of Notice & Consent section | 30 days |
12. NOTICE AND CONSENT
12.1 How We Deliver Notice
- Website footer: business name, city, phone, email, all policy links - on every page
- Registration form: mandatory unticked consent checkbox - registration blocked until ticked
- Post-registration email: links to all policies and Grievance Officer contact
- Dashboard 'Help & Legal' menu: all policies and Grievance contact - on every dashboard page
- Connection setup screen: specific notice before each new Connection explaining what data will be captured
- Cloud Drive connection screen: specific notice before OAuth authorisation
- Cookie consent banner: before any non-essential cookies are set on first visit
- Desktop Application first launch: non-skippable privacy and risk notice before login
- Policy-change email: sent at least 15 days before any material change
12.2 Consent Records
For every consent action, we store a Consent Record: User ID, consent type, timestamp (UTC), IP address, Platform version, and the exact text of the notice shown. Retained 5 years.
12.3 How You Withdraw Consent
- Dashboard > Settings > Delete Account (full withdrawal - triggers AccountDeletionRequest)
- Dashboard > Connections > Disconnect (per-Connection withdrawal)
- Dashboard > Connections > Cloud Drive Settings > Revoke Access (per Drive withdrawal)
- Unsubscribe link in any marketing email
- Written request to grievance@chatvault.in
13. CHILDREN'S DATA (DPDP ACT 2023, SECTION 9)
ChatVault is not for children under 18. We do not knowingly collect data from minors without verifiable parental consent. If such data is collected inadvertently, we will delete it within 30 days.
14. ACCOUNT DELETION - AccountDeletionRequest
How to delete: Dashboard > Settings > Account > Delete Account, or email grievance@chatvault.in.
| Action | Timeline | Notes |
|---|---|---|
| All WhatsApp Connections disconnected | Immediately | No further captures |
| All Cloud Drive access revoked and tokens deleted | Within 24 hours | Encrypted tokens purged |
| Account identity data deleted/anonymised | Within 90 days | |
| Communication Metadata deleted | Within 90 days | |
| Media Metadata (Drive File IDs + descriptors) deleted | Within 90 days | Note: deleting the Drive File ID from our DB does not delete the actual file from your Drive - that belongs to you |
| Billing records retained | 7 years | Legal obligation - cannot be deleted |
| Audit logs retained | 2 years | Legal obligation |
| Consent Records retained | 5 years | Legal obligation |
| Your files in your Google Drive | Not affected - permanently in your Drive | You control your Drive; we only ever held a reference, not the file |
15. WHATSAPP - NON-AFFILIATION NOTICE
ChatVault is NOT affiliated with, endorsed by, authorised by, or connected to WhatsApp LLC or Meta Platforms, Inc. The Platform uses an unofficial WhatsApp Web protocol library. Your WhatsApp account may be banned as a result. ChatVault accepts no liability for any WhatsApp enforcement action. Users are solely responsible for WhatsApp Terms of Service compliance.
16. CHANGES TO THIS POLICY
Material changes will be emailed to all registered Users at least 15 days before they take effect. The updated Policy will be posted on the website with the revised Effective Date. Continued use after the effective date constitutes acceptance.
17. CONTACT
Grievance Officer: grievance@chatvault.in | +91-9009580245
Legal Notices: legal@chatvault.in
Support: support@chatvault.in
Address: Jabalpur, Madhya Pradesh, India
ANNEXURE PP-III
DPDP ACT 2023 - COMPLIANCE CHECKLIST
| DPDP Act Requirement | Section | ChatVault Compliance |
|---|---|---|
| Notice before data collection | S5 | Registration checkbox, Connection notice, Drive notice, first-launch modal, cookie banner |
| Free, specific, informed consent | S6 | Separate unticked checkboxes per processing activity |
| Withdrawal of consent with equal ease | S6(4) | Dashboard disconnect, revoke, delete functions |
| Data minimisation | S8(3) | Only metadata collected; file content never reaches servers - see Annexure PP-II |
| Accuracy of data | S8(1) | Users can correct via dashboard |
| Purpose limitation | S8(2) | Data used only for purposes in Section 11 |
| Security safeguards | S8(4) | Section 8 security programme |
| Storage limitation / deletion | S8(5) | Retention schedule in Section 10; AccountDeletionRequest protocol |
| Breach notification | S8(6) | Documented incident response; Board and User notification |
| Grievance mechanism | S8(7) | Grievance Officer in Section 2; 30-day resolution |
| Children's data protection | S9 | Section 13; no minor data without parental consent |
| Right to access | S11 | Section 11 |
| Right to correction and erasure | S12 | Dashboard + AccountDeletionRequest |
| Right to grievance redressal | S13 | Grievance Officer; escalation to Data Protection Board |
| Right to nominate | S14 | Written request to Grievance Officer |