Privacy Policy

This Privacy Policy explains how [Legal Entity Name] ("PointEight", "we", "us") collects, uses, shares and protects personal data when you use PointEight — an AI operating layer for goods-moving businesses delivered over WhatsApp, SMS, voice and the web. We comply with India's Digital Personal Data Protection Act, 2023 (DPDP Act) and applicable data-protection laws.

1. Two roles: who controls the data

For the personal data of the business owner and their team who sign up, PointEight acts as the Data Fiduciary. For the personal data of the owner's own customers, drivers and suppliersthat flows through the product (names, phone numbers, GSTINs, transaction details), the business owner is the Data Fiduciary and PointEight acts as a Data Processor, handling that data only on the owner's instructions to provide the service.

2. Data we collect

• Account data: name, business name, email, phone number, password, industry.
• Operational data you enter or dictate: loads, inventory, invoices, payments, customers, suppliers.
• Messages and voice: WhatsApp/SMS text, voice notes and their transcriptions used to run commands.
• Payment data: invoice amounts and payment status. Card/UPI credentials are handled by our payment gateway (Razorpay) and are never stored on our servers.
• Technical data: IP address, device/browser, and usage logs.

3. How we use it

• To provide the service: understand your instructions, create loads/invoices, track stock, send notifications, generate GST documents and collect payments.
• To send transactional messages (status updates, invoices, payment reminders) on your behalf.
• To secure, maintain, debug and improve the product.
• To comply with legal, tax (GST) and regulatory obligations.

We do not sell your personal data.

4. Service providers (sub-processors)

We share data with vetted providers strictly to operate the service:

• Anthropic (Claude) — AI understanding of your commands.
• Groq / OpenAI / Deepgram — voice transcription.
• Meta (WhatsApp Business) and Twilio — messaging delivery.
• Razorpay — payment links and reconciliation.
• GST Suvidha Provider — e-invoice (IRN) and e-way bill generation.
• Cloud hosting and database providers.

Some providers process data outside India (e.g. the United States). Where this happens, we rely on appropriate safeguards and transfer only what is necessary to deliver the service.

5. Data retention

We retain personal and transaction data for as long as your account is active and as required to meet legal, accounting and tax obligations (for example, GST records). On verified deletion request we delete or anonymise data that we are not legally required to keep.

6. Security

We use encryption in transit, encryption of sensitive credentials at rest, access controls, tenant isolation and audit logging. No system is perfectly secure, but we work to protect your data using industry-standard measures.

7. Your rights (DPDP Act)

• Access a summary of the personal data we process about you.
• Correct or update inaccurate data.
• Request erasure, subject to legal retention limits.
• Withdraw consent (this may limit or end the service).
• Nominate another person to exercise your rights, and raise a grievance.

To exercise any right, contact our Grievance Officer (Section 9).

8. Consent, WhatsApp and children

By using PointEight you consent to this Policy. Messages to your customers are sent within WhatsApp's policies; you are responsible for having a lawful basis to contact them. The service is for businesses and not directed at children under 18.

9. Grievance Officer & contact

Grievance Officer: [Grievance Officer Name]
Email: privacy@pointeight.app
Address: [Registered Address]

10. Changes

We may update this Policy; material changes will be notified in-app or by email. Continued use after an update means you accept the revised Policy.