Privacy Policy

We collect three types of information: (a) information you provide when creating an account or using the Service; (b) recipient data you upload or send through the Service; and (c) usage information we collect automatically.

Account information includes your name, email address, company name, phone number, billing details and payment method (processed by Razorpay — we never store card numbers on our servers).

Recipient data includes email addresses, phone numbers, names and any custom fields you upload to your recipient lists. As a Data Processor, we handle this data solely on your instructions.

Usage information includes IP address, browser type, device information, pages viewed, API request logs and diagnostic data. This is used strictly to operate and improve the Service.

We use information to:

• Provide, maintain and improve the Service.
• Process transactions and send you related billing information.
• Send technical notices, updates, security alerts and support messages.
• Respond to your comments, questions and customer service requests.
• Detect, investigate and prevent fraud, abuse and security incidents.
• Comply with legal obligations.

We do not use recipient data for our own marketing or sell it to third parties. Recipient data is your data.

We process personal data on the following legal bases: performance of a contract (to deliver the Service you signed up for), legitimate interests (to operate and improve the Service), consent (for optional marketing communications), and compliance with legal obligations.

We share personal data only with: (a) our sub-processors listed at https://notifyr.in/subprocessors; (b) email, SMS or WhatsApp providers you explicitly configure in your project; (c) authorities when required by law; and (d) a successor entity in the event of a merger or acquisition.

We never sell personal data. We never use recipient data to train third-party AI models.

Account data is retained for as long as your account is active plus 90 days after cancellation. Email logs and campaign data are retained for 90 days on Starter/Growth plans and configurable up to 7 years on Scale plans. You can delete recipient data at any time from the dashboard.

We encrypt data in transit with TLS 1.3 and at rest with AES-256. We enforce SSO and 2FA for internal access, run continuous vulnerability scanning, and undergo an annual SOC 2 Type II audit. Read more on our Security page.

Depending on your jurisdiction, you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Request deletion (“right to be forgotten”).
• Restrict or object to processing.
• Data portability — export your data in a machine-readable format.
• Withdraw consent at any time.
• Lodge a complaint with your supervisory authority.

To exercise any of these rights, email us at privacy@notifyr.in from the address associated with your account. We respond within 30 days.

Data is primarily stored in Mumbai (ap-south-1). For customers on the Scale plan we offer EU (eu-west-1) or US (us-east-1) data residency. Transfers between regions rely on Standard Contractual Clauses approved by the European Commission.

We use strictly necessary cookies for authentication and functional cookies for user preferences. We use privacy-respecting analytics (Plausible / self-hosted) and do not use third-party advertising trackers on our dashboard.

The Service is not directed at children under 16. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us and we will promptly delete it.

We may update this Privacy Policy from time to time. Material changes are announced at least 30 days in advance by email to your account address.

Questions or requests? Email privacy@notifyr.in or write to us at Bengaluru, Karnataka, India. Our Data Protection Officer can be reached at the same address.