Privacy Policy

ViziGrow is operated by KRAS AI Solutions Private Limited, a company incorporated in India (CIN U72900UP2020PTC130416), with its registered office at F-7, 1st Floor, Friends Garden, Sikandra, Mathura Road, Agra, Uttar Pradesh 282001, India. In this policy “we” means that company. This covers our website (vizigrow.com), the ViziGrow dashboard, the business landing pages we host, and the WhatsApp and web chat conversations we handle on a business's behalf.

Under India's Digital Personal Data Protection Act, 2023 we act in two different roles depending on whose data it is, and the difference matters: see the next section.

There are two kinds of people in this policy.

• Business owners - you signed up, you run a business, you use the dashboard. For your data we are the data fiduciary: we decide what to collect and we answer to you directly for it.
• Customers of those businesses - you messaged a shop, clinic or salon on WhatsApp, filled in a form on their page, or chatted on their website. For your data we are a data processor. The business you contacted decides what happens to it; we hold it and act on their instructions, and we do not use it for our own purposes.

If you are in the second group and want your data corrected or deleted, you can ask us directly and we will act on it: see Your rights. We will also tell the business, because in most cases they hold a copy too.

We do not sell personal data. We do not share one business's customers with another. We do not build advertising profiles.

If you own a business on ViziGrow:

• Your mobile number, which is how you sign in. We do not store a password because there isn't one.
• What you tell us about your business: name, category, address, hours, services and prices, and any menus, brochures or photos you upload.
• Your Google Business Profile information, but only if you connect your Google account, and only for the listings you pick.
• How you use the product, which screens you open, which suggestions you accept. We use this to fix the parts people get stuck on.

If you contacted a business that uses ViziGrow:

• Your phone number and WhatsApp display name, or whatever you typed into a form on their page.
• The messages themselves, in full, on both sides of the conversation.
• What our system worked out from those messages so the business can serve you: the service you asked about, a date, a location, a budget, how urgent it seemed. Alongside it we keep a priority score so the business knows who to call back first. That score is a simple weighted sum, not a judgement about you, and it is only ever visible to the business you contacted.
• Your bookings with that business, and whether you turned up.
• A record of what you have and have not agreed to be messaged about.
• If you used a form on a business's ViziGrow page: which page you submitted from, your browser identification string, and a one-way scrambled version of your IP address. The scrambled IP cannot be turned back into your address; it exists so we can block a bot submitting the same form a thousand times, and nothing else.

• To run the service you asked for - set up and maintain a business's online presence, answer their enquiries, take bookings, send reminders.
• To write and reply using AI - business details, service lists and conversation history are sent to our AI provider so it can draft profile content and reply to customers. See Who else sees it.
• To send the messages you have consented to - booking confirmations, reminders, review requests. Never anything you have not agreed to. See WhatsApp and messaging.
• To keep the platform safe and working - rate limiting, spam and fraud prevention, debugging, and keeping accurate records of consent so we can prove a message was allowed.
• To sign you in - a one-time code by SMS to the business owner's phone.

We do not use the conversations between a business and its customers to train AI models, to advertise to anyone, or for any purpose of our own beyond running the service.

This is the part most worth reading. ViziGrow sends and receives WhatsApp messages on a business's behalf using the official WhatsApp Business Platform, which means your phone number and the contents of your messages pass through Meta.

You are talking to an AI, and we say so.The first reply in a conversation identifies itself as an AI assistant working for the business. It answers using that business's own price list and real availability, it is built so that it cannot state a price or an appointment time it did not read from their system. When it is unsure, or when you ask for a person, it stops and hands the conversation to the owner, who can read everything and take over.

We only message you if you have agreed to it. Consent is recorded separately for each purpose: replying to your enquiry, booking updates, review requests, promotions, and each one is an individual, dated, permanent record rather than a single box someone ticked once. Replying to a message you sent is not the same as marketing to you, and the two are never treated as the same permission. A message we cannot verify you agreed to does not get sent.

To stop messages, reply STOP. Send STOP (or बंद करो) to a business messaging you through ViziGrow and we stop immediately, every automated message, every reminder, every review request, and the AI assistant too. You will get one short confirmation and then nothing. Reply START if you ever want to turn it back on. You can also block the number in WhatsApp, or email us and we will do it for you.

There are limits on how often you can be messaged. Automated messages are capped per person, per purpose, per day, and the cap is enforced in our code rather than left to the business's discretion. WhatsApp's own rules also apply: once 24 hours have passed since your last message, a business can only contact you using a message format Meta has approved in advance.

We keep the conversation. The business you messaged can read the whole thread, as can we for support and debugging. It is also sent to our AI provider in order to generate replies. If you would rather it were not kept, ask us and we will delete it: see Your rights.

We use a small number of companies to run ViziGrow. Each gets only what it needs, and each is bound by its own contract and privacy terms.

• Google Cloud & Firebase - hosting, sign-in, database and file storage. Effectively everything is stored here.
• Meta (WhatsApp Business Platform) - receives phone numbers and message contents in order to deliver WhatsApp messages. Meta's handling of that data is governed by their own terms.
• AI language-model providers - receive business details and conversation text so the AI can draft content and replies. Our agreements with them do not permit training models on it. We may change providers; write to us and we will tell you which ones we use today.
• Google Maps Platform - to find a business's listing and show a map on their page.
• Google Business Profile - only after a business explicitly connects their Google account, and only for the listings they authorise. They can disconnect us at any time from their Google account permissions.

Google account data, in detail. When a business connects Google we ask for the business.managepermission and for the email address of the account. We use that access for exactly four things, all on the one listing the owner picks: to publish posts, review replies and answers that the owner has approved or has asked us to handle through their weekly plan; to read the listing's reviews, questions and verification state so we can draft that work; to read its performance figures so the dashboard can show what changed; and to display which account is connected. The refresh token Google gives us is stored encrypted, is used only by our servers, and is deleted the moment the owner disconnects. We never sell this data, never use it for advertising, never let a person read it except to support the owner at their request, and never transfer it to another app. ViziGrow's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We also disclose data when the law genuinely requires it: a court order or valid legal process, and we will tell you when we are permitted to.

Some of these companies process data outside India. Where that happens it is under contractual terms requiring protection equivalent to what this policy promises.

These apply whether you are a business owner or someone who messaged a business through us.

• See what we hold. Ask and we will send you a copy.
• Correct it. Business owners can edit most things directly in the dashboard. Anyone else, just ask.
• Delete it. Business owners can delete their account. Customers can ask us to erase their conversations, lead record and contact details. We keep only the record proving you asked us to stop messaging you: deleting that would mean losing the evidence of your own instruction.
• Stop being messaged. Reply STOP, or ask us. Immediate, and it covers every channel.
• Complain. To us first, details below, and if we do not resolve it, to the Data Protection Board of India.
• Nominate someone. You may nominate a person to exercise these rights on your behalf if you die or become incapacitated. Write to us and we will record it.

We reply within 7 business days. We may need to verify who you are first, usually by confirming you control the phone number involved, because handing someone else's conversations to the wrong person is its own harm.

Data is stored on Google Cloud infrastructure in Asia, primarily the Mumbai region.

• Business account and content - kept while the account is active, then deleted within 30 days of a deletion request.
• Conversations, leads and bookings - kept while the business's account is active, so they can serve a returning customer. Deleted on request.
• Consent and opt-out records - kept for as long as we are required to be able to prove a message was permitted, and after that only in the form needed to keep honouring an opt-out. These deliberately outlive the rest.
• Technical logs - kept for a short operational period and then discarded.

Data is encrypted in transit and at rest. Access to production data is limited to the people who need it to operate the service. Sign-in is by one-time code, so there is no password of yours for anyone to steal from us. Credentials for connected accounts are stored encrypted.

No system is perfect. If a breach affects your data, we will notify you and the Data Protection Board of India without undue delay, and tell you plainly what happened and what to do about it.

We will update this policy as the product changes. Anything material gets an in-product notice as well as a new date at the top of this page, we will not rely on you re-reading it.

For any privacy question, request or complaint: including from customers of a business that uses ViziGrow: contact our Grievance Officer:

• Email anmol.sharma@kras.ai
• KRAS AI Solutions Private Limited, F-7, 1st Floor, Friends Garden, Sikandra, Mathura Road, Agra, Uttar Pradesh 282001, India
• CIN U72900UP2020PTC130416

We respond within 7 business days. If you are not satisfied with how we handle it, you can escalate to the Data Protection Board of India.