Privacy Policy

This policy explains what personal information Tous Connect (operated by Grid IT Solutions) collects, how we use it, and the choices you have. It covers our business customers (the people who sign up and use the platform) and explains how we handle the data those businesses process about their own customers.

1. Information we collect

• Account information — business name, contact name, email address, phone number, business type, and your password (stored only as a salted hash).
• Contacts — the customer records you upload or create: names, phone numbers, tags, notes, and custom fields.
• Messages — the content, timestamps, and delivery status of WhatsApp messages sent and received through your connected number.
• Card scans — images of business cards you upload, and the text extracted from them.
• Payment information — billing amounts, transaction IDs, and payment status. Card numbers are handled entirely by Razorpay; we never receive or store them.
• Usage and technical data — log data such as IP address, browser type, pages accessed, and error traces, used for security and debugging.

2. How we use it

• To provide, operate, and maintain the Service.
• To send and receive messages on your behalf via the WhatsApp Business Platform.
• To process payments, manage subscriptions, and maintain your credit balance.
• To provide support and respond to your requests.
• To detect abuse, spam, fraud, and security incidents.
• To send essential service notices (billing, outages, policy changes).

We do not sell your data, and we do not sell or share your contacts with third parties for their own marketing. We do not use the content of your customer conversations to train AI models.

3. Where your data is stored

Data is stored in Supabase (PostgreSQL), hosted in the Singapore region. The application is hosted on Vercel. Data is encrypted in transit (TLS) and at rest. Access is restricted to authorised personnel and segregated per tenant using row-level security, so one business can never read another’s data.

4. WhatsApp and Meta

When you connect a WhatsApp Business number, messages pass through Meta’s WhatsApp Business Platform. We process those messages on behalf of your business — you are the data controller for your conversations and we act as your processor.

For the end consumers your business messages, Meta’s own privacy policy and the WhatsApp terms apply to the handling of their data inside WhatsApp. We do not control Meta’s processing. If a consumer wants their data removed from your records, contact us or manage it directly from your contacts page.

5. Card scanner and AI processing

When you scan a business card, the image is sent to Groq for AI text extraction. Only the extracted fields (name, phone, email, company) are saved to your contacts. The image is not stored permanently after extraction. We do not use your scans to train models.

6. Cookies

We use session cookies for authentication only — they keep you signed in and secure your session. We do not use advertising cookies, third-party tracking pixels, or cross-site behavioural profiling. Blocking these cookies will prevent you from signing in.

7. Data retention

• Active accounts — data is retained for as long as your account is open, so your conversation history and contacts stay available.
• Closed or deleted accounts — data is retained for 30 days after termination so you can export it, then permanently purged from our production systems.
• Backups are rotated and expire within a further 30 days.
• Limited billing and tax records are retained longer where required by Indian law.

8. Your rights

You may, at any time:

• Access and export your contacts and data from the dashboard, or by request.
• Correct inaccurate account or contact information.
• Delete individual contacts, or request deletion of your entire account.
• Object to or restrict certain processing, where applicable law provides that right.

To exercise any of these, email connect@thetous.com. We respond within 30 days. We may need to verify your identity before acting on a request.

9. Third-party services

We share data with these processors strictly to run the Service:

• Supabase — database, authentication, and file storage.
• Vercel — application hosting and delivery.
• Meta Platforms — WhatsApp Business Platform message delivery.
• Razorpay — payment processing.
• Groq — AI text extraction for the card scanner and template generation.

Each processes data under its own terms and applicable data-protection obligations.

10. Security

We use TLS encryption, hashed credentials, row-level tenant isolation, scoped API keys, and signature verification on payment and webhook endpoints. No system is perfectly secure; if a breach affects your data we will notify you promptly and without undue delay.

11. Children

The Service is for businesses and is not directed at anyone under 18. We do not knowingly collect personal information from children.

12. Changes to this policy

We may update this policy. Material changes will be notified in-app or by email at least 14 days before taking effect, and the “last updated” date above will change.

13. Contact

For any privacy question or request: Grid IT Solutions — connect@thetous.com