Privacy Policy
Last updated: 24 August 2026
This Privacy Policy explains how Replova Labs Private Limited ("Replova Labs", "we", "us", "our"), operating the Rechlio platform, collects, uses, stores, and protects your personal and business data in compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act), the Meta Platform Terms, the WhatsApp Business Messaging Policy, and other applicable Indian and international privacy laws.
1. Information We Collect
1.1 Account Information
When you create a Rechlio account, we receive your name and email address. You may sign up with an email and password, or with Google or GitHub (OAuth). Passwords are never stored in plain text — they are salted and hashed (scrypt) before storage, and OAuth sign-ins store only a provider identifier, never your provider password.
1.2 Workspace & Business Data
You provide your company name, description, products/services, and target audience to configure outreach campaigns. This data is stored in your workspace and used solely to personalize your AI-generated outreach content.
1.3 Lead Data & Contact Lists
Lead information is sourced from publicly available business directories (Google Places API) or uploaded by you via CSV/Excel files. This may include business names, phone numbers, email addresses, websites, and addresses. You remain the Data Controller (Data Fiduciary) for all lead data you upload or query.
1.4 Communication Data
When you use Rechlio to send emails, SMS, WhatsApp messages, or make voice calls, we store:
- Message content, templates, and scripts you create
- Delivery status and engagement metrics (opens, replies, call duration)
- Call recordings and transcripts (for AI voice calls via Bolna AI)
- Extracted data and summaries from AI voice conversations
1.5 Meta & WhatsApp Cloud API Data
If you connect a WhatsApp Business Account (WABA), we process data through the Meta WhatsApp Cloud APIto send and receive messages on your behalf. This includes:
- Business Account Credentials: Your WhatsApp Business Account ID, Phone Number ID, and API Access Tokens (stored encrypted with AES-256)
- Customer & Recipient Details: Phone numbers and names of contacts you choose to message
- Message Content & Status: Template names, text body, media parameters, inbound replies, and delivery/read status metadata
- Consent & Opt-in Records: Customer consent and opt-out statuses maintained for your WABA
We use Meta/WhatsApp data solely to deliver the messaging features you request (sending messages, displaying replies, and organizing workspace conversations).We NEVER use your WhatsApp message content or customer contact lists to train public AI/LLM models, share with third-party advertisers, or sell to third parties.
2. How We Use Your Data
- Service Delivery: Running outreach campaigns, executing AI voice calls, delivering emails/SMS, and processing WhatsApp messages
- AI Personalization: Using your business context to generate tailored outreach templates and conversation summaries
- Billing & Metering: Tracking plan quotas and deducting per-unit usage charges from your Rechlio wallet
- Analytics & Dashboards: Displaying real-time delivery status, response rates, and call quality metrics
- System Health & Security: Debugging system errors, monitoring API performance, and preventing fraud or abuse
- Compliance & Audit Trails: Maintaining DPDP consent logs and responding to lawful requests from regulatory authorities
3. Third-Party Service Providers (Sub-processors)
We share data with third-party service providers strictly for service execution under written data processing agreements:
| Provider | Purpose | Data Shared |
|---|---|---|
| Meta Platforms Inc. / Meta Cloud API | WhatsApp messaging & Embedded Signup | WABA ID, Phone Number ID, phone numbers, message content |
| Bolna AI | AI voice calls & batch calling | Phone numbers, call scripts, voice config |
| Plivo | Telephony infrastructure | Phone numbers, call routing |
| Google (Places API) | Lead discovery | Search queries, location parameters |
| ZeptoMail / User SMTP | Email delivery | Recipient emails, message content |
| MSG91 | SMS delivery | Phone numbers, message content |
| Anthropic (Claude AI) | AI segmentation & reply scoring | Lead data for scoring, reply classification (zero-retention agreement) |
| Razorpay Software Pvt. Ltd. | Payment processing (wallet top-ups & subscriptions) | Name, email, payment amount, transaction & order IDs |
| Supabase / AWS | Database & infrastructure hosting | Application data (encrypted at rest with RLS) |
We do not sell, rent, or trade your personal data or your customers' data to any third party for marketing or advertising purposes.
4. Data Storage, Security & Encryption
- Encryption at Rest: All database records are stored in encrypted databases (AES-256) hosted on secure cloud infrastructure
- Application-Level Encryption: WhatsApp API access tokens, SMTP passwords, and secret credentials are encrypted at the application layer using process secrets before database write
- Encryption in Transit: All web traffic and API communications are enforced via TLS 1.2 / TLS 1.3 encryption
- Row-Level Security (RLS): Multi-tenant isolation ensures complete separation between customer workspaces
5. Data Retention & Erasure
- Account & Workspace Profile: Retained while workspace is active; permanently erased within 30 days of workspace closure
- WhatsApp Access Tokens: Deleted immediately upon in-app disconnect or Meta deletion callback
- WhatsApp Messages & Call Logs: Retained in your workspace inbox until deleted by you or upon workspace closure
- Statutory Invoices & Billing Logs: Retained for 7 years as mandated by Indian tax and accounting regulations
6. Your Rights Under DPDP Act 2023 & Meta Policies
As a Data Principal under Indian law and Meta Platform Developer Policies, you have the right to:
- Right to Access: Obtain a copy of your personal data processed by Rechlio
- Right to Correction & Updating: Request correction of inaccurate or incomplete personal data
- Right to Erasure / Deletion: Request full erasure of your account and connected WABA data — see our Data Deletion Instructions
- Right to Withdraw Consent: Disconnect connected integrations (WhatsApp, Email, CRM) at any time to revoke processing consent
- Right to Grievance Redressal: Submit privacy complaints directly to our Data Protection Officer
7. Meta Developer Policies & Platform Compliance
Rechlio explicitly complies with the Meta Platform Terms, Developer Policies, and WhatsApp Business Messaging Policy. We enforce opt-in verification, template approval checks, and provide users with instant disconnect tools to ensure full compliance with Meta's messaging standards.
8. Children's Data
Rechlio is a B2B sales automation platform intended strictly for commercial business use by adults aged 18 and older. We do not knowingly collect personal data from minors.
9. Grievance Officer & Contact Information
In accordance with the DPDP Act 2023 and Information Technology Act 2000, for privacy questions, data deletion requests, or grievances:
- Grievance / Data Protection Officer: Replova Labs Private Limited
- Email: support@rechlio.com
- SLA: Grievance inquiries are acknowledged within 24 hours and addressed within 7 business days
- CIN: U62012PN2026PTC255232
- Registered Address: H. No. 1152, Wangdari, Shrigonda, Ahmadnagar - 413726, Maharashtra, India