Privacy Policy

Dripo (dripo.nebkern.com) is a customer-messaging and CRM platform that lets businesses talk to their customers over WhatsApp, Instagram and Facebook Messenger. It is owned and operated by Nebkern Technology, a sole proprietorship owned by Sanjit Singha, with its registered address at Ghoshpukur, Kamala Bagan, Darjeeling, West Bengal 734426, India. In this policy, "we", "us" and "our" mean Nebkern Technology, and "the Service" means the Dripo website, web application, APIs and the Dripo app on Meta’s platform.

This policy explains what personal data we collect, how we use it, who we share it with, how long we keep it, how we protect it, and the rights you have over it. It applies to everyone who visits our website or uses the Service.

In short: we use your data only to run the Service for you. We do not sell personal data, we do not use it for advertising, and you can delete your account and everything in it at any time — see our Data Deletion page at dripo.nebkern.com/data-deletion.

We collect the following categories of information.

• Account information — your name, email address, password (stored only as a secure hash), business name, phone number, profile picture, the team members you invite, and their roles and permissions.
• Information from Meta, when you connect a WhatsApp Business, Instagram or Facebook Page account — described in detail in section 4.
• Conversation and customer data — the messages, media, voice notes and call records exchanged with your customers on your connected channels, and the contacts, names, phone numbers, notes, tags, custom fields, deals and campaign data you keep in Dripo. We hold this on your behalf; see section 7.
• Information from other services you connect — such as Google (Sign in with Google and Google Sheets, described in section 5), Zoho CRM, Shopify, WooCommerce, or an AI model provider whose API key you add. We receive only what each connection needs to work.
• Billing information — your plan, invoices, billing name, address and tax details. Card, UPI and bank details are entered directly with our payment processor, Razorpay, and never reach or are stored on our servers.
• Technical and usage information — IP address, browser and device type, pages and features used, timestamps, sign-in sessions and devices, and error logs, used to run and secure the Service.
• Information you send through our website — contact and enquiry forms, newsletter sign-ups, and our free tools. When you use the free WhatsApp QR code generator, we record the number and pre-filled message you enter with a timestamp.

We do not buy personal data, and we do not ask for sensitive personal data such as health, financial account, biometric or religious information. If such data appears inside a conversation, we process it only as part of storing that conversation for you.

• To provide the Service — send and receive messages, display your inbox, run the automations, campaigns, chatbots and AI features you set up, keep your contacts and connected tools in sync, and show you reports about your own account.
• To process payments, issue invoices and meet our tax and accounting obligations.
• To keep the Service and your account secure — verify sign-ins, prevent fraud, spam and abuse, enforce rate limits and investigate incidents.
• To give you support when you ask for it, which may mean viewing the specific records you ask us about.
• To maintain and improve the Service using aggregated, de-identified usage statistics — never the content of your conversations.
• To send you service messages, such as account, billing and security notices. Marketing emails are separate, and every one has an unsubscribe link.
• To comply with the law and respond to lawful requests from authorities.

We process your personal data on the basis of your consent, to perform our contract with you, to comply with legal obligations, and for other legitimate uses permitted by India’s Digital Personal Data Protection Act, 2023. Where we rely on consent, you can withdraw it at any time.

We do not use the content of your customer conversations to train AI models. AI features in Dripo run on an AI provider account that you connect with your own API key, and only for your own workspace.

When you connect a WhatsApp Business account, an Instagram professional account or a Facebook Page to Dripo, you sign in with Meta and grant Dripo the permissions shown on Meta’s consent screen. Through that connection we receive:

• Business and account identifiers — your Meta business ID, WhatsApp Business Account ID, phone number ID, display phone number, verified business name, Facebook Page ID and name, and Instagram account ID and username.
• Account status — phone number quality rating, messaging limits, and your message templates and their approval status.
• Access tokens that allow Dripo to act on these accounts on your behalf. They are stored encrypted and are never shown in the app.
• Messages and events — messages, media and reactions your customers send to your connected accounts, delivery and read receipts for the messages you send, call events, and the profile name and WhatsApp number, Instagram-scoped ID or Messenger-scoped ID of each person who contacts you.

How we use and protect it:

• We use this information only to provide the features you use in Dripo — sending and receiving messages, managing templates, showing conversations in your inbox, running your automations and reports, and keeping your connection working.
• We do not sell it, rent it, or use it for advertising or marketing; we do not share it with data brokers; and we do not combine it across different businesses to build profiles of individuals.
• We share it only with the service providers needed to run Dripo (see section 8 and our Subprocessor List), each bound to use it only for that purpose.
• We handle it in accordance with the Meta Platform Terms, Meta’s Developer Policies, and the WhatsApp Business terms and policies.
• When you disconnect a WhatsApp, Instagram or Messenger account in Dripo, we immediately delete its access token and connection settings. Conversation history you already have stays in your workspace until you delete it or your account.

To delete the data we hold that came from Meta — or your whole account — follow the steps on our Data Deletion page at dripo.nebkern.com/data-deletion, or email contact@dripo.nebkern.com. You can also remove Dripo’s access at any time from your Facebook settings (Business integrations) or from Meta Business Suite.

• Sign in with Google — if you choose it, Google shares your name, email address and profile picture so we can create and sign in to your account. We use it for nothing else.
• Google Sheets — if you connect Google Sheets, Dripo uses the Google "drive.file" permission, which gives access only to spreadsheets that Dripo creates or that you choose to open with it. We use it to create those spreadsheets and write the contact and event rows you set up. We cannot see any other file in your Google Drive.

Dripo’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We do not use Google user data for advertising, we do not sell it, we do not let humans read it except with your permission, for security, or where the law requires, and we do not use it to train AI models. You can revoke access at any time from your Google Account (Security → Third-party connections) or by disconnecting Google Sheets in Dripo.

You can choose to connect Dripo to other tools. Each connection is optional, starts only when you set it up, and can be removed at any time.

• Zoho CRM — keeps your Zoho leads, contacts and deals in sync with Dripo, and can save your conversations as notes on the matching Zoho record.
• Shopify and WooCommerce — receive your store’s order events so you can send order updates to your customers.
• AI model providers (OpenAI, Anthropic, OpenRouter) — when you add your own API key, we send them only the text needed to draft or send a reply: the recent conversation, your instructions and relevant knowledge-base content.
• Webhooks, the API, Zapier, Make and n8n — deliver data to the systems you nominate.

Access credentials for these services are stored encrypted. What a connected service does with the data it receives is governed by its own terms and privacy policy.

Much of the personal data in Dripo belongs to the people your business talks to. For that data — your contacts, their numbers and your conversations with them — your business decides why and how it is processed, and we process it only on your instructions. Under India’s DPDP Act your business is the Data Fiduciary and we are its Data Processor; under the GDPR, the controller and processor. For your own account, billing and usage data, we are the Data Fiduciary (controller).

As a business using Dripo, you are responsible for having a valid basis — usually opt-in consent — to message your customers, for honouring their requests to stop, and for answering their privacy requests. Our Acceptable Use and WhatsApp policies explain what that requires, and the app lets you export or delete any contact and their conversation history.

We do not sell personal data, and we do not share it for advertising. We share it only as follows:

• Meta — messages you send and receive pass through the WhatsApp Business Platform, Instagram and Messenger, which Meta operates under its own terms and privacy policy.
• Service providers who run the Service for us, under contract and only for that purpose: Cloudonfire (application servers), Supabase (database, authentication and file storage, in Mumbai, India), Cloudflare (media storage and delivery, and bot protection on our forms), Razorpay (payments) and DeoMail (email delivery). The full list is on our Subprocessor List.
• Services you choose to connect, as described in sections 5 and 6.
• Professional advisers, and a buyer or successor if our business is sold or reorganised, who must protect the data as this policy does.
• Government or law-enforcement authorities, where the law requires it. Unless we are prohibited from doing so, we will tell you about such a request.

The app uses only cookies and browser storage that are strictly necessary — to keep you signed in, protect your account and remember your interface preferences. On our public website we measure visits with Umami, which sets no cookies, and with Google Analytics 4, which sets cookies and loads only if you accept them. We do not use advertising or cross-site tracking cookies anywhere. Our Cookie Policy lists every cookie and how to control it.

Your workspace data — accounts, contacts and conversations — is stored in Supabase’s data centre in Mumbai, India. Media files are stored with Cloudflare R2, and the application runs on servers operated by Cloudonfire. Some providers, including Meta, Google, Cloudflare and the AI provider you connect, process data on infrastructure outside India. We transfer data abroad only as permitted by Indian law, and never to a country the Government of India has restricted.

• Conversation and contact data — for as long as your account is active. You can delete any contact or conversation at any time, and it is removed from our live systems.
• Connected channel credentials — until you disconnect the channel, when they are deleted immediately.
• When you delete your account — the account is locked at once and can be restored for 30 days. After that, all workspace data, including data received from Meta and Google, is permanently deleted from our live systems.
• Backups — deleted data can remain in encrypted backups for up to 30 days, until they expire.
• Invoices and payment records — for as long as Indian tax and accounting law requires, generally up to 8 years.
• Security logs — for a limited period, generally no more than 90 days.

Our Data Retention & Deletion Policy has the full detail.

Data is encrypted in transit with TLS and at rest. Access tokens and integration credentials are additionally encrypted before they are stored. Each business’s data is kept separate by row-level security enforced in the database, so one workspace can never read another’s. Staff access is limited to what is needed to run and support the Service. Our Security Policy describes these controls in detail.

No system is completely secure. If a personal data breach affects you, we will notify you, and the Data Protection Board of India where required, without undue delay.

Under India’s Digital Personal Data Protection Act, 2023, you have the right to:

• Obtain a summary of the personal data we hold about you and how we process it.
• Have inaccurate or incomplete data corrected, completed or updated.
• Have your personal data erased, unless we must keep it by law.
• Withdraw consent you have given, as easily as you gave it.
• Have your grievances addressed by our Grievance Officer.
• Nominate another person to exercise these rights on your behalf in case of death or incapacity.

You can view, edit, export and delete most of your data yourself in the app. For anything else, email contact@dripo.nebkern.com. We may need to verify your identity, and we respond within 30 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India. If you are located outside India, you may have similar rights under your local law, and we will honour them.

If you are a customer of a business that uses Dripo and want your data corrected or deleted, please contact that business — it controls your data. If you contact us, we will forward your request to the business and help it respond.

The Service is for businesses and is not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child’s data has reached us, email contact@dripo.nebkern.com and we will delete it.

We may update this policy as the Service or the law changes. We will change the "Last updated" date above and, for significant changes, notify account owners by email or in the app before the change takes effect.

For any question or request about this policy or your personal data, contact Nebkern Technology at contact@dripo.nebkern.com, call +91 92390 64013, or write to Ghoshpukur, Kamala Bagan, Darjeeling, West Bengal 734426, India.

In accordance with the Information Technology Act, 2000, the rules made under it, and the Digital Personal Data Protection Act, 2023, our Grievance Officer is Sanjit Singha, Proprietor — email contact@dripo.nebkern.com, phone +91 92390 64013, address Ghoshpukur, Kamala Bagan, Darjeeling, West Bengal 734426, India. Grievances are acknowledged within 24 hours and resolved within 15 days.