Privacy Policy

1. Introduction & Legal Entity

This Privacy Policy describes how INFOSKILLS TECHNOLOGY PVT LTD (operating as NotifySetu, “we”, “us”, or “our”) collects, uses, and safeguards your information when you access or integrate our developer notification APIs, software, and console services at https://notifysetu.com.

2. Data We Collect

NotifySetu collects information strictly necessary to provide unified notification services across Email, SMS, WhatsApp, Push, and Voice. This includes developer account credentials, API tokens, notification metadata, delivery receipts, and billing identifiers managed by our Merchant of Record (Paddle).

3. How We Process Notification Payloads

We process payload parameters strictly for dispatching notifications through your configured provider channels (e.g. AWS SES, Twilio, Meta WhatsApp) and delivering real-time webhook event callbacks. We do not sell or monetize customer data.

4. Data Encryption & Security Standards

All secrets, provider API keys, and sensitive payload parameters are encrypted at rest using industry-standard AES-256 GCM encryption. In-transit communications are encrypted via TLS 1.3.

5. WhatsApp Business Platform Data

Where you use NotifySetu to send messages via the WhatsApp Business Platform (Meta), we process the following on your behalf: recipient phone numbers, message template content, delivery/read status, and your WhatsApp Business Account (WABA) ID and Phone Number ID. This data is transmitted to Meta solely to deliver the messages you configure, in accordance with Meta’s WhatsApp Business Data Use Policy. We do not use WhatsApp message content for advertising or share it with third parties beyond what is required to deliver your notifications.

6. Data Sharing, Sub-processors & Infrastructure

We share and transmit data solely with vetted third-party service providers and sub-processors strictly necessary to deliver notifications and operate our infrastructure:

• Meta / WhatsApp Business Platform: For dispatching WhatsApp message templates, session messages, and receiving delivery webhook callbacks.
• Amazon Web Services (AWS SES, Cloud Infrastructure): For high-deliverability transactional email delivery, worker queues, and cloud hosting.
• Twilio: For carrier-grade SMS, voice dispatches, and OTP verification where configured.
• Paddle: Acting as our Merchant of Record for global checkout, PCI-DSS Level 1 compliant payment processing, invoicing, and tax compliance.

For a complete, comprehensive registry of our authorized sub-processors, processing locations, security standards, and GDPR Article 28 data processing terms, please refer to our official Data Processing Addendum (DPA). We do not sell customer or recipient personal data, nor do we share it with third parties for cross-context behavioral advertising.

7. Data Retention

We retain notification metadata and delivery logs for as long as your account is active, and for up to 90 days after account closure for billing, dispute resolution, and legal compliance purposes, unless a longer period is required by law. You may request earlier deletion by contacting us as described below.

8. Your Rights & Data Subject Access Requests

Depending on your jurisdiction, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. To exercise these rights, contact us using the details in Section 11. We will respond within the timeframe required by applicable law (e.g., 30 days under GDPR).

9. Children’s Privacy Protection

Our APIs, documentation, developer console, and communication services are strictly intended for businesses, software developers, and professionals. We do not knowingly solicit, collect, or process personal data from children under the age of 13 (or under 16 within the European Economic Area or UK). If you believe that a minor has provided personal data through our platform or through an application integrated with our APIs without verified parental consent, please contact us immediately so that we can promptly investigate and permanently delete such records.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the “Last Updated” date at the top of this page, and, where required by law, we will provide additional notice.