Privacy Policy

1. Scope and processing roles

This Policy applies to data processed through our website, portals, APIs, imports, support channels, outreach tools, analytics, AI features, and integrations. It covers business owners, managers, staff, prospective customers, support contacts, and people whose details are entered into a customer workspace.

For account registration, billing, website, security, product-usage, support, and direct-marketing data that we determine how and why to process, tribly.ai generally acts as the body corporate or Data Fiduciary, as applicable.

For customer relationship and store-operational data—such as customer profiles, visits, calls, follow-ups, field sales, campaign leads, and analytics—the subscribing business ordinarily determines the purposes and means and acts as Data Fiduciary. tribly.ai ordinarily acts as its Data Processor or service provider on documented instructions, subject to law and our agreement.

Each subscribing business remains responsible for giving required notices, establishing a lawful ground, recording communication consent and preferences, configuring access, and ensuring data uploaded to or used through the Services was lawfully obtained.

2. Personal data we process

The data processed depends on the features selected by a customer and information its authorised users submit. It may include:

• Account and workforce data: name, work email, phone number, business/store name, role, staff identifier, assigned store, login status, preferences, and account relationships.
• Authentication and security data: password hashes (not plaintext passwords), session tokens, one-time authentication data, roles/permissions, IP address, device/browser information, access events, audit records, and suspected-abuse signals.
• Customer and CRM data entered by businesses: names, phone numbers, email addresses, gender or age-group information where supplied, birthdays or anniversaries, location/area, customer type, preferences, purchase interests, visit history, follow-ups, notes, and assignments.
• Sales and operational data: visits, field-sales records, purchase and non-purchase outcomes, product/budget preferences, scheme enrolments, sales values, calls, correction requests, imports, and performance metrics.
• Location data: store locations and, where enabled and permitted by the device user, coordinates and accuracy information associated with field activity or visit records.
• Campaign and outreach data: segments, campaign content, templates, delivery status, opt-out/suppression status, call/SMS/WhatsApp metadata, and provider identifiers.
• Meta Platform Data: Facebook Page IDs/names, encrypted access tokens, OAuth session data, Lead Ads form/ad/ad-set/campaign identifiers and names, lead IDs/timestamps, and lead form fields made available by a connected Page.
• Google and AI data: free-form AI questions; selected store names; aggregated or scoped metrics; call-feedback or field-note text when an AI feature is invoked; model responses; and API usage metadata. Automated owner summaries are designed to exclude direct customer names and phone numbers, but user-entered prompts or notes may contain personal data.
• Billing data: billing contacts, GST/tax identifiers, invoices, subscription status, payment references, and reconciliation details. Full payment-card details are handled by authorised payment providers and are not intended to be stored in tribly.ai.
• Website and usage data: cookies/session identifiers, device type, browser, operating system, timestamps, feature usage, diagnostics, error logs, and performance data.
• Communications: demo/report requests, registration details, support tickets, bug reports, attachments, feedback, and correspondence.
• SPDI under the 2011 Rules, where supplied: passwords, financial information, health/medical information, biometrics, or other legally defined SPDI. The Services are not designed for health, biometric, or similarly high-risk data; customers must not submit it unless expressly supported and lawfully authorised.

3. Sources of data

• Directly from a person who registers, uses the Services, submits a form, communicates with us, or enables device permissions.
• From subscribing businesses, their authorised owners, managers, staff, administrators, imports, and connected systems.
• Automatically from browsers, devices, servers, cookies, logs, security systems, and product interactions.
• From customer-authorised integrations, including Meta Lead Ads, messaging/telecommunication providers, payment partners, and other APIs.
• From lawful public or business sources where permitted and relevant to providing the Services.

4. Purposes of processing

We process data reasonably necessary for purposes including:

• Creating and administering accounts, stores, roles, subscriptions, and billing.
• Providing CRM, visit, field-sales, calling, follow-up, segmentation, campaign, analytics, reporting, export, and collaboration features.
• Receiving authorised Meta leads and associating them with the correct workspace.
• Sending customer-authorised SMS, WhatsApp, call, email, or service communications through configured providers.
• Generating AI-assisted summaries, classifications, recommendations, and responses requested by an authorised user.
• Authenticating users, enforcing role/store scope, preventing unauthorised access, maintaining audit trails, and investigating abuse.
• Providing support, onboarding, training, notices, and responses to requests.
• Monitoring reliability, debugging, improving performance, and developing Services, using aggregated or de-identified data where reasonably possible.
• Meeting tax, accounting, contractual, regulatory, cybersecurity, litigation, and lawful-government-request obligations.
• Sending our own product marketing only where permitted and subject to available consent, preference, and unsubscribe controls.

5. Notice, consent, and lawful processing

Where consent is required, the relevant Data Fiduciary must provide a clear, standalone notice and obtain consent that is free, specific, informed, unconditional, unambiguous, and given through clear affirmative action. Consent must be limited to data necessary for the stated purpose.

A person may refuse optional data or withdraw consent using controls made available by the relevant business or by contacting us. Withdrawal does not affect prior lawful processing, but features may become unavailable where the data is necessary to provide them.

Where permitted, processing may also be based on performance of a lawful contract, compliance with law, voluntarily provided data used for the stated purpose, employment-related purposes, or another legitimate use specifically recognised by applicable law. We do not rely on a broad, undefined 'legitimate interest' where Indian law requires consent or a specific permitted use.

If we materially change a consent-based purpose, we will provide updated notice and obtain fresh consent where required.

6. Business-customer and outreach responsibilities

Subscribing businesses control who is contacted and what is sent through their workspaces. They must maintain valid consent or another lawful basis, honour opt-outs and DND preferences, use registered headers/templates and approved routes where required, and comply with the TRAI Telecom Commercial Communications Customer Preference Regulations, 2018, as amended, including applicable 2025 amendments and directions.

Customers must not use tribly.ai for unsolicited, deceptive, harassing, discriminatory, unlawful, or prohibited communications. Inferred consent must not be treated as indefinite; where it depends on a contractual relationship, customers must stop relying on it when that relationship ends. Customers are responsible for applicable Principal Entity, telemarketer, template, header, and consent registrations.

We may block, suppress, rate-limit, suspend, or preserve evidence of communications to honour an opt-out, protect recipients, investigate abuse, comply with provider rules, or meet legal obligations.

7. Sharing and service providers

We do not sell personal data or Platform Data and do not disclose it to data brokers. We may disclose only data reasonably necessary to:

• Cloud hosting, database, storage, content-delivery, monitoring, security, authentication, and support providers.
• Google when an authorised user invokes Gemini or another enabled Google feature.
• Meta when an authorised user connects a Page, manages a subscription, or receives Lead Ads data.
• SMS, WhatsApp, telecommunication, email, and campaign-delivery providers such as configured messaging gateways.
• Payment processors, invoicing systems, and professional advisers under appropriate confidentiality duties.
• A customer’s authorised users and connected systems according to workspace permissions.
• Courts, regulators, CERT-In, law-enforcement bodies, or authorities where lawfully required.
• A successor in a merger, financing, reorganisation, acquisition, insolvency, or asset transfer, subject to applicable notice/consent and continued protections.

8. Google services and Gemini

When an authorised user uses an AI feature powered by Gemini, we send the prompt and relevant context needed for the requested output to Google. Depending on the feature, context may include the user’s question, store names, aggregated/scoped metrics, feedback or notes, and system instructions. We do not send Meta access tokens or account passwords to Gemini.

Google’s treatment of Gemini API content depends on the service and billing tier. Under Google’s published terms, content submitted to unpaid Gemini services and generated responses may be used to provide, improve, and develop Google products and machine-learning technologies and may be human reviewed after account/project disassociation. Under qualifying paid services, Google states prompts and responses are not used to improve its products and are processed under applicable data-processing terms, though limited safety/abuse logging and lawful disclosures may occur. Users must not put unnecessary personal, sensitive, confidential, or regulated information into free-form AI prompts.

If tribly.ai requests Google Account data through Google OAuth or specified API scopes, we will identify the requested data and purpose at authorisation, request minimum permissions, and allow revocation through applicable account/integration controls.

Our use and transfer of information received from Google API Services will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google-scope data will be used only to provide or improve prominent user-facing features; it will not be sold, used for advertising, transferred to data brokers, used to determine creditworthiness, or read by humans except with affirmative permission or where needed for security, legal compliance, or permitted aggregated internal operations.

9. Meta Platform and Lead Ads data

The Meta integration requests permissions necessary to list authorised Pages, read basic Page engagement information, manage Page webhook subscriptions, and retrieve Lead Ads data. Current permissions may include pages_show_list, pages_read_engagement, pages_manage_metadata, and leads_retrieval. We do not request permission to publish social posts on a user’s behalf through this integration.

After authorisation, we may receive Page IDs/names, encrypted Page access tokens, webhook events, lead IDs/timestamps, lead form fields, and associated form, ad, ad-set, campaign, and platform metadata. We use this to connect the selected Page, receive requested leads, create/update workspace lead or customer records, assign work, prevent duplicates, report performance, maintain the integration, and provide support/security.

Meta Platform Data is processed only as described in this Policy, Meta’s Platform Terms, applicable product terms, and law. We do not sell it, use it for unrelated advertising, combine it for undisclosed profiling, or disclose it to another customer.

Disconnecting a Page stops future webhook collection after unsubscription. It may not delete lead/customer records already imported into the workspace because the subscribing business may need them for the consented purpose or legal records. The business or affected user may request deletion below.

10. AI-assisted processing

AI outputs may summarise operations, classify text, identify trends, or suggest actions. They are probabilistic, may be inaccurate, and are not legal, financial, employment, credit, health, or other professional decisions.

Authorised users must review outputs before acting. We do not intend AI features to make decisions producing legal or similarly significant effects about a person without appropriate human review. Customers must not use AI insights unlawfully, discriminatorily, or as the sole basis for sensitive decisions.

Where feasible, prompts are scoped, compressed, or aggregated and system instructions prohibit direct identifiers. User-entered text may nevertheless contain personal data, so users must minimise it.

11. Cross-border processing

Data may be stored or processed in India and other countries where our service providers, Google, Meta, messaging providers, or their subprocessors operate. Those countries may have different privacy laws.

For SPDI transfers, we require the recipient to provide the level of protection required by applicable Indian rules and limit transfers to those necessary for a lawful contract or otherwise validly consented to. Under the DPDP framework, transfers will be subject to any countries, conditions, or restrictions notified by the Government of India and any stricter sector-specific law.

We use contractual, organisational, encryption, access-control, and vendor-risk safeguards appropriate to the processing. Enabling an integration authorises transfers necessary to provide it, subject to required notice and consent.

12. Retention, deletion, and account closure

We retain data only while reasonably necessary for the disclosed purpose, customer instructions, security, disputes, enforcement, and legal obligations. Retention depends on data type, settings, contracts, and law.

Account/workspace data is generally retained while active. After termination or a verified request, it is deleted, returned, or de-identified according to the agreement and law. Residual encrypted backups may remain until ordinary rotation, generally up to ninety (90) days, unless legal preservation is required.

Billing, tax, corporate, consent, opt-out, complaint, and transaction records may be kept for statutory, audit, fraud-prevention, and evidentiary periods. Security/ICT logs are retained for at least the period required by CERT-In directions (currently a rolling 180 days for covered logs) and longer where necessary for investigation or law.

Meta OAuth sessions are short-lived; Page tokens are retained only while needed for an enabled integration and stored encrypted. Imported Platform Data is deleted or de-identified when required by Meta terms, law, a verified user/client request, or when no longer necessary, subject to documented legal retention.

Google/Gemini data is also subject to Google’s provider-side retention under the applicable tier and terms. Revoking permission stops future access but does not automatically erase data lawfully retained before revocation.

We may retain irreversible aggregated or de-identified information that can no longer be associated with a person.

13. Security and incident response

We maintain reasonable security practices and a documented security programme designed for the nature of the Services and information processed. No system is completely secure, and we cannot guarantee absolute security.

• TLS for data in transit and AES-256-GCM application-level encryption for configured PII and integration-token fields in production.
• Password hashing, secure sessions, role/store-scoped access, least privilege, and audit logging.
• Secrets management, environment separation, monitoring, backup/recovery, vulnerability remediation, and incident-response procedures.
• Personnel/contractor confidentiality duties, restricted production access, and appropriate provider obligations.
• Data minimisation, retention controls, and testing of relevant safeguards.

14. Individual rights and duties

Rights depend on the law in force, our role, and applicable exceptions. A person may request:

• Access to or a summary of applicable personal data and processing information.
• Correction of inaccurate/misleading data, completion of incomplete data, and updating of outdated data.
• Erasure where the purpose is complete or consent withdrawn, subject to lawful retention.
• Withdrawal of consent through a means reasonably comparable in ease to giving consent.
• Grievance redressal and escalation to the appropriate authority when legally available.
• Nomination of another person to exercise DPDP rights after death/incapacity once applicable provisions are in force.

15. Cookies and similar technologies

We use necessary cookies/similar storage to authenticate users, protect sessions, route requests, remember preferences, prevent abuse, and operate the Services. We may use analytics/performance technologies where enabled and permitted.

You may control cookies through browser/device settings and any consent tool we provide. Blocking necessary cookies may prevent login or core functionality. We do not permit advertising use of Google- or Meta-derived Platform Data.

16. Children and lawful guardians

The Services are intended for authorised business users aged eighteen (18) or older and are not directed to children. Customers must not knowingly create child profiles or use the Services to track or target children unless strictly necessary, lawful, within supported product design, and backed by verifiable parental consent where required.

We do not knowingly undertake behavioural monitoring of children or targeted advertising directed at children. Contact us if child data was submitted improperly so it can be restricted and deleted, subject to law.

17. Grievance redressal and complaints

Privacy complaints, consent withdrawal, correction, deletion, security, and rights requests may be sent to:

• Name: [Grievance Officer Name]
• Email: privacy@tribly.ai
• Phone: [+91-XXXXXXXXXX]
• Address: [Registered office address], India

18. Legal requests and government access

We may preserve, use, or disclose information where required by valid law, court order, regulatory direction, CERT-In request, or lawful process; to investigate fraud/security incidents; or to protect rights, safety, and the Services.

Where legally permitted, we review requests for facial validity and scope, disclose only information reasonably required, and may notify the affected customer.

19. Changes to this Policy

We may update this Policy for changes in law, regulatory commencement, provider terms, integrations, security practices, or the Services. We will post a revised date and provide prominent notice where required.

We will not rely solely on continued use as consent to a materially new purpose where fresh consent is required.

20. Contact us

Privacy, rights, consent, correction, and deletion: privacy@tribly.ai

General support: support@tribly.ai

Tribly Technologies Private Limited · [Registered office address], India