Your customers' data and privacy
Learn what your website collects and why, how the automatic Privacy and Terms pages work, and how to handle a customer's request to see or delete their data.
Your website collects some details from customers so you can reply to them. This guide explains what is collected, how long it is kept, and what you should do when a customer asks about their data. It is for owners, takes about 5 minutes to read, and needs no setup.
What your website collects and why
| When | What is kept | Why |
|---|---|---|
| A visitor sends the enquiry form | Name, phone and/or email, the message, and the page it was sent from | So you can reply. It becomes a lead and a contact. |
| A visitor books online | The same details plus the service, date, time and any note | To confirm and manage the booking and send reminders |
| A visitor uses the chat | The chat messages, and any name, phone or email they share | To answer them, and so you can follow up |
| Someone messages you on two-way WhatsApp | Their WhatsApp number, profile name and messages | To answer them in the Inbox |
| Every page view, tap, enquiry, booking and chat | The visitor's IP address (the number their phone or computer uses on the internet), their approximate place (city, state and country, worked out from the IP address) and their browser and device, for example Chrome on an Android phone | To see where visitors come from and to stop spam. You and the platform team can see them. |
| Every visit | Pages viewed and taps on Call, WhatsApp and Directions, where the visit came from (site name only), campaign tags, phone or computer, and language | To show you visitor numbers |
Visitor numbers are counted without cookies. Each browser tab gets a random visit number, which is forgotten when the tab is closed and renewed after 30 minutes without activity. When someone sends a message, books or leaves their number, you see which pages they looked at during that visit, so you understand what they were interested in.
Clean-up after 90 days: a daily clean-up removes the visit number, the referring site, the campaign tags and the IP address from visits, leads and change-log entries older than 90 days. The city, country and browser stay with the totals.
The place is worked out on the platform's own servers from a free database, "IP geolocation by DB-IP" (https://db-ip.com); the IP address is not sent to any other service for this. It is approximate: often the nearest big city, or the city of the visitor's mobile network. The privacy notice credits the database, as its licence asks.
Your website does not use advertising or tracking cookies. Cookies are only used when you and your staff sign in.
The Privacy and Terms pages
Every business website has two pages that are made for you automatically:
- Privacy notice at
https://<your-business>.vadodara.biz/privacy - Terms of use at
https://<your-business>.vadodara.biz/terms
They are linked as Privacy and Terms in the footer of every page, and the enquiry form, booking form and chat point to them.
You do not write these pages. They are built from what your site actually does, so they stay correct when you switch features on or off. For example:
- the booking part appears only when Accept online bookings is on, with your own cancellation cut-off;
- the chat part appears only when the chat button is on, and names the AI service if the AI assistant answers;
- WhatsApp, email, Telegram alerts and phone notifications are listed only if they are used;
- your business email and phone (from Businesses → Contact) are shown as the contact for questions.
The terms say that Indian law applies and the courts in Vadodara have jurisdiction. The privacy notice explains your customers' rights under India's Digital Personal Data Protection Act, 2023.
Good to know: These pages are a solid starting point, not legal advice. If your business has special needs (for example a clinic with health details), have them reviewed and talk to the platform team.
When a customer asks to see or delete their data
Customers can ask you what you hold about them, or ask you to correct or delete it. The privacy notice tells them to contact you.
- Note the request: the customer's name, and the phone number or email they used with you.
- To correct something, such as a wrong phone number, change it yourself in the website editor (CRM → Contacts).
- To see everything or delete everything, send the request to the platform team with the phone number or email. Do not post it in a public group.
- The platform team finds everything linked to that phone or email in your business only: the contact, leads, timeline, enquiries, bookings, chats and WhatsApp messages. They can export it for you to send to the customer, or erase it.
- Tell the customer when it is done.
Reply to these requests quickly. There is no button for a full export or erase in the editor or app; the platform team does it for you.
Backups
Your data is backed up every night. Backups are kept for up to 6 months and then deleted automatically. This means a deleted record can still exist in an older backup for up to 6 months, which the privacy notice also says.
When the platform team has switched on backup encryption, the backups are encrypted and can only be opened with a key that is kept off the server. Your privacy notice then says "Encrypted backups"; otherwise it just says "Backups", so it never claims more than is true.
Your responsibilities
You decide how your customers' details are used, so please:
- use customer details only to answer and serve them, never to sell or share them;
- never ask customers to send passwords, card numbers or OTPs in the chat, the form or WhatsApp. The chat itself warns visitors not to share passwords or payment details;
- never put such details into a lead note or the timeline yourself;
- give staff their own account, and remove access when they leave (see Adding staff);
- turn on two-step verification for your own account (see Signing in);
- sign out on shared computers;
- delete leads and contacts you no longer need;
- pass data requests to the platform team promptly.