Short version: We collect the minimum data needed to run your Smartly Craft workspace, never sell it, store it in the region you pick, share it only with the sub-processors listed below, and let you export or delete it any time. The long version follows.
This Privacy Policy explains how Webetron Solutions Pvt. Ltd. (operating "Smartly Craft") collects, uses, discloses and protects information when you visit our websites, sign up for an account, or use our software. It applies to personal data we process as a controller (e.g. for prospects, visitors, contacts of customers) and outlines our role as a processor for end-user data that flows through your workspace.
1. Scope & roles
We act as a data controller for personal data about people who visit our marketing site, attend our events, subscribe to our newsletter, apply for jobs or administer a Smartly Craft workspace (e.g. workspace owners and seats). We act as a data processor for personal data about your end users (your customers, contacts and visitors) that you submit to or process through the Service. This Policy covers both roles; your relationship as a customer is also governed by our Terms of Service and Data Processing Addendum (DPA).
2. Data we collect
2.1 Account & billing data. Name, work email, phone, company, role, country, password hashes, billing address, GSTIN/VAT, last-four payment digits (we never store full card numbers — those live with our PCI-DSS payment partners).
2.2 Workspace content. Catalog data, knowledge-base documents, templates, automations, segments, tags, and configuration you create.
2.3 Conversation data (processor role). Messages, contacts, media, profile metadata and message statuses exchanged through your connected WhatsApp Business, Instagram, web widget and other channels.
2.4 Usage telemetry. Pages visited, features used, performance traces, error logs, IP address, browser, device type and timestamps. Used to improve reliability and detect abuse.
2.5 Marketing & sales data. Form submissions, demo requests, event attendance, communications you exchange with our team, and limited enrichment data (firmographics) from reputable B2B sources.
2.6 Sensitive categories. We do not knowingly process special-category personal data (health, biometrics, political views, etc.) or data of children under 16. Do not submit such data to the Service unless covered by a written addendum.
3. Where we get it
Directly from you (sign-up, forms, in-app actions), automatically (cookies, SDKs, server logs), from your end users (messages they send your workspace), and from partners (channel providers like Meta, payment processors, enrichment vendors, single-sign-on identity providers).
4. How we use personal data & legal bases
We process personal data only where we have a lawful basis under the GDPR, the UK GDPR, the DPDP Act 2023 and analogous laws:
- To perform our contract with you — provisioning accounts, routing messages, billing, support.
- Legitimate interests — securing the Service, preventing fraud and abuse, product analytics, direct B2B marketing to existing customers (with opt-out).
- Consent — optional cookies, marketing emails to prospects, public testimonials, and any feature requiring explicit consent.
- Legal obligation — tax records, lawful requests from authorities, anti-money-laundering checks.
We do not sell personal data, do not share it for cross-context behavioural advertising, and do not use Customer Data to train shared or foundation AI models.
5. AI processing
Hybrid-NLP requests run on Smartly Craft infrastructure within your selected data residency region. When advanced reasoning is needed, we may route prompts to vetted LLM providers (e.g. OpenAI, Anthropic, Google) under enterprise contracts that contractually prohibit training on your data and enforce zero-retention or short-retention windows (typically 24 hours for abuse monitoring only). End-user identifiers are stripped or pseudonymised before transmission wherever possible. You may disable third-party LLM routing from workspace settings.
7. Data residency, retention & deletion
Residency. You select your primary region at sign-up: Mumbai (default), Singapore, Frankfurt or Virginia. Backups remain in-region; cross-region replication is opt-in.
Retention. Account data is retained for the life of your subscription. Conversation data is retained per your workspace's configured policy (default 24 months). Telemetry and security logs are kept for 12 months. Billing records are kept for 8 years to meet Indian tax law.
Deletion. You may delete individual contacts or messages at any time. On account closure or written request, we delete or anonymise personal data within 30 days, including from backups in the next backup-rotation cycle (max 90 days). Some pseudonymised security logs may be retained where required by law.
8. International transfers
Where personal data leaves the EEA, UK or India, we rely on appropriate safeguards including the European Commission's Standard Contractual Clauses (2021), the UK International Data Transfer Addendum, and India-specific contractual safeguards under the DPDP Act 2023. A copy of these safeguards is available from dpo@smartlycraft.com.
9. Security
We protect data with TLS 1.2+ in transit, AES-256 at rest, strict role-based access controls, mandatory 2FA for staff, principle-of-least-privilege production access, continuous vulnerability scanning, annual penetration tests, and SOC 2 Type II aligned controls (report under NDA). A detailed overview is at /security. We will notify affected customers without undue delay (and within 72 hours where required) of any personal-data breach that poses a meaningful risk.
10. Your privacy rights
Depending on where you live, you have the right to (a) access the personal data we hold about you, (b) correct inaccuracies, (c) request deletion, (d) restrict or object to processing, (e) data portability, (f) withdraw consent, and (g) lodge a complaint with your supervisory authority. For workspace end users, please reach out to the workspace owner first — Smartly Craft processes data on their behalf. To exercise any right against Smartly Craft as a controller, email dpo@smartlycraft.com. We respond within 30 days (extendable by 60 days for complex requests) and do not charge unless requests are excessive.
12. Marketing communications
We send product, security and onboarding emails to all customers — these are transactional and cannot be opted out of while you have an active account. We send marketing emails only to people who opted in or to existing customers with a clear unsubscribe link in every message. You can also email dpo@smartlycraft.com to stop all marketing communications.
13. Children
Our Service is intended for businesses. We do not knowingly collect personal data from children under 16. If you believe a child has provided personal data, contact us and we will delete it.
14. Changes to this Policy
We may update this Policy from time to time. The "Effective" date at the top reflects the latest revision. For material changes, we notify account owners by email at least 30 days before they take effect. Continued use after the effective date constitutes acceptance.
15. Contact us
Data Controller: Webetron Solutions Pvt. Ltd., BKC, Bandra East, Mumbai, Maharashtra 400051, India.
Data Protection Officer: dpo@smartlycraft.com
EU representative (Art. 27 GDPR): SmartlyCraft EU OU, Tallinn, Estonia.
UK representative: available on request.
For grievances under the Indian DPDP Act 2023, you may also write to our Grievance Officer at the address above; we respond within 30 days.