Privacy Policy

This Privacy Policy explains how Layap Infotech Private Limited (“Layap Infotech”, “we”, “us”) handles personal data in connection with i-Connect: our website at i-connect.world, the i-Connect application at app.i-connect.world, and the messaging services we provide to businesses. It is written to meet the Digital Personal Data Protection Act, 2023 (“DPDP Act”), the rules made under it, and the Information Technology Act, 2000.

1. Who we are

i-Connect is a product of Layap Infotech Private Limited, a company incorporated in India (CIN U72900HR2016PTC065513) with its registered office at 1071, Sector-47, Gurgaon, Haryana, India, 122001.

2. Our two roles

We handle personal data in two different capacities, and your rights depend on which one applies:

• As a Data Fiduciary for the people who visit our website, the people who sign up for and use i-Connect on behalf of a business (“users”), and the business contacts who correspond with us about sales, billing or support. We decide why and how this data is used, and this policy describes it in full.
• As a Data Processor for the businesses that use i-Connect (“customers”). When a customer uses i-Connect to message its own customers and leads (“contacts”), the customer is the Data Fiduciary for that data and decides why it is used. We process it only on the customer's instructions and under our agreement with them. See section 5.

3. What we collect

Website visitors

Our website does not use cookies, analytics or advertising trackers, and has no forms. Like any web server, ours records technical request data (IP address, browser user agent, page requested, time and referring page) in server logs, which we use only to keep the site secure and working.

Users of i-Connect

• Account data: name, work email address, password (stored only as a one-way hash), two-factor authentication settings, the organisations you belong to and your role in each.
• Usage and security data: sign-in times, IP addresses and devices, and an audit log of sensitive actions (for example, exports, role changes, broadcast launches and revealing a masked phone number).
• Communications: messages you send to our sales, support or privacy teams.

Customers (businesses)

• Business details: business name, address, GSTIN and billing contacts.
• Payment data: when online billing is available, payments are processed by Razorpay. We receive confirmation of payment and limited details (such as the last digits of a card), never full card numbers or bank credentials.
• WhatsApp Business Account details: account and phone number identifiers and the access credentials needed to send messages for you. Access tokens are encrypted and never shown again after you provide them.

4. How and why we use it

We do not sell personal data, use it for advertising, or build profiles of website visitors. We do not use contacts' data (section 5) for any purpose of our own.

5. Data we process for our customers

When a customer uses i-Connect, we store and process, on its behalf, the data of its contacts: phone numbers and WhatsApp identifiers, names and other fields the customer adds, tags, consent records (including the consent text shown and when and how consent was given or withdrawn), messages sent and received and their delivery status, form and WhatsApp Flow answers, the source of a lead (for example, a link or a form), and, where the customer uses those features, email addresses and the emails sent to them, orders, delivery addresses and bookings.

The customer decides what to collect and why, and is responsible for having a lawful basis, normally consent, to message its contacts. Our product enforces opt-outs and keeps marketing and service consent apart, but it is the customer's notice and consent that apply. We process contacts' data only to provide i-Connect to that customer, keep it separate from other customers' data, and delete or return it as the customer instructs and as our agreement requires.

If you received a WhatsApp message from a business that uses i-Connect: reply STOP to stop marketing messages from that business at any time. If you received an email, use the unsubscribe link at the bottom of it. For anything else about your data, contact the business first. If you can't reach them, write to privacy@i-connect.world with your phone number and the business's name and we will pass your request on and help where we can. See also our Data Deletion Instructions.

6. Who we share it with

We share personal data only with the service providers we need to run i-Connect, under contracts that require them to protect it:

Meta's handling of WhatsApp messages is also governed by Meta's own terms and policies, which customers accept when they create a WhatsApp Business Account. We may also disclose data when required by law, by a court or by a government authority acting under law, or to protect the rights, safety and security of our users, customers or the public. If our business is merged or sold, data may transfer to the new owner under the same protections.

7. Where data is stored

Our servers are hosted on Oracle Cloud Infrastructure. Some of our service providers, including Meta, process data outside India. Where data is transferred outside India, we do so in line with the DPDP Act and any restrictions notified by the Government of India.

8. How long we keep it

• Message content and form answers: for 180 days by default, or the period the customer sets between 30 and 730 days. After that the content is removed and only the record that a message was sent, its time and its status remain.
• Other account and customer data: for as long as the account is active. When a customer closes its account, we delete its data as described in our Data Deletion Instructions.
• Contact imports and exports: the files expire and are deleted automatically after a short period.
• Erased contacts: personal data is removed; a one-way hash of the phone number and of any email address is kept so the person is not contacted again by that business.
• Audit logs: for the period set by the customer's plan, then deleted automatically.
• Server logs: for a limited period for security, normally no longer than 30 days.
• Invoices and billing records: for as long as Indian tax and company law requires.

9. How we protect it

We use reasonable security safeguards, including encryption of WhatsApp access tokens and other secrets (AES-256-GCM), encryption of import and export files at rest, TLS for all traffic, password hashing (Argon2id), two-factor authentication, role-based access, number masking, audit logging, and automated tests that check one customer's data can't be reached by another. More detail is on our Security page. If we become aware of a personal data breach, we will notify affected customers without undue delay and the Data Protection Board of India and affected individuals as the law requires.

10. Your rights

Where we are the Data Fiduciary for your data, you have the right to:

• get a summary of the personal data we hold about you and how we use it, and the identities of those we have shared it with;
• have inaccurate or incomplete data corrected, completed or updated;
• have your data erased when it is no longer needed for the purpose it was collected for, unless the law requires us to keep it;
• withdraw consent at any time, as easily as you gave it (this does not affect processing that already happened);
• nominate another person to exercise your rights if you die or become unable to; and
• have a grievance addressed by our Grievance Officer, and if you are not satisfied, complain to the Data Protection Board of India.

To use any of these rights, write to privacy@i-connect.world from the email address on your account, or tell us how we can verify who you are. Users can also correct most account details in the app. If your data is held for a business that uses i-Connect, that business handles your request (section 5).

11. Cookies and analytics

The website sets no cookies and uses no analytics. If you choose a light or dark theme, that choice is saved in your browser's local storage and never sent to us. The i-Connect application uses a single essential cookie to keep you signed in securely; it is not used for tracking.

12. Children

i-Connect is a business service and is not meant for children. We do not knowingly collect personal data from anyone under 18 as a user. Customers must not use i-Connect to message children without verifiable consent from a parent or lawful guardian as the law requires.

13. Changes to this policy

We may update this policy. We will change the “Last updated” date above, and for significant changes we will tell customers by email or in the app before they take effect.

15. Contact us

Privacy questions: privacy@i-connect.world. Grievances: dpo@i-connect.world. Post: Layap Infotech Private Limited, 1071, Sector-47, Gurgaon, Haryana, India, 122001.