Privacy Policy

1. Who we are

Sunaam (“Sunaam”, “we”, “us”) is operated by Teknesya Networks Pvt Ltd, a company incorporated in India (the “Data Fiduciary”). We provide an AI-powered reputation and local-presence platform for Indian small businesses.

This policy explains what personal data we collect, why, how we protect it, and the rights you have under the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and its rules.

2. The data we collect

• Account data: your name, phone number and/or email address, and (if you sign in with Google or Facebook) your basic profile and email from that provider.
• Business data: details of your business, and information from connected services such as your Google Business Profile (listing details, reviews and ratings) and social accounts you choose to link.
• Customer data you provide: contacts you add or push via our API to send customer messages - names and phone numbers. Phone numbers are encrypted and consent is recorded. For this data your business is the Data Fiduciary and Sunaam acts as a Data Processor on your instructions.
• Payment data: subscription and billing status. Card/UPI details are handled by our payment processor (Razorpay); we do not store them.
• Technical data: limited logs and diagnostics. We scrub personal information from logs and do not sell any personal data.
• Signup attribution: if you reached us from a link carrying campaign tags (for example utm_source, or a Google or Facebook click identifier), we record those tags, the referring website and the first page you opened, and attach them to your account once - the first time only. This tells us which of our own campaigns brought a business to Sunaam. It is not used to profile you, is never combined with your customers’ data, and is not shared with advertising networks.

3. Why we process it (purposes)

• To provide the service: manage reviews, draft AI replies, manage your Google listing, send customer messages, publish posts and improve local visibility.
• To operate your account, provide support, and secure the platform against abuse.
• To process subscriptions and payments.
• To understand which of our own marketing efforts bring businesses to Sunaam, using the signup attribution described above.
• To comply with legal obligations.

4. Consent and lawful basis

We process personal data on the basis of your consent and for the legitimate uses permitted under the DPDP Act. Where consent is required, we ask for it clearly before processing, and you may withdraw it at any time - withdrawal is as easy as giving consent and does not affect processing already carried out.

You are responsible for obtaining valid consent from your own customers before adding their contact details to Sunaam, and every customer message you send includes an easy way for them to opt out (for example, replying STOP).

5. Your rights as a Data Principal

Under the DPDP Act you may:

• Access a summary of the personal data we process about you and how.
• Correct, complete, update or erase your personal data.
• Withdraw consent, and have your data erased when it is no longer needed.
• Nominate another individual to exercise your rights in the event of your death or incapacity.
• Raise a grievance and have it addressed (see “Grievance Officer” below).

6. Data retention and deletion

We keep personal data only for as long as your account is active or as needed to provide the service and meet legal requirements. You can ask us to delete your account at any time; deleting a customer record purges that person’s personal details from our systems (a tombstone may be kept to prevent re-processing).

Signup attribution is stored once, at the point your account is created, and is never updated afterwards. It is deleted with your account.

7. Who we share data with (processors)

We share personal data only with service providers who help us run Sunaam, under appropriate safeguards, and only as needed:

• Microsoft Azure - hosting, database and storage (India region).
• Google - Business Profile and “Sign in with Google”.
• Meta - “Sign in with Facebook” and (where enabled) Instagram/Facebook publishing.
• Resend - sending sign-in and notification emails.
• Azure OpenAI - generating AI reply drafts and captions (see cross-border note below).
• Razorpay - payment processing.
• PostHog - product analytics: which screens are used and which features are reached. Hosted in the United States (see the cross-border note below).
• A WhatsApp Business Solution Provider - sending WhatsApp messages you initiate.

8. Google Business Profile data (Google API content)

When you connect your Google Business Profile, Sunaam accesses content through Google’s Business Profile APIs - for example your listing details, reviews and ratings - only to provide the features you use: showing your reviews, drafting replies for your approval, and managing your profile at your request. Nothing is published to Google without your explicit approval.

Content retrieved through Google’s APIs is stored only where necessary to operate and improve the service. Such API content is stored securely and temporarily, for no longer than 30 calendar days, unless a shorter period applies. Live content is refreshed within this window; anything Google no longer serves is removed automatically by our scheduled deletion jobs.

You can disconnect your Google Business Profile at any time from Settings → Connected accounts. When you disconnect, Sunaam immediately stops retrieving and publishing information, revokes its access at Google, and deletes the Google content it holds for your business. This retention is enforced by our database and deletion jobs - it is not only a statement of policy.

Sunaam is an independent service and is not affiliated with, sponsored by or endorsed by Google. Google Business Profile is available directly from Google at no charge; Sunaam charges only for its own software, AI drafting, alerts and management tools.

9. Cross-border processing

Your account and business data are hosted in India. AI drafting is performed by Azure OpenAI, which we currently operate in a United States Azure region because the service is not yet offered in an Indian region. Review text sent for drafting is therefore processed outside India. The DPDP Act permits such transfers except to countries the Government of India may restrict. We will move AI processing to an Indian region when available.

10. How we protect your data

• Application-level encryption of sensitive personal data such as customer phone numbers, on top of encrypted storage.
• India-region hosting for your account and business data, with access controls and least-privilege access.
• We do not log personal information; logs are scrubbed.
• Idempotent, human-in-the-loop workflows so nothing is published on your behalf without approval.

11. Children’s data

Sunaam is a business tool intended for users aged 18 and over. We do not knowingly process the personal data of children without verifiable parental consent, and we do not carry out tracking or targeted advertising directed at children.

12. Cookies and local storage

We use minimal, first-party storage - for example, keeping your sign-in token in your browser so you stay logged in.

If you arrive from a tagged link, your browser also keeps the campaign tags and referring site until you create an account, at which point they are recorded once against that account and cleared from your browser. If you never sign up, they stay in your browser and never reach us at all.

We use PostHog, a product-analytics service, to understand which parts of Sunaam are used. It sets its own first-party storage in your browser. It is not an advertising network, we do not sell what it records, and it is not used to follow you around other websites.

Analytics identities are only created for people who sign in. Someone who simply opens a review or reward link - a customer of one of our businesses - is counted, not profiled.

We do not use third-party advertising cookies, and we do not track you across other websites.

13. Grievance Officer

If you have any question, request or complaint about your personal data, contact our Grievance Officer:

Grievance Officer, Teknesya Networks Pvt Ltd - grievance@sunaam.io. We aim to acknowledge and resolve grievances within the timelines prescribed under the DPDP Act.

14. Changes to this policy

We may update this policy from time to time. Material changes will be notified in the app or by email. The “last updated” date below always reflects the current version.