Privacy Policy

1. Who we are

Sunaam (“Sunaam”, “we”, “us”) is operated by Teknesya Networks Pvt Ltd, a company incorporated in India (the “Data Fiduciary”). We provide an AI-powered reputation and local-presence platform for Indian small businesses.

This policy explains what personal data we collect, why, how we protect it, and the rights you have under the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and its rules.

2. The data we collect

• Account data: your name, phone number and/or email address, and (if you sign in with Google, or created your account with Facebook before we stopped offering it) your basic profile and email from that provider.
• Business data: details of your business, and information from connected services such as your Google Business Profile (listing details, reviews and ratings) and social accounts you choose to link.
• Customer data you provide: contacts you add or push via our API to send customer messages - names and phone numbers. Phone numbers are encrypted and consent is recorded. For this data your business is the Data Fiduciary and Sunaam acts as a Data Processor on your instructions.
• Payment data: subscription and billing status. Card/UPI details are handled by our payment processor (Razorpay); we do not store them.
• Technical data: limited logs and diagnostics. We scrub personal information from logs and do not sell any personal data.
• Reviewer data: if you sign in with Google to write a review of a business in the Sunaam directory, we keep your name (shown on your reviews as first name and surname initial, which you can change), your email address (encrypted, and used only to tell you about replies to your reviews and our moderation decisions), a hashed form of your Google account ID, and your reviews. You can delete any review, or everything, from sunaam.io/my-reviews.
• Signup attribution: if you reached us from a link carrying campaign tags (for example utm_source, or a Google or Facebook click identifier), we record those tags, the referring website and the first page you opened, and attach them to your account once - the first time only. This tells us which of our own campaigns brought a business to Sunaam. It is not used to profile you, is never combined with your customers’ data, and is not shared with advertising networks.

3. Why we process it (purposes)

• To provide the service: manage reviews, draft AI replies, manage your Google listing, send customer messages, publish posts and improve local visibility.
• To operate your account, provide support, and secure the platform against abuse.
• To process subscriptions and payments.
• To understand which of our own marketing efforts bring businesses to Sunaam, using the signup attribution described above.
• To comply with legal obligations.

4. Consent and lawful basis

We process personal data on the basis of your consent and for the legitimate uses permitted under the DPDP Act. Where consent is required, we ask for it clearly before processing, and you may withdraw it at any time - withdrawal is as easy as giving consent and does not affect processing already carried out.

You are responsible for obtaining valid consent from your own customers before adding their contact details to Sunaam, and every customer message you send includes an easy way for them to opt out (for example, replying STOP).

5. Your rights as a Data Principal

Under the DPDP Act you may:

• Access a summary of the personal data we process about you and how.
• Correct, complete, update or erase your personal data.
• Withdraw consent, and have your data erased when it is no longer needed.
• Nominate another individual to exercise your rights in the event of your death or incapacity.
• Raise a grievance and have it addressed (see “Grievance Officer” below).

6. Data retention and deletion

We keep personal data only for as long as your account is active or as needed to provide the service and meet legal requirements. You can ask us to delete your account at any time; deleting a customer record purges that person’s personal details from our systems (a tombstone may be kept to prevent re-processing).

Signup attribution is stored once, at the point your account is created, and is never updated afterwards. It is deleted with your account.

7. Who we share data with (processors)

We share personal data only with service providers who help us run Sunaam, under appropriate safeguards, and only as needed:

• Microsoft Azure - hosting, database and storage (India region).
• Google - Business Profile and “Sign in with Google”.
• Meta - Instagram/Facebook publishing where you enable it, and the profile from Facebook sign-in for accounts created with it before it was retired.
• Resend - sending sign-in and notification emails.
• Azure OpenAI - generating AI reply drafts and captions (see cross-border note below).
• Razorpay - payment processing.
• PostHog - product analytics: which screens are used and which features are reached. Hosted in the United States (see the cross-border note below).
• Meta - the Meta (Facebook) pixel on our public website and signup, which tells us whether people who arrive from our Facebook and Instagram adverts go on to create an account or subscribe. It is not used inside the app you sign in to, and never on a review or reward link you open as someone else’s customer.
• A WhatsApp Business Solution Provider - sending WhatsApp messages you initiate.

8. Google Business Profile data (Google API content)

When you connect your Google Business Profile, Sunaam accesses content through Google’s Business Profile APIs - for example your listing details, reviews and ratings - only to provide the features you use: showing your reviews, drafting replies for your approval, and managing your profile at your request. Nothing is published to Google without your explicit approval.

Content retrieved through Google’s APIs is stored only where necessary to operate and improve the service. Such API content is stored securely and temporarily, for no longer than 30 calendar days, unless a shorter period applies. Live content is refreshed within this window; anything Google no longer serves is removed automatically by our scheduled deletion jobs.

You can disconnect your Google Business Profile at any time from Settings → Connected accounts. When you disconnect, Sunaam immediately stops retrieving and publishing information, revokes its access at Google, and deletes the Google content it holds for your business. This retention is enforced by our database and deletion jobs - it is not only a statement of policy.

Sunaam is an independent service and is not affiliated with, sponsored by or endorsed by Google. Google Business Profile is available directly from Google at no charge; Sunaam charges only for its own software, AI drafting, alerts and management tools.

9. Cross-border processing

Your account and business data are hosted in India. AI drafting is performed by Azure OpenAI, which we currently operate in a United States Azure region because the service is not yet offered in an Indian region. Review text sent for drafting is therefore processed outside India. The DPDP Act permits such transfers except to countries the Government of India may restrict. We will move AI processing to an Indian region when available.

10. How we protect your data

• Application-level encryption of sensitive personal data such as customer phone numbers, on top of encrypted storage.
• India-region hosting for your account and business data, with access controls and least-privilege access.
• We do not log personal information; logs are scrubbed.
• Idempotent, human-in-the-loop workflows so nothing is published on your behalf without approval.

11. Children’s data

Sunaam is a business tool intended for users aged 18 and over. We do not knowingly process the personal data of children without verifiable parental consent, and we do not carry out tracking or targeted advertising directed at children.

12. Cookies and local storage

We use minimal, first-party storage - for example, keeping your sign-in token in your browser so you stay logged in.

If you arrive from a tagged link, your browser also keeps the campaign tags and referring site until you create an account, at which point they are recorded once against that account and cleared from your browser. If you never sign up, they stay in your browser and never reach us at all.

We use PostHog, a product-analytics service, to understand which parts of Sunaam are used. It sets its own first-party storage in your browser. It is not an advertising network, we do not sell what it records, and it is not used to follow you around other websites.

Analytics identities are only created for people who sign in. Someone who simply opens a review or reward link - a customer of one of our businesses - is counted, not profiled.

Our public website and signup pages carry the Meta (Facebook) pixel, which is an advertising cookie. It lets Meta tell us how many people who clicked one of our adverts signed up, so we can stop paying for adverts that do not work, and Meta may use it to show you Sunaam adverts elsewhere. It records page views and two things you do - creating an account, and starting or completing a subscription - never your customers’ data, your reviews or anything you write in Sunaam.

The pixel is not loaded on the review and reward pages your own customers open. Somebody scanning a QR code on your counter is not advertised to by us.

You can refuse it: browser tracking protection, an ad blocker, or “Off-Facebook activity” in your Meta account settings all stop it, and nothing in Sunaam works any differently without it.

13. Grievance Officer

If you have any question, request or complaint about your personal data, contact our Grievance Officer:

Grievance Officer: Rohit Kundu, Teknesya Networks Pvt Ltd - Rohit@sunaam.io. We aim to acknowledge and resolve grievances within the timelines prescribed under the DPDP Act.

14. Changes to this policy

We may update this policy from time to time. Material changes will be notified in the app or by email. The “last updated” date below always reflects the current version.