Privacy Policy

This Privacy Policy explains how Thinkbix Technologies Private Limited (CIN U62099PN2025PTC238489), the company that runs MotherBot, with its registered office at Baner Business Bay, Baner, Pune, Maharashtra 411045, India (“MotherBot”, “we”, “us”), handles personal data. It covers our website, the MotherBot web app, the MotherBot mobile app, the MotherBot Chrome extension, our plugins and extensions for other software, and our APIs (together, the “Services”).

It is written to meet the Digital Personal Data Protection Act, 2023 (the “DPDP Act”) and the Digital Personal Data Protection Rules, 2025, the Information Technology Act, 2000 and the rules made under it. If you are in the European Union or the United Kingdom, our GDPR page adds to this policy.

You can ask us for this policy in English or in any language listed in the Eighth Schedule to the Constitution of India. Write to hello@motherbot.io.

1. Our two roles

We handle personal data in two different roles, and your rights depend on which one applies.

• We decide how your data is used (a “Data Fiduciary” under the DPDP Act) for the people who sign up for and use MotherBot, the team members they invite, our partners, and visitors to our website. Most of this policy is about this role.
• We process data on a business’s instructions (a “Data Processor”) for the customers and contacts of the businesses that use MotherBot: the people they message, call, chat with or keep in their contact lists. For this data, the business is the Data Fiduciary and decides why and how it is used. Our Data Processing Addendum is the contract that binds us to their instructions.

2. Personal data we collect

2.1 When you create and use an account

• Account details: your name, email address, mobile number, password (stored only as a one-way hash, never in readable form), profile photo, and your organisation’s name.
• Business and billing details: billing name and address, GSTIN and state (for GST invoices), plan, invoices and payment history.
• Payment details: payments are taken by Razorpay. We receive a payment reference and status. We never see or store your full card number, CVV, UPI PIN or net-banking password.
• Sign-in details: if you sign in with Google, the name, email and profile photo Google shares with us. If you turn on two-step verification, the settings for it.
• Connected accounts: when you connect WhatsApp, Instagram, Facebook or another channel, the account identifiers, phone numbers, display names and access tokens needed to send and receive on your behalf. Access tokens are never shown back to anyone, and are only used to provide the Services.
• What you tell us: messages to our support team (support chats are deleted automatically after 48 hours), emails, feedback and survey answers.

2.2 Automatically, when you use the Services

• Device and log data: IP address, browser and device type, operating system, app version, time of each request, and the pages and features used. We use it to keep the Services secure, investigate problems and meet our legal duties.
• Activity records: who in your team did what, and when (for example, who sent a broadcast or changed a setting), so you can audit your own workspace.
• Cookies: only the ones needed to sign you in, keep you signed in safely, and remember your cookie choice. See our Cookie Policy.

2.3 The MotherBot mobile app

• Notifications: a push token from Apple or Google, so we can alert you to new chats and calls.
• Camera, photos and microphone: used only when you choose to send a photo, document or voice note, or to take a WhatsApp call. We don’t access them in the background.
• Contacts: read only if you choose to import contacts from your phone, and only the contacts you pick are uploaded.
• Face ID or fingerprint: checked by your phone. Your biometric data never leaves your device and we never receive it.

2.4 The MotherBot Chrome extension

• If you allow it, the extension shows a small MotherBot button next to phone numbers on the websites you visit. It looks for phone numbers inside your own browser. It never sends the content of the page to us or anyone else.
• When you click the button, or select a number and use the right-click menu, only that number is used, to open the message box.
• When you send a message from the extension, we record the website’s name (for example, example.com), never the full page address, so it shows in your send history. You can turn this off in the extension’s settings.
• Your access token and server address are stored only on your computer. Your extension preferences are synced by Chrome to your Google account if you use Chrome sync. If you turn on “Remember numbers I recently messaged” (off by default), the last 10 numbers are kept on your computer only.

2.5 From other people

• Meta, when you connect a WhatsApp Business account through Meta’s sign-up (business name, account and phone number identifiers).
• A MotherBot partner who referred you or set up your account.
• Your organisation’s administrator, if they invited you as a team member.

2.6 Data businesses put into MotherBot (“Customer Data”)

Businesses use MotherBot to hold and process their own customers’ data: names, phone numbers, email addresses, tags, notes and custom fields; the messages, photos, documents and voice notes exchanged; call details; answers given to chatbots and forms; orders, appointments, quotations and payment status. We process this only to provide the Services to that business, as described in section 1 and in our Data Processing Addendum.

3. Why we use it, and on what basis

Under the DPDP Act we use personal data only with your consent or for a “legitimate use” the Act allows. For each purpose:

You can withdraw your consent at any time, as easily as you gave it (section 10). Withdrawing doesn’t affect anything done before. If you withdraw consent needed to run your account, we will have to stop providing the Services to you.

4. What we never do

• We do not sell personal data, and we don’t share it with advertisers or data brokers.
• We do not read your conversations except when you ask us to (for example, for support), when needed to investigate abuse or a security problem, or when the law requires it.
• We do not use your data or your customers’ messages to train artificial intelligence models.
• We do not use Customer Data for our own marketing.

5. Automatic checks

To protect your WhatsApp number from being blocked, MotherBot can automatically hold or slow sends that look risky, for example sending too fast or to many numbers that have opted out. You can see these checks, and switch some of them off, in your settings. They never make decisions about your customers as individuals.

6. Messages we send you

• Service messages, by email, WhatsApp or in the app: sign-in codes, security alerts, invoices, payment problems, renewal reminders, and important changes to the Services or these policies. These are part of the service and can’t be turned off while you have an account.
• Onboarding tips and product news, by email or WhatsApp. To stop them, write to hello@motherbot.io from the email address on your account. We will stop within 10 working days.

7. Who we share data with

7.1 Service providers who work for us

These companies process personal data only on our instructions, under contracts that require them to keep it secure and confidential:

7.2 Services you choose to connect

When you connect another service to MotherBot, such as an AI provider (OpenAI, Google Gemini, Anthropic or others), a CRM (Zoho, Salesforce, HubSpot), Google Sheets, Shopify, a payment gateway, a data-enrichment service such as Explorium, or another app, the data you choose to send to it goes to that service. That service handles it under its own privacy policy, and usually under your own account with it. Check its policy before you connect it. You can disconnect it at any time from Integrations.

Messages and calls on WhatsApp, Instagram and Messenger travel through Meta, which handles them under Meta’s own terms and privacy policy.

7.3 Others

• Your team and partners: people in your organisation see the data your administrator allows them to. A MotherBot partner sees your workspace only if you or your administrator gave them access.
• Authorities: government agencies, courts, CERT-In and other authorities, when Indian law requires it, for example under the IT Act, the DPDP Act or a court order. Where the law allows, we will tell you first.
• A buyer of our business: if MotherBot or our company is merged or sold, personal data may pass to the new owner, who must keep to this policy. We will tell you before that happens.
• Anyone else: only with your consent.

8. Where your data is stored

• Our main database, which holds your account, contacts and messages, is in India (Mumbai).
• Our application servers, which process requests as they happen, are in Singapore.
• Media files and documents are stored with Cloudflare R2, on Cloudflare’s global network.
• Messages on WhatsApp, Instagram and Messenger pass through Meta’s data centres around the world.

The DPDP Act allows personal data to be transferred outside India, except to countries the Central Government restricts by notification. We will not transfer personal data to any restricted country. Every provider outside India is bound by a contract to keep the data secure.

9. How long we keep it

When the purpose for which we hold personal data is over, and no law requires us to keep it, we delete it or make it permanently anonymous.

10. Your rights

Under the DPDP Act, you have the right to:

• Know what personal data we hold about you, how we use it, and who we have shared it with.
• Correct, complete or update it. Most of it you can change yourself in Settings.
• Erase it, unless the law requires us to keep it. You can delete your whole account yourself in Settings → Security → Delete account, on the web or in the mobile app.
• Withdraw consent, as easily as you gave it.
• Nominate someone to exercise these rights for you if you die or become unable to.
• Complain to our Grievance Officer, and if you’re not satisfied, to the Data Protection Board of India.

You can also give, manage and withdraw consent through a Consent Manager registered with the Data Protection Board, once such services are available.

How to ask: write to hello@motherbot.io from the email address on your account, saying which right you want to use. We may ask you to confirm it’s you. It’s free. We will reply as soon as we can, and within 30 days. If we can’t do what you ask, we will explain why and tell you how to complain.

Your duties under the DPDP Act: give us true information, don’t impersonate anyone, and don’t file false or frivolous complaints.

Outside India: if you are in the EU or UK, see our GDPR page for your extra rights. If you are a California resident, you may ask to know, correct or delete your personal information; we do not sell or share it for cross-context advertising, and we won’t treat you differently for asking.

11. How we protect it

• All connections to MotherBot are encrypted (HTTPS/TLS). Our database and file storage are encrypted at rest.
• Passwords are stored only as one-way hashes. Access tokens for the extension and plugins are stored as hashes, so even we can’t read them back.
• Two-step verification is available for every account, and team members only see what their role allows.
• Only staff who need it can reach production systems, and that access is recorded.
• Card payments are handled entirely by Razorpay, which is PCI-DSS certified.

These practices are intended to meet the “reasonable security practices” required by section 43A of the IT Act and the DPDP Act. No system is perfectly secure, so please use a strong password and turn on two-step verification.

If something goes wrong: if a personal data breach affects you, we will tell you without delay, in plain language: what happened, what it may mean for you, what we are doing, and what you can do. We will also report it to the Data Protection Board of India and to CERT-In within the time the law sets. To report a security problem, write to hello@motherbot.io.

12. Children

MotherBot is for businesses and is not meant for anyone under 18. We don’t knowingly collect personal data from children. If you believe a child has given us personal data, write to our Grievance Officer and we will delete it.

Businesses that use MotherBot must not use it to process the personal data of children without verifiable consent from a parent or guardian, or to track, monitor or target advertising at children, as the DPDP Act forbids.

13. Changes to this policy

If we make a significant change, we will tell you by email or in the app at least 14 days before it takes effect, unless a law requires a faster change. The date at the top shows when this policy was last updated.

14. Grievance Officer and contact

Under the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and the DPDP Act, our Grievance Officer handles complaints and questions about your personal data:

• Grievance Officer, Thinkbix Technologies Private Limited
• Email: hello@motherbot.io
• Address: Baner Business Bay, Baner, Pune, Maharashtra 411045, India
• Hours: Monday to Friday, 10 am to 6 pm IST (except public holidays)

We acknowledge every complaint within 24 hours and resolve it within 15 days. Requests about your rights under the DPDP Act are answered within 30 days. If you’re not satisfied with our answer, you can complain to the Data Protection Board of India.