Privacy Policy
1. Who we are, and what this policy covers
Granra Solutions ("we," "us," "our") provides Granra, a desktop application that helps businesses schedule and send WhatsApp Business messages, using their own Google Sheet or Excel file as a contact source. This policy explains what personal data we collect, why, how long we keep it, and the rights you have over it.
We are based in India. This policy is written to meet India's Digital Personal Data Protection Act, 2023 ("DPDP Act"), and — since our architecture is built to serve customers outside India too — the EU's General Data Protection Regulation ("GDPR") where it applies to you.
2. Two different roles we play with your data DPDP Act
The DPDP Act draws a distinction that matters here, between a Data Fiduciary (the party deciding how and why personal data is processed) and a Data Processor (a party processing data on someone else's behalf, under their instructions):
- For your own account data (your name, email, business details, payment record) — Granra Solutions is the Data Fiduciary. We decide how this is used, and this policy is our commitment to you as the person whose data it is (the "Data Principal").
- For the contacts you import (names and phone numbers from your Google Sheet or Excel file) — we act as a Data Processor on your instructions. You are the Data Fiduciary for your own contacts, and you are responsible for having a lawful basis and appropriate consent to message the people in your list. We only process this data to carry out the sends you schedule.
3. Information we collect
- Account information: your name, email address, and business details when you sign up.
- WhatsApp Business API credentials: the access token and phone number ID you connect from your own Meta Business account, stored so the app can send messages on your behalf.
- Contact data you import: names, phone numbers, and any custom fields you connect from your own Google Sheet or Excel file. Used only to send the messages you schedule.
- Payment information: handled entirely by our payment processor, Dodo Payments, acting as Merchant of Record. We do not store your card details.
- Usage data: basic technical information such as app version and error logs, used to fix bugs and improve the product.
4. Consent DPDP Act
Where we rely on your consent to process personal data, that consent is specific, informed, and freely given — collected through a clear opt-in step, not bundled into an unrelated agreement or assumed by default. You can withdraw consent at any time; withdrawing won't affect processing that already happened lawfully before you withdrew, but may mean some features stop working (e.g., we can't schedule messages without holding your WhatsApp credentials).
5. How we use your information
- To operate the scheduling and messaging features you use
- To process your subscription payment via Dodo Payments
- To provide customer support when you contact us
- To send you service-related updates (not marketing, unless you opt in)
- To meet legal obligations (e.g. tax records, responding to a lawful request from an authority)
6. How long we keep your data
We keep account and contact data for as long as your account is active. If you delete your account, we delete your personal data within 30 days, except where we're required to retain something for legal or tax purposes (e.g. billing records), in which case we keep only what's legally required and for no longer than necessary.
7. Your rights
| Under India's DPDP Act | Under GDPR (if this applies to you) |
|---|---|
| Right to access a summary of your personal data and processing activities | Right of access to your data |
| Right to correction and erasure of your personal data | Right to rectification and erasure ("right to be forgotten") |
| Right to grievance redressal — you can raise a complaint with us directly, and if unresolved, with the Data Protection Board of India | Right to lodge a complaint with your national supervisory authority |
| Right to nominate another individual to exercise your rights in case of death or incapacity | Right to data portability, and to object to certain processing |
To exercise any of these, contact us at support@granra.com. You can also disconnect your WhatsApp account or delete your contacts directly within the app at any time.
8. Data breach notification
If a personal data breach occurs, we will notify affected users and the relevant authority (India's Data Protection Board, or your supervisory authority under GDPR) without undue delay, and in any case within the timeframe required by applicable law.
9. Where your data is stored, and cross-border transfer
Your data is stored in our database, hosted by Render (application server) and Turso (database), which may be located outside India. The DPDP Act permits cross-border transfer of personal data except to countries specifically restricted by the Indian government; we do not currently transfer data to any restricted destination. If you're in the EU, we take reasonable steps to ensure any transfer outside the EU meets GDPR's adequacy requirements.
10. Third parties
We share data only where necessary to provide the service: with Meta/WhatsApp to deliver your messages, and with Dodo Payments to process your subscription. We do not sell your data to advertisers or other third parties.
11. Children's data
Granra is a business tool and is not directed at, or intended for use by, children. We do not knowingly collect personal data from children.
12. Changes to this policy
We may update this policy from time to time. If we make material changes, we'll let you know (e.g. via email or an in-app notice) before they take effect.
13. Grievance Officer / Contact us
Questions, complaints, or requests about this policy or your data can be sent to our Grievance Officer at support@granra.com. We aim to acknowledge grievances within 7 days and resolve them within a reasonable time as required under the DPDP Act.