Privacy policy

• Account details: your name, mobile number (we sign you in with a one-time code), email if you add one, and the companies you belong to and your role in each.
• Business details: company name, GSTIN, addresses, plants, industry, country, logo, bank account and UPI ID for quotations, products, prices and catalogues you upload.
• Conversations and documents: messages, photos and files exchanged with buyers through connected channels, quotations, leads, notes, call records and transcripts, and your conversations with Setu, the in-app assistant.
• Buyer details: what a buyer shares when they contact a customer, such as name, phone number, email, company and the content of their enquiry.
• Connected accounts: when you connect WhatsApp or Gmail we store the access tokens those services give us (encrypted), and the account identifiers needed to send and receive messages.
• Technical data: IP address, device and browser type, app version, push notification tokens, and logs of requests and errors, used to run and secure the service.

• To provide SupplierSetu: show enquiries in one inbox, send replies and quotations from your own number or mailbox, publish your catalogue website, and run the features you switch on.
• To run AI features: drafting replies and quotations, reading catalogues and attachments, summaries, reminders and business alerts. AI drafts that reach a buyer follow the approval settings you choose.
• To sign you in, keep accounts secure, prevent abuse and fix problems.
• To contact you about your account, billing, security and changes to the service.

We do not sell personal data, and we do not use customers’ or buyers’ data to advertise to them or to anyone else.

A customer can connect its own WhatsApp Business number through Meta’s Embedded Signup, which runs on Facebook Login for Business. Meta asks the customer to sign in and choose the business and number. From that flow we receive only the WhatsApp Business Account ID, the phone number ID, the number’s display details and a business access token. We do not receive or store the customer’s Facebook password or personal Facebook profile.

We use that access to receive buyers’ messages to the connected number, send the customer’s replies and approved message templates, show delivery and read receipts, and manage the number’s templates. Messages travel through Meta’s WhatsApp Business Platform and are also subject to WhatsApp’s Business policies. A customer can disconnect the number at any time in Settings › WhatsApp; we then stop receiving and sending messages for it.

A team member can connect a Gmail account to reply to buyers by email. We request permission to send mail and to read mail. We only bring buyers’ emails into SupplierSetu: replies in email threads that are already conversations in SupplierSetu, and mail from people saved as contacts in the company’s customer list. We read message headers to decide this; the rest of the mailbox is not stored.

SupplierSetu’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Gmail data is not used for advertising, is not sold, and is not used to train general AI models. People do not read it except with your permission, for security, or where the law requires.

We share data only with service providers that help us run SupplierSetu, under contracts that limit their use to providing their service to us:

• Hosting and storage: DigitalOcean (servers in Bengaluru, India) and Cloudflare (website delivery, email routing, file storage).
• Messaging: Meta (WhatsApp Business Platform), MSG91 (sign-in codes and our own messages to customers) and Google (Gmail, when connected).
• AI: OpenAI and Anthropic process text and files to produce drafts and answers. They do not use this data to train their models under our API agreements.
• Mobile notifications: Expo and Apple or Google push services.

A customer’s buyers see what the customer sends them, such as replies, quotations and the catalogue website. We may also disclose data when the law requires it, to protect people or the service, or as part of a merger or sale of the business, with notice to customers.

Our main database runs in India. Some providers listed above process data in other countries; when they do, it is under their own security and data protection commitments.

We keep data for as long as the customer’s account is active. When a customer deletes a conversation, file or connected account, we remove it from the live service. When a customer closes its account, we delete its data within 30 days, except what we must keep for tax, accounting or legal reasons. Backups roll over within 30 days after that.

Data is encrypted in transit. Access tokens for connected accounts are encrypted at rest. Each company’s data is separated at the database level, team members see only what their role allows, and we limit and log staff access. No system is perfectly secure; if a breach affects your data we will tell you and the authorities as the law requires.

Under India’s Digital Personal Data Protection Act, 2023 and other laws that apply to you, you can ask to access, correct or delete your personal data, withdraw consent, and nominate someone to act for you. Customers can change most details themselves in Settings, disconnect WhatsApp or Gmail, and remove team members.

Buyers who want their data corrected or removed should contact the business they dealt with; we will help that business act on the request. You can also write to us at privacy@suppliersetu.com and we will respond within 30 days. See how to delete your data.

SupplierSetu is a business tool and is not meant for anyone under 18. We do not knowingly collect children’s data.

We will update this page when our practices change and change the date at the top. For significant changes we will tell customers in the app or by email first.

Stayoft Ventures Private Limited, India. For privacy questions, requests or complaints, email privacy@suppliersetu.com. Our Grievance Officer can be reached at the same address and will acknowledge your complaint within 48 hours.