Privacy Policy

Effective date: 19 October 2026 · Version 2026-10-19

This Privacy Policy explains how VertexSprint ("we", "us") collects, uses, shares and protects personal data when businesses use SprintChat and when people message those businesses on WhatsApp or Instagram. It is written to meet India's Digital Personal Data Protection Act, 2023 (DPDP Act) and the DPDP Rules, 2025. Questions? See Contact and Grievance Officer.

This policy is in English. A Hindi summary is in section 14. For any other language in the Eighth Schedule to the Constitution of India, email admin@vertexsprint.com.

1. Who we are and our role

VertexSprint is a technology company based in India (vertexsprint.com). SprintChat is our WhatsApp and Instagram messaging automation and CRM dashboard for businesses.

• If you messaged a business that uses SprintChat: that business decides why and how your messages are used. Under the DPDP Act it is the Data Fiduciary, and VertexSprint is its Data Processor: we process your data only to provide SprintChat to that business, under a contract with it. You can contact the business directly, or contact us and we will pass your request on and help.
• If you are a business user of the SprintChat dashboard: VertexSprint is the Data Fiduciary for your account details (name, email, login and session data).

2. Our Meta app

SprintChat connects to Meta platforms through our Meta app, VertexSprint Automation. The app uses Instagram messaging and comments and the WhatsApp Business Platform to:

• receive messages and comments sent to businesses that use SprintChat;
• send replies to those messages and comments on the business's behalf;
• use AI to draft replies; and
• save leads to the business's CRM inside SprintChat.

We only access Instagram or WhatsApp accounts that a business has connected to SprintChat and authorised.

3. Personal data we process, and why

We do not use your data for advertising, to build profiles of you, or for any purpose of our own, and we do not sell it.

4. Who receives it, and where

• The business you messaged, in its SprintChat dashboard.
• Meta (Instagram and the WhatsApp Business Platform), to send and receive messages.
• OpenAI, L.L.C., to draft AI replies. Message text and the business's own information are sent to OpenAI and processed in the United States.
• Hostinger, which hosts our servers in Mumbai, India, and our notification email.
• Authorities, where the law requires it.

Some of these providers process data outside India. The DPDP Act allows this unless the Central Government restricts transfers to a country, and we will follow any such restriction.

5. Retention and deletion

• Conversation and lead data are kept for as long as the business uses SprintChat, until the business deletes them, or until a valid deletion request is completed.
• When a business stops using SprintChat, we delete or return its data within 30 days.
• Processing logs and associated data are kept for one year and then deleted, because the DPDP Rules, 2025 (rule 8(3)) require this for detecting and investigating misuse.
• See Data deletion for how to ask us to delete your data.

6. Your rights

Under the DPDP Act you can ask for:

• access to a summary of your personal data, how it is processed, and who it was shared with;
• correction, completion, updating or erasure of your personal data;
• withdrawal of consent you gave to the business, as easily as you gave it;
• grievance redressal about how your data was handled; and
• nomination of a person to use these rights if you die or cannot act.

Send your request through vertexsprint.com/data-request or email admin@vertexsprint.com. Include your Instagram username or WhatsApp number (with country code), and the business you messaged if you know it. We may ask you to confirm the request from the same account or number. Because the business you messaged controls your data, we will tell it about your request and help it respond. We aim to respond within 30 days, and never later than the 90-day maximum the DPDP Rules allow.

7. Complaints to the Data Protection Board

If you are not satisfied after using the business's or our grievance process, you can complain to the Data Protection Board of India.

8. Security

We take reasonable safeguards to protect personal data, including encrypted connections (HTTPS), a separate login for each business, hashed passwords, lockout after repeated wrong attempts, access limited to authorised people, and logs of access and processing. No system is completely secure. If a personal data breach happens, we will tell the affected businesses without delay so that they, and we where required, can inform affected people and the Data Protection Board as the DPDP Rules require.

9. Your choices

• You can stop messaging a business at any time.
• You can remove connected apps from your Instagram account in Settings > Apps and websites.
• You can use the rights in section 6.

10. Children

SprintChat is a tool for businesses and is not directed at children. Business users must be 18 or older. Businesses must not use SprintChat to target children, and must get verifiable parental consent where the law requires it. If we learn that we hold a child's personal data without that consent, we will tell the business and delete it.

11. Consent Managers

The DPDP Act lets people manage consent through Consent Managers registered with the Data Protection Board. We will look at supporting them once they are available.

12. Changes to this policy

When we change this policy, we update the effective date and version at the top of this page.

13. Contact and Grievance Officer

14. हिंदी सारांश