This Privacy Policy explains how Brandbabaa-AI ("Brandbabaa", "we", "us", "our") collects, uses, shares, and protects personal data when (a) you visit our website, (b) you create an account and use our CRM/automation platform, and (c) your organization uploads or otherwise provides personal data of leads, customers, or contacts to Brandbabaa (together, the "Services").
This Policy is intended to support compliance with applicable Indian laws, including the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Digital Personal Data Protection Rules, 2025, as notified, and the Information Technology Act, 2000 and applicable rules (including the SPDI Rules).
a) Website visitors and account users. For personal data collected directly from you (e.g., when you sign up, pay for a subscription, or contact support), Brandbabaa generally acts as a Data Fiduciary (controller).
b) Customer-Provided Data. If you are a business customer and you upload or connect lead/customer/contact data (including WhatsApp message content) to Brandbabaa, your organization typically determines the purpose and means of processing that data and is the Data Fiduciary. In that context, Brandbabaa generally acts as a Data Processor (processor) and processes such data only on documented instructions from the customer, as further described in our customer agreement / Data Processing Addendum (where applicable).
c) End customers / leads. If you are an end customer/lead whose data is processed by one of our business customers, please contact that business customer first to exercise rights, because they control the relationship and the purpose of processing. We will assist our customers in responding to such requests as required by law and contract.
We collect personal data depending on how you use the Services. This can include:
We do not intentionally ask you to provide Sensitive Personal Data (as defined under applicable IT rules) through the Services; however, Customer-Provided Data may include such information if your leads share it during conversations. You are responsible for minimizing collection to what is necessary for your use case.
Under the DPDP Act, we process personal data only for a lawful purpose and based on (a) consent, or (b) certain legitimate uses as permitted by law. Where we act as a Data Processor for Customer-Provided Data, our customer (the Data Fiduciary) is responsible for establishing a lawful basis and providing any required notices/consents to Data Principals.
We use cookies and similar technologies for authentication, security, preferences, and analytics. You can manage cookies via your browser settings. Where required, we will provide cookie choices or banners.
We may share personal data with:
We do not sell Customer-Provided Data or personal data. We do not share Customer-Provided Data with third parties for their own marketing or advertising purposes.
We may process and store personal data in India and other jurisdictions where we or our service providers operate. Transfers outside India will be carried out in accordance with the DPDP Act/Rules and any other applicable laws.
We retain personal data for as long as necessary to provide the Services, comply with legal obligations, resolve disputes, and enforce agreements. Retention can vary by data type:
Upon account termination, we will provide customers a reasonable opportunity to export Customer-Provided Data. After this export period, we will delete or anonymize Customer-Provided Data within a reasonable time, except where retention is required for legal, security, or dispute-resolution purposes.
Subject to applicable law, Data Principals may have rights including: (i) access to information about processing, (ii) correction/completion/updating, (iii) erasure, (iv) grievance redressal, and (v) nomination. Where processing is based on consent, you may also withdraw consent.
If you are a business customer/account user, contact us at info@Brandbabaa-ai.com. If your data was provided to Brandbabaa by one of our business customers, please contact that customer first.
We maintain reasonable administrative, technical, and organizational safeguards designed to protect personal data against unauthorized access, disclosure, alteration, or loss. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.
If we become aware of a personal data breach, we will take reasonable steps to contain and remediate it. We will notify the Data Protection Board of India and affected Data Principals when required under applicable law.
Our Services are intended for use by businesses and are not directed to children. We do not knowingly process personal data of children as a Data Fiduciary.
We may update this Policy from time to time. The updated version will be posted with a revised "Last Updated" date. Material changes may be notified through the website or within the Services.
Email: ggaganjohar@gmail.com
We will respond to grievances within the timelines prescribed by applicable law (currently up to 90 days under the DPDP Rules, as notified).