Privacy Policy

Digitoria Marketing Solutions Private Limited, India (“Digitoria”, “we”). You can reach us about anything on this page at info@digitoria.in.

DigiTick is software businesses use to talk to their own customers. Two roles matter:

• For customer conversations, we are a processor.The business using DigiTick decides which customers it messages and why; it is the data controller (a “data fiduciary” under India's DPDP Act), and we process those chats and contact details only to run DigiTick on its instructions.
• For accounts and billing, we are the controller. We decide how we handle the details of the people who sign up and sign in to DigiTick, and the billing records of each subscription.

If you messaged a business on WhatsApp and have a question about your chat, the business is the first place to ask; we will help if you can't reach them.

Sign-up details.When a business signs up: the person's name and email, a hashed password, the business name, country, industry and website, the version of the terms they accepted and when, and the IP address the sign-up came from. The email is verified with a one-time code.

WhatsApp conversations.Messages sent to and from the business's WhatsApp number — text, images, video, audio, documents, locations, shared contact cards, reactions and delivery status — and, for chats that began from a Click-to-WhatsApp ad, the ad details Meta passes along (headline, text, image link). Media files stay on Meta's servers; we store a reference and stream the file to signed-in staff when they open it.

Customer contact details.The customer's WhatsApp number (or, for a customer who uses a WhatsApp username, the identifier WhatsApp gives instead), the profile name WhatsApp supplies, any name the business types, tags, notes and custom fields the business chooses to record, and whether the customer has opted out.

Staff accounts. Name, email address, role, and a password stored only as a bcrypt hash, which nobody — including us — can read back.

Sign-in records. For each sign-in attempt: the IP address, the approximate city, region and country derived from it, the network operator, the browser user agent and whether the attempt succeeded. This lets a business see unauthorised access to its own inbox and lets us spot attempts to break in. It is not used for advertising or profiling.

Notification subscriptions. If a team member turns on notifications, the push address their browser or phone issues, so new-message alerts can reach that device.

WhatsApp connection settings.The business's WhatsApp phone number ID, WhatsApp Business Account ID and the access token Meta issues when the number is connected, used solely to send and receive on that business's behalf.

Free-trial records. The Meta identifiers of each WhatsApp number and WhatsApp Business Account that has used a free trial, so the same number cannot start a second one.

Billing records. The plan, the term bought, the amount paid and the dates of each subscription.

Web server logs.Our web server logs every request to DigiTick — the public website and the app — with the IP address, the time, the address requested, the referring page and the browser's user agent. Our public pages also tell the server which page is on screen; this uses no cookie or identifier. We derive an approximate city, country and network operator from the IP address using a database stored on our own server — the address is not sent anywhere for this. We use these logs to count website visitors (separately from existing customers and our own staff), to keep the service running and to spot abuse.

Cookies and browser storage.One sign-in cookie that keeps you logged in. The pricing page remembers your currency choice in your own browser. We load no analytics, advertising or tracking scripts (the sign-up page may load Cloudflare's human check, described below).

• We do not sell or rent any data to anyone.
• We do not use customer conversations for advertising or to train AI models.
• We do not let one business see another's data — every request is checked against the signed-in person's own business.

• Meta Platforms— the WhatsApp Business Platform (Cloud API). Every message is delivered through Meta and is also subject to Meta's own terms and privacy policy. Meta stores media files and processes messages on its own global infrastructure.
• Hostinger — the virtual private server and database that run DigiTick, and the email service that sends sign-up and password-reset codes.
• Browser push services— Google (Firebase Cloud Messaging, for Chrome and Android), Mozilla, Apple and Microsoft, depending on the device. They carry new-message alerts, which include the sender's name and the first 120 characters of the message. The alert is encrypted under the Web Push standard so the push service cannot read it; it only sees the device address.
• Cloudflare Turnstile— only if it is switched on for the sign-up page: a check that the person signing up is human. Cloudflare receives the visitor's IP address and browser signals for that check; it never receives the form contents.
• ip-api.com and ipwho.is — the IP address of a sign-in attempt is sent to one of these to look up an approximate location. No name, email or message content is sent, and each answer is cached for 30 days so the same address is not looked up again.

DigiTick's server and database run on a virtual private server rented from Hostinger, in a Hostinger data centre. Because WhatsApp messages pass through Meta, and push alerts through the services above, some data is processed outside your country. By using DigiTick, a business accepts these transfers as part of the service.

• Account data — conversations, contacts, staff accounts, sign-in records and settings — is kept for as long as the business keeps its DigiTick account, because that history is the product.
• Deletion on request. When a business asks us to delete its account, we delete it within 30 days of verifying the request. Everything belonging to it is removed together.
• Backups. Database backups — the nightly ones and any one-off copy taken before an upgrade — are deleted automatically after 30 days, so deleted data is gone from backups within 30 days as well.
• Technical de-duplication records are discarded after 7 days, web server logs are deleted after 15 days, and cached IP location lookups are refreshed after 30 days.
• We keep the free-trial records described above after an account is deleted, and the invoice records Indian tax law requires us to keep.

• Access, correction and deletion. You can ask for a copy of your personal data, ask us to correct it, or ask us to delete it. Email info@digitoria.in from a contactable address; we may need to verify that the request is yours. We respond within 30 days.
• Opting out of a business's messages. A WhatsApp customer can reply STOP at any time to stop automated messages from that business, and START to resume. This is honoured automatically.
• For requests about a chat with a business, and how deletion works, see Data deletion.

All traffic is served over HTTPS. Passwords are hashed with bcrypt. Sign-in attempts are rate-limited per account and per network. Every message Meta delivers to us is checked against Meta's signature before it is accepted. Access inside a business is controlled by roles, so a team member can be prevented from seeing customer phone numbers or chats that are not theirs.

If we become aware of a personal data breach affecting DigiTick, we will tell the affected businesses without undue delay, with what we know and what we are doing about it, and help them meet their own obligations. Where India's Digital Personal Data Protection Act or another applicable law requires it, we will also notify the Data Protection Board of India and the affected people.

No government or public authority has ever asked us for user data. If one does, these are the rules we follow, every time:

• We check that the request is lawful before we answer it. A request must arrive in writing, name the authority and the officer making it, and cite the law it is made under. A request that does not meet that bar is not acted on.
• We disclose the minimum the law requires — only for the accounts and the time period named in the request.
• We write every request down — its date, the authority, the legal basis cited, who at Digitoria handled it, what we decided and exactly what was disclosed. That record is kept permanently.
• We tell the business, unless we are forbidden to. If data belonging to a business using DigiTick is disclosed, we notify that business — except where the law or a court order prohibits it.

Under India's Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000, grievances are handled by Digitoria Marketing Solutions Private Limited. Email info@digitoria.in with the subject “Grievance”. We acknowledge within two business days and respond in full within 30 days.

When what DigiTick stores or who processes it changes, we update this page and the date at the top. For significant changes we also tell account owners by email or in the app.