Privacy Policy

01Who we are

Color Cloud Software Private Limited ("Color Cloud", "we", "us") operates C2qor, a hosted customer relationship management application. Businesses ("operators") use C2qor to manage conversations with their own customers across WhatsApp, Telegram, Instagram, Facebook Messenger, email and SMS.

Under the Digital Personal Data Protection Act, 2023 (the "DPDP Act"), Color Cloud is the Data Fiduciary for operator account data. For the conversation data an operator's customers generate by messaging them, the operator is ordinarily the Data Fiduciary and Color Cloud acts as their Data Processor, storing and displaying that data on their instructions.

02Scope of this policy

This policy covers the C2qor application and the data it processes for operators and their customers. It does not cover Color Cloud's corporate website, which has its own policy, or any privacy notice an operator publishes to their own customers. Use of C2qor is also governed by our Terms of Service.

03What data we collect

• Account data: the name, email address and password (stored hashed) of anyone who signs up for or is invited to an operator's account, and, if they turn it on, a two-factor authenticator secret.
• Channel connection data: access tokens for the WhatsApp Business Account, Facebook Page, Instagram account, Telegram bot, or email/SMS sender an operator connects. These are encrypted at rest.
• Customer conversation data: a contact's name, phone number or platform identifier, the messages and media exchanged, and any location a customer chooses to share. If an operator connects Instagram, public comments on their posts may be read to power comment-reply automations.
• Business records: contacts, deals, appointments, reminders, products and campaigns an operator creates.
• Email campaign data: whether a campaign email was delivered, opened or clicked, and unsubscribe, bounce and complaint records so we never email that address again for that operator.
• Technical logs: IP address, browser and device type, and timestamps, recorded for security and to keep the service running.

C2qor does not embed third-party analytics or advertising trackers, and this data is never sold or used for advertising.

04Why we use it, and our lawful basis

Under Sections 4–7 of the DPDP Act we process personal data either with consent or for a "legitimate use" recognised by the Act:

• To operate the CRM: showing conversations, letting an operator's team reply, and running the bots, automations and AI replies the operator has configured, on the operator's instructions.
• To administer operator accounts, including billing and support.
• To secure our infrastructure, prevent abuse and diagnose faults, as required by Section 43A of the Information Technology Act, 2000.
• To comply with applicable law, and to establish or defend legal claims.

Where we rely on consent, you may withdraw it at any time; this does not affect processing already carried out.

05AI features

If an operator turns on AI features (reply drafts, auto-replies, voice-note transcription, template and automation generation), the relevant conversation text and the operator's knowledge base are sent to the AI provider the operator selects (OpenAI, Anthropic or Groq) using the operator's own API key. We do not use customer conversations to train any model. AI features are off until an operator configures them.

06Cookies

C2qor sets only the essential cookies needed to keep you signed in and remember display preferences. We do not use analytics or advertising cookies, so there is no cookie banner.

07When we share data

We do not sell personal data. We disclose it only in these situations:

• Messaging platforms: messages flow to and from Meta (WhatsApp, Instagram, Facebook), Telegram and our SMS provider through their official APIs, governed by their own terms.
• Service providers: Amazon Web Services (hosting, database and email delivery), Supabase (authentication software, self-hosted on our AWS infrastructure), Google Maps (address search, when an operator adds a location) and the AI provider an operator selects. Each may use the data only to provide its service to us.
• Legal and regulatory: where Indian law, a court order or a lawful government request requires it, including directions issued by CERT-In.
• Corporate transactions: in a merger, acquisition or restructuring, with this policy continuing to apply.

08Storage and cross-border transfer

Our servers and database are hosted in AWS's Mumbai region (ap-south-1). Some providers, such as AI providers, may process data outside India; we transfer data only to countries not restricted under Section 16 of the DPDP Act, and this policy continues to apply wherever data is processed.

09How long we keep it

Account and conversation data is kept while the operator's account is active. When an operator deletes their account, its data is deleted within 30 days, except where the law requires us to keep it. Backups roll off within a further 30 days. Unsubscribe and bounce records are kept for as long as the operator's account exists, so that a person who opted out is not contacted again. Security logs are rotated out after a limited period.

10How we protect it

We follow reasonable security practices under Section 43A of the IT Act and the SPDI Rules, 2011: encryption in transit and of channel tokens at rest, strict separation of each operator's data, role-based access, optional two-factor sign-in, automatic sign-out after inactivity, and rate limits against abuse. No system is completely secure, but we work to reduce risk and will notify affected parties and the Data Protection Board of a breach as the DPDP Act requires.

11Your rights as a Data Principal

Subject to the DPDP Act, you may:

• Access a summary of the personal data we hold about you (Section 11). Account owners can download their data from Settings.
• Correct, update or erase your personal data (Section 12). Account owners can delete their account from Settings; see Data deletion.
• Withdraw consent as easily as you gave it (Section 6), including unsubscribing from any campaign email through its unsubscribe link.
• Nominate another person to exercise these rights on your behalf in the event of death or incapacity (Section 14).
• Grievance redressal: complain to us first, then to the Data Protection Board of India if you are not satisfied (Section 13).

If you messaged one of our operators, please contact that operator first, since they control how your conversation data is used; we will help them respond. Operators and their team members can write to support@colorcloudindia.com. We may need to verify your identity before acting on a request.

12Children's data

C2qor is a business tool and is not directed at children. In line with Section 9 of the DPDP Act, we do not knowingly process the personal data of anyone under 18 as an account holder without verifiable parental consent, and we do no tracking or targeted advertising directed at children. If a child's data reached us in error, contact us and we will delete it.

13Grievance redressal

Our Grievance Officer for data-related complaints:

• The Grievance Officer, Color Cloud Software Private Limited
• Email: support@colorcloudindia.com

We acknowledge complaints within 24 hours and aim to resolve them within 15 days, as the IT Rules, 2021 require. If you remain dissatisfied, you may approach the Data Protection Board of India.

14Changes to this policy

We may revise this policy as our practices or the law change. The effective date at the top shows the current version, and we will tell account owners by email before a material change takes effect.