Privacy Policy

Last updated: 28 May 2026

This Privacy Policy explains how webMonx Solutions LLP ("webMonx", "we", "our", "us"), the operator of the dripBot platform, collects, processes, and protects personal data when you use our services at dripbot.in and app.dripbot.in.

dripBot is a product of webMonx Solutions LLP. We are a WhatsApp Business Solution Provider (Tech Provider) that enables Indian businesses to send WhatsApp messages through the official Meta WhatsApp Business Cloud API. In doing so, we process WhatsApp Business Solution Data on behalf of our client businesses, subject to their instructions and authorization, in accordance with Meta\'s WhatsApp Business Solution Terms and WhatsApp Business Messaging Policy.

1. Who we are

webMonx Solutions LLP (a limited liability partnership registered in India, LLPIN ACR-1536)
Sri Nagar Colony, Hyderabad, Telangana, India
Contact: support@dripbot.in

References in this Policy to "dripBot" mean the product operated by webMonx Solutions LLP.

2. Information We Collect

Account information

When you create a dripBot account, we collect your name, business email address, phone number, business name, GSTIN (if provided for invoicing), and the role you hold within your organization. This information is necessary to create your account, verify your identity, and provide our services.

WhatsApp Business Solution Data

To enable WhatsApp messaging, we collect and process data on behalf of your business. This includes:

• Your WhatsApp Business Account (WABA) credentials, phone numbers, and Meta API tokens. These are encrypted using AES-256-GCM at rest.
• Contact lists you upload or capture (phone numbers, names, custom attributes you provide).
• Message content, templates, and campaign data.
• Inbound and outbound message metadata, delivery and read status, and conversation history.

This data is processed solely to provide the dripBot service to you, and is not used for any other purpose. See Section 4 for the role we play with respect to this data.

Usage and technical data

We automatically collect information about how you use our platform, including pages visited, features used, API calls made, IP addresses, browser type, device information, and performance metrics. This information helps us operate the platform securely and improve our service.

Payment data

Subscription payments are processed through Razorpay, our payment processor. webMonx Solutions LLP and dripBot do not store your card numbers, CVV, or full bank account details. We retain only the transaction reference, amount, currency, and the billing details (business name, billing address, GSTIN) required to issue a tax invoice.

3. Our Role: Data Processor / Third Party Service Provider

For account-level data about your business (Section 2.1) and your billing information (Section 2.4), webMonx Solutions LLP acts as a data controller under applicable Indian and international data protection laws.

For WhatsApp Business Solution Data you upload, generate, or process through dripBot (Section 2.2), webMonx Solutions LLP acts as a data processor (also referred to as a Third Party Service Provider, or TPSP, under Meta\'s WhatsApp Business Solution Terms). In this role:

• The client business is the data controller of the contact, message, and template data.
• We process such data only on your instructions and authorization, solely to provide the dripBot service.
• We do not use this data for any other purpose, including marketing our services or training AI models (see Section 6).

4. WhatsApp and Meta Data Handling

All data obtained, accessed, or processed through the WhatsApp Business Solution (the Meta WhatsApp Business Cloud API) is processed only to provide the service you have requested, in accordance with:

• Meta\'s WhatsApp Business Solution Terms
• Meta\'s WhatsApp Business Messaging Policy
• Meta\'s Commerce Policy where applicable

5. Opt-In and Consent

You may use dripBot to send WhatsApp messages only to end users who have given valid opt-in consent in accordance with Meta\'s policies and applicable law. As a client, you are responsible for obtaining, recording, and demonstrating that opt-in before initiating a conversation. dripBot stores the opt-in source and timestamp for every contact you create or import.

End users may opt out at any time by replying "STOP" (or any locally accepted opt-out variant). dripBot honors opt-outs automatically by adding the recipient to a tenant-level blocklist, and excludes blocklisted recipients from all subsequent messaging.

6. Use of AI and Machine Learning

This is a critical commitment. WhatsApp Business Solution Data (including any anonymized, aggregated, or derived form of such data) is NOT used by webMonx Solutions LLP to create, develop, train, fine-tune, or improve any machine learning or artificial intelligence systems or models, including large language models (LLMs), whether our own or any third party\'s.

Where dripBot offers AI-assisted reply features:

• AI is used solely to generate replies for your specific business, on your behalf, using only data necessary to compose that reply.
• Any model customization or fine-tuning is performed solely for your exclusive use and never contributes data to any broader AI model.
• When we send data to a third-party AI or LLM provider to generate a reply, that data is processed only to produce your business\'s response and the provider is contractually prohibited from using it to train their models.

This policy applies to all data accessed through the WhatsApp Business Solution and is enforced regardless of changes to product features.

7. AI Transparency to End Users

Where AI-assisted replies are used on a conversation, dripBot supports informing end users that they may be interacting with an automated or AI assistant. Client businesses are responsible for configuring this disclosure in their conversation flows in line with Meta\'s policies and applicable AI transparency laws.

8. How We Use Your Information

• To provide, operate, and maintain the dripBot platform and its features.
• To process WhatsApp message delivery through the Meta WhatsApp Business Cloud API on your behalf.
• To send service-related notifications, billing reminders, and important account updates.
• To provide customer support and respond to your inquiries.
• To analyze platform usage patterns and improve our service.
• To detect, prevent, and address fraud, abuse, security incidents, and policy violations.
• To comply with our legal obligations under Indian law and applicable regulations.

9. Data Storage and Security

All data is stored on servers physically located in India. We apply administrative, physical, and technical safeguards that meet or exceed industry standards, including:

• AES-256-GCM encryption at rest for credentials and sensitive fields.
• TLS encryption for all data in transit between your browser, our servers, Meta, and other sub-processors.
• Row-level tenant isolation in the database. Each client\'s data is logically separated and is never accessible to other tenants.
• Argon2id password hashing for staff accounts.
• Two-factor authentication (TOTP) available on all staff accounts.
• Scoped, hashed API keys with audit logging of every issuance and use.
• Regular security reviews, vulnerability scanning, and patching.
• Audit trails for every sensitive action (contact deletion, key rotation, staff changes).

10. Data Sharing and Sub-Processors

We do not sell your personal data. We share data only with the sub-processors and recipients listed below, each engaged under written agreements that bind them to data protection obligations:

• Meta Platforms, Inc. (WhatsApp Business Cloud API). To deliver WhatsApp messages and receive inbound replies. Only data necessary for messaging is shared.
• Razorpay. To process subscription payments. Card and bank details are handled by Razorpay under PCI-DSS standards; we do not see or store them.
• Cloud infrastructure providers in India. To host our application, databases, and object storage. These providers are bound by data processing agreements and do not access data content.
• Transactional email provider. To send service notifications, password resets, and billing emails.
• Third-party AI / LLM providers (where you enable AI-assisted reply features). Bound by contracts that prohibit using your data for training their models.
• Legal authorities. Where we are required to disclose data by Indian law, a valid court order, or a binding request from a government authority.

11. Data Retention and Deletion

We retain account, contact, and message data for as long as your dripBot account is active.

If you close your account:

• Your contact data and message history are deleted within 30 days, except where retention is required by law.
• Billing records are retained for 7 years as required by Indian tax laws.
• Audit logs may be retained for up to 2 years for security and dispute purposes.

You may request deletion of specific contacts or your full tenant at any time by contacting support@dripbot.in. Opt-out requests from end users are processed automatically and immediately on the next campaign run.

12. Your Rights

Under India\'s Digital Personal Data Protection (DPDP) Act 2023 and, where applicable, the EU/UK GDPR, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Request deletion of your personal data, subject to legal retention requirements.
• Withdraw consent for processing where consent is the legal basis.
• Receive a copy of your data in a machine-readable format (data portability).
• Nominate another person to exercise these rights on your behalf, where applicable.
• Lodge a complaint with the Data Protection Board of India or another competent supervisory authority.

To exercise these rights, contact us at support@dripbot.in. We respond to verified requests within 30 days.

13. Contact Data You Upload

When you upload contacts to dripBot, you confirm that you have a lawful basis (typically opt-in consent) to process those contacts\' data and to send them WhatsApp messages, and that you comply with Meta\'s WhatsApp Business Policy and all applicable laws. webMonx Solutions LLP processes this data strictly as your processor.

14. Cookies

Our platform uses cookies and similar technologies to maintain your session, remember your preferences, and analyze platform usage. Session cookies are deleted when you close your browser. You can control cookie behavior through your browser settings; disabling some cookies may limit functionality.

15. Children\'s Privacy

dripBot is a business platform intended for use by individuals who are 18 or older and authorized to act on behalf of a business. We do not knowingly collect data from minors. If we become aware that we have collected data from a minor, we will delete it promptly.

16. International Transfers

Data is stored on servers in India. Limited transfers outside India may occur when interacting with Meta\'s WhatsApp infrastructure (which routes messages globally) and with third-party AI providers. Such transfers are protected by appropriate contractual safeguards.

17. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page indicates when material changes were last made. We will notify clients of material changes via email or a prominent notice in the dripBot dashboard. Continued use of dripBot after such notice constitutes acceptance of the updated Policy.

18. Contact Us

For privacy-related questions or to exercise your data rights:

webMonx Solutions LLP (operator of dripBot, LLPIN ACR-1536)
Sri Nagar Colony, Hyderabad, Telangana, India
Email: support@dripbot.in