Privacy Policy | Risponse

1. Who we are

Risponse is a WhatsApp team inbox for businesses.

In this policy, “Risponse”, “we” and “us” mean Risponse. “You” means anyone whose personal data we handle, such as website visitors, customers and their team members.

For any privacy question, email info@risponse.com. This policy is governed by the laws of India.

2. What this policy covers

This policy covers our website at risponse.com, the Risponse app and the emails you send us. Our help docs at docs.risponse.com run on a separate documentation platform, which may use its own cookies or browser storage.

3. Our two roles

Risponse handles personal data in two roles, depending on the data.

For our own purposes, we decide. This covers website visitors, emails to us, accounts and team members, billing, support and marketing. Under India’s Digital Personal Data Protection Act, 2023 (DPDP Act), Risponse is the Data Fiduciary for this data.

For your workspace, we act for you. The messages, contacts, groups, media, calls, notes, tickets and properties in your workspace belong to your business. We process them only on your behalf and on your instructions, to provide the service. Your business is the Data Fiduciary, and Risponse is its Data Processor.

As the business, you need a lawful reason to handle your customers’ data. You must also give them any notice and get any consent the law requires. Our terms explain this further.

4. What we collect

On our website

Our website uses Google Analytics, a service from Google, to measure visits. With each page you view, it receives the page address, the page that linked to it, the time, your browser, device type, screen size and language, and an approximate location (country and city) worked out from your IP address. It sets cookies with a random ID, listed in our Cookie Policy. Google Analytics does not store IP addresses, and we have turned off Google signals and ad personalisation.

Our website also uses Microsoft Clarity, a service from Microsoft, to see how people use our pages. With each page you view, it receives the page address, the page that linked to it, your browser, device and screen size, an approximate location worked out from your IP address, and what happens on the page, such as scrolling, clicks and mouse movement. It never records what is typed into form fields, and everything in our sign-up form is hidden from it. It sets cookies, listed in our Cookie Policy. The site uses no advertising pixels or chat widgets.

The site is hosted on Amazon Web Services (AWS). AWS receives normal request data, such as your IP address, browser type and the page requested. It uses this data to deliver pages and to protect the site.

We do not keep access logs of visits to our website. The firewall that protects the site keeps a sample of recent requests, such as the IP address, browser details and page requested, for 3 hours.

The pricing page can remember the currency you pick, in your own browser. It is never sent to us. The Cookie Policy explains this, and what our host sees.

When you email us

When you email info@risponse.com, we receive your address and everything you write. We use it to reply and help you.

Your account and your team

You sign up with your name and phone number, and you sign in through WhatsApp. The first person to sign up becomes the admin. Admins invite teammates and choose whether each one is an Admin or a Member.

For each workspace, we hold:

each user’s name, phone number, role and any other profile details they add
availability, such as online status and working hours
activity history, such as label, assignee and membership changes
the teammate who wrote each message sent from Risponse
metrics for each person, such as chats handled, messages sent, response speed and time online

Billing

When you buy a plan, an add-on or credits, we keep billing records, such as the plan, amounts, dates, invoices and billing contact details. A payment provider processes payments for us and handles the payment details you enter.

When you use the app

Like any online service, the app receives technical data with each request, such as your IP address and browser type. We use it to run the service and keep it secure.

The app also saves copies of your chats and settings in your browser. Clearing your browser data removes only those copies. Your chats and settings stay on Risponse servers.

Your workspace content

When you connect a number with a QR code, everything that number is part of syncs into Risponse, including groups (connect WhatsApp). For a coexistence number, Meta lets contacts and one-to-one chats from the 180 days before setup sync. Groups on a coexistence number do not sync (Meta’s coexistence guide).

Your workspace can then hold:

chats, messages, groups and group members
contacts, with their names and phone numbers
photos, videos, voice notes and documents
private notes, tickets, tasks, labels and custom properties
quick replies, scheduled messages, saved chat lists and bulk message logs
FAQs and documents in the AI agent’s knowledge base
AI summaries, suggested replies and translations
call history, recordings, transcripts and AI call summaries

Calls

Calling is a beta feature. Calls answered in Risponse are recorded, with a transcript and an AI summary. Missed calls and calls answered on a phone have no recording. If you use calling, your business must tell callers about the recording and get any consent the law requires.

5. How we use data, and why

We use personal data only for these purposes, each on a ground the law allows. Under the DPDP Act, that is your consent or a “legitimate use”, such as data you gave us for a stated purpose.

To provide the service. We run your workspace, numbers, messages, bulk messages, automations, AI features and integrations. Ground: data you gave us to use the service (a legitimate use), and our contract with you.
To bill you. We charge for plans, add-ons and credits and keep financial records. Ground: data you gave us to buy a plan, and tax laws.
To support you. We answer your emails and help fix problems. Ground: data you chose to give us for this purpose.
To send service messages. These include billing notices and notices about changes to the service or this policy. Ground: data you gave us to use the service (a legitimate use), and our contract with you.
To keep things secure. We protect the website, the app and your account, and we look into misuse. Ground: data you gave us to use the service, and our legal duty to protect it.
To improve our website. With Google Analytics we see, in totals, which pages people read, how they find the site and which devices they use. With Microsoft Clarity we watch replays of visits and see heatmaps, to find parts of the site that confuse people. Both start when a page loads, without asking first, and you can block them at any time (Cookie Policy, section 8). Ground: our interest in running a useful website.
To follow the law. We keep required records and answer lawful requests. Ground: legal duty.
To send marketing. If we send news or offers, we send them only to people who agreed to get them. You can opt out at any time by emailing us. Ground: your consent.

You can withdraw consent at any time by emailing us. We then stop the use that relied on it and have our service providers stop too, unless a law requires us to continue. From about May 2027, we will also delete the data we held on that consent, and have our service providers delete it, unless a law requires us to keep it. This does not affect what we did before. You may also choose not to give us some data. Without it, we may not be able to run your account or some features.

Under the SPDI Rules (see section 11), payment details, such as card or bank account details, are sensitive personal data. Where we receive them, we use them only to process payments.

6. AI features

Risponse has AI features your team can choose to use: summaries, suggested replies, translation, message flagging, an AI agent and AI assistants. Each one reads some workspace content to do its job.

AI summaries and the chat assistant read only the chat you have open.
The org assistant works across your workspace.
Self-training reads chats marked resolved, on a schedule, to draft FAQs. Drafts can wait for your approval.
The AI agent uses the FAQs and documents in its knowledge base. You switch each built-in tool on or off, and your team can review every custom tool call.
Calling (beta) makes a transcript and an AI summary of each call answered in Risponse.

To run these features, we use AI models from service providers, mainly Anthropic, OpenAI and Google (Gemini). A provider receives the content a feature reads, so it can produce the result.

We do not sell personal data. We share it only as described here.

Your own team

People in your workspace see data according to their role and labels (see section 10).

WhatsApp and Meta

WhatsApp is a Meta service, and every message your numbers send or receive passes through it. With a QR connection, Risponse links to your number as a device, like WhatsApp Web (connect WhatsApp). WhatsApp Business API and coexistence numbers send and receive messages through Meta’s platform. Signing in to Risponse also goes through WhatsApp. WhatsApp’s own terms and privacy policy apply to its service.

Integrations and tools you turn on

When your team connects another tool, Risponse sends it the data that connection shares. That tool’s own terms and privacy policy then apply.

HubSpot gets new messages logged on the linked contact or company, and tickets synced to a pipeline you pick. If you turn it on, it also gets contacts or companies made from new chats.
Zoho CRM gets new messages logged on the linked record, and the custom properties you choose to share. If you turn it on, it also gets records made from new chats.
Zoho Desk and Freshdesk get the tickets you create in Risponse. Zoho Desk also gets custom properties you add to its layout.
Google Sheets gets chats, messages, reactions and ticket changes. Anyone with access to the sheet can read them.
Zapier gets chat, message, reaction and ticket events for your Zaps. Anyone with your Risponse API key can read your data through Zapier, so replace a leaked key.
Automation rules and workflows can send message data to Slack, your own webhook or an email address you choose.
AI apps you connect to the Risponse MCP server can read chats, search messages and draft replies on the numbers you allow.
Custom tools for the AI agent send inputs, such as an order number, to your own systems.

See all integrations in the docs.

Service providers

We use service providers, for example to host our infrastructure, store data, send email, process payments and run AI models (see section 6). They receive personal data so they can do this work for us. Where we decide how data is used (see section 3), we stay responsible for the personal data they handle for us. The DPDP Act makes this a legal duty from about May 2027.

Legal reasons and business changes

We may share data when the law requires it, such as a valid order from a court or authority. We may also share it to protect the rights or safety of Risponse, our customers or others. If Risponse is merged, sold or reorganised, data may pass to the new owner. That owner must keep protecting it under this policy.

8. Data outside India

We host the Risponse app, and the data it holds, in India. Some service providers, and Meta, may still process data outside India. For example, every WhatsApp message passes through Meta. Our website is delivered through the AWS CloudFront network, so a visit may be handled outside India. Google, which provides Google Analytics for our website, and Microsoft, which provides Microsoft Clarity, may also process visit data outside India.

We transfer data abroad only as Indian law allows. Where the law requires it, the recipient must protect it to the same standard as this policy.

9. How long we keep data

We keep personal data only as long as we need it for the purposes in this policy, or as Indian law requires.

Workspace content is kept to run your workspace, under your control. Your team can delete items such as labels, saved chat lists and scheduled messages, and remove a number in its settings. A message deleted through a workflow action cannot be restored.
Account and team data stays while the account is active.
Billing records stay as long as tax laws require.
Emails to us stay while we need them to help you.

When an account is deleted, we delete the data linked to it, except data the law requires us to keep. Indian law can require us to keep:

billing records and invoices, as tax laws require
logs of our systems, which the CERT-In directions under the IT Act require businesses to keep for 180 days
from about May 2027, some personal data and logs of how we processed it. The DPDP Rules require us to keep these for at least one year.

We use this data only for the legal purpose it is kept for. When that period ends, we delete it, unless another law requires us to keep it longer.

When we no longer need data, we delete it or make it anonymous. Depending on your plan, you can export your data, such as chats, messages and tickets. Export anything you need before an account is deleted. Keep exported files private, as they may hold phone numbers and messages.

10. How we protect data

Risponse gives your admins controls to limit who sees what. Our security page has more detail.

Roles and labels. Admins see every chat on the connected numbers. Members see only chats with their label, and each chat lists who can see it.
Number masking. You can hide customer phone numbers from agents, who still see the name and full chat. It cannot stop someone noting a number a customer types in a message.
Media privacy. Outside the app, links to media files can expire after a time you choose.
Private notes. Only your team can read notes, and they are never sent to the customer.
Activity history. Each message sent from Risponse shows who wrote it, and label, assignee and membership changes are recorded.
Approved connections. Most integrations connect only after someone signs in to the other tool and approves access.

If a data breach affects personal data that Risponse decides about (see section 3), we will tell you and the authorities as the law requires. Under the DPDP Rules, from about May 2027, we will tell you without delay, through your account or your contact details. We will explain what happened, what it may mean for you, what we are doing about it, what you can do and who to contact. We will also report it to the Data Protection Board of India. If a breach affects data in a business’s workspace, that business must tell the people affected and the Board. Today, we must report cyber security incidents to CERT-In, India’s national agency for cyber security.

11. Your rights

Rights under Indian law

Two sets of Indian law protect your personal data. One is the Information Technology Act, 2000. Its 2011 rules on reasonable security practices and sensitive personal data are called the SPDI Rules here. The other is the DPDP Act, which is coming into force in stages. Today, the SPDI Rules let you review and correct your data, withdraw consent and make a complaint to us (see section 14). The other rights below come from the DPDP Act and are expected to start in May 2027. You can still send us any of these requests now.

Access. Get a summary of your personal data, how we use it and who we shared it with.
Correction. Have your data corrected, completed or updated.
Erasure. Have data deleted that we no longer need, or that you no longer agree to us using.
Withdraw consent. Take back consent at any time.
Grievance. Complain about how we handle your data and get an answer (see section 14).
Nominate. Name someone to use your rights if you die or cannot act.

Once the DPDP Act’s complaint process is in force, you may also complain to the Data Protection Board of India. You must use our grievance process first.

If you are in the EU or UK

Risponse is not set up in the EU or UK at this stage, but our website is open to visitors from anywhere. If the EU or UK GDPR applies to how we handle your data, you can also restrict or object to its use, or ask to move it. You can complain to your local data protection authority.

How to use your rights

Email info@risponse.com and say which right you want to use. If you have a Risponse account, tell us the phone number linked to it. We may ask for details to confirm who you are, so we never give your data to someone else.

12. If you message a business that uses Risponse

If you chat on WhatsApp with a business that uses Risponse, that business decides how your data is used. Please send privacy requests to the business. If you write to us instead, we will pass your request on where we can identify the business.

13. How to ask us to delete your data

You can ask us to delete your personal data at any time. Email info@risponse.com with “Delete my data” in the subject line. Tell us:

the phone number linked to your account, if you have one
the workspace or WhatsApp number it is about, if any
what you want deleted

If the data is in a business’s workspace, that business decides what is deleted. We will pass your request to it, as section 12 explains.

We will confirm when we receive your request and when it is done. If the law requires us to keep some data, such as billing records, we will tell you what we kept and why. Section 9 explains what the law can require us to keep.

14. Grievance Officer

To complain about how we process personal data, email info@risponse.com with “Grievance” in the subject line. We will resolve it within one month of receiving it, as the SPDI Rules require. If you are not happy with our answer, section 11 explains when you can go to the Data Protection Board of India.

15. Children

Risponse is a service for businesses, and users must be 18 or older. We do not knowingly collect children’s data for our own purposes. We never track, profile or target advertising at children. If you think a child has given us personal data, email us and we will delete it. Businesses are responsible for any children among their own customers, including any parental consent the law requires.

16. WhatsApp and Meta rules for your business

When you connect a number, you agree to follow the WhatsApp and Meta terms and policies for your account. Your business is responsible for getting each contact’s agreement (opt-in) before you message them, and for respecting every request to stop (opt-out). Meta alone decides on matters such as template approval, messaging limits and account restrictions. Our best practices guide has tips.

17. Links to other sites

Our website and app link to other sites, such as our help docs, Meta’s pages, Instagram and the tools you connect. Each of these sites, and the platform that runs our help docs, has its own privacy policy. We are not responsible for how other companies’ sites handle your data.

18. Changes to this policy

We may update this policy when our service or the law changes. Each time, we will change the date at the top. If a change affects how we use your data, we will tell account holders by email and in the app first. This version takes effect on 27 October 2026.

19. Contact us

For any question about this policy or how we process personal data, email info@risponse.com. Our contact page shows how to reach us about sales, support or a demo.