1. Who we are
The business behind EazyWebsite, and what this policy covers.
EazyWebsite is a brand of StellarCart, a business registered in India (GSTIN 32DBIPR9609N1ZY) with its principal place of business at 55, Krishnakripa House, Kuruppan Kulangara Road, Maruthorvattom East, Cherthala, Alappuzha, Kerala 688539, India ("EazyWebsite", "we", "us", "our"). We design and build websites and digital tools for businesses, and we operate a WhatsApp messaging platform (the "Messaging Platform"). The Messaging Platform lets businesses send updates and offers to their customers, reply to customer messages and set up automatic replies, using Meta's official WhatsApp Business Platform.
This Privacy Policy explains how we handle personal data in these situations:
- when you visit eazywebsite.in or contact us;
- when you become our client or use the Messaging Platform;
- when a business uses the Messaging Platform to communicate with you.
2. Laws we follow
The Indian data protection laws this policy is written to meet.
We handle personal data in line with these laws:
- the Digital Personal Data Protection Act, 2023 and the rules made under it (together, the "DPDP Act");
- the Information Technology Act, 2000;
- the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.
Where we process data about people outside India, we also take the applicable local laws into account.
Terms such as "personal data", "Data Fiduciary", "Data Processor" and "Data Principal" have the meanings given in the DPDP Act. In simple words:
- a Data Fiduciary decides why and how personal data is used;
- a Data Processor handles personal data on behalf of a Data Fiduciary;
- a Data Principal is the person the data is about.
3. Our two roles
When we decide how data is used, and when we act on a client's instructions.
- When we are the Data Fiduciary. We decide how data is used for these people, and this policy applies directly to them:
- website visitors and people who send us enquiries;
- our clients;
- client staff who sign in to the Messaging Platform.
- When we are a Data Processor. A business that uses the Messaging Platform (our "client") decides whom to message and why. That client is the Data Fiduciary for its customers' data. We process that data only on the client's instructions and under our Terms of Service.
If you received a WhatsApp message from a business that uses our Messaging Platform, that business's own privacy notice governs how it uses your data. Section 11 explains how we can still help you.
4. Personal data we collect
What we collect, and where it comes from.
Data you give us
- Contact and business details: name, business name, designation, phone number, email address, business address, GSTIN and website. We collect these when you send an enquiry, sign up, or speak to our sales team.
- Account details: for people who use the Messaging Platform, their login email, a securely hashed password, user role and team membership.
- Billing records: plan, fees, invoices, payment references and tax details. We do not store card numbers or bank account numbers in the Messaging Platform.
- Support communications: emails, chat messages and call notes when you contact us.
Data we receive from Meta when you connect WhatsApp
Clients connect their WhatsApp Business Account to the Messaging Platform through Meta's Embedded Signup. You sign in with your own Meta credentials on Meta's own screens. We never see or store your Facebook or Meta password. With your permission, Meta shares the following with us:
- identifiers for your business portfolio, WhatsApp Business Account and business phone number;
- your WhatsApp business display name, phone number status, quality rating and messaging limits;
- an access token that lets the Messaging Platform act only on the WhatsApp assets you chose to share. We store this token in encrypted form.
We use this data only to provide the Messaging Platform to you. You can remove our access at any time; see our Data Deletion Instructions.
Customer data we process for our clients
When clients use the Messaging Platform, we process the following on their behalf:
- their customers' names, phone numbers and WhatsApp user identifiers;
- consent and opt-out records;
- tags and custom fields the client adds;
- the content and media of messages sent and received;
- delivery and read status.
A client may connect a number it already uses on the WhatsApp Business app. In that case, at the client's request and where Meta permits, we may also import that number's existing contacts and recent chat history.
Data collected automatically
When you use our website or the Messaging Platform, we collect technical data: IP address, browser and device type, pages visited, timestamps and error logs. Some of this is collected through cookies, as described in our Cookie Policy.
5. How we use personal data
The purposes we use data for.
- To provide, operate and maintain our website, the Messaging Platform and our development services.
- To onboard clients, connect their WhatsApp Business Accounts and verify their identity.
- To send, receive and track WhatsApp messages as our clients instruct, including campaigns, inbox replies and automatic replies.
- To apply opt-outs, consent rules and messaging limits.
- To invoice clients and keep accounting and tax records.
- To provide support and send service notices, such as security alerts and changes to our policies.
- To detect and prevent spam, fraud, abuse and security incidents.
- To send you information about our own services where you have agreed to receive it. You can opt out at any time.
- To comply with the law and respond to valid legal requests.
We do not sell personal data. We do not use our clients' customer data for our own marketing, for advertising, or to serve any other client.
6. Why we are allowed to use it
The legal grounds we rely on.
We process personal data on one of two grounds:
- Your consent.
- A legitimate use permitted under the DPDP Act. For example, when you have voluntarily given us your data to receive a service you asked for, or when we need to process data to comply with the law.
Where we rely on your consent, you can withdraw it at any time by writing to us. Withdrawing consent does not affect processing we carried out before you withdrew it.
For customer data we process for clients, the client must have a valid basis before uploading anyone's data or messaging them. This includes their WhatsApp opt-in.
8. Where data is stored
Storage location, and transfers outside India.
- Our hosting. We host the Messaging Platform on Amazon Web Services in India (Mumbai region).
- Meta's systems. WhatsApp is operated by Meta, so message content and related data also pass through Meta's systems under Meta's own terms. These systems may be located outside India.
- Other service providers. Some of our service providers may process limited data outside India.
We transfer personal data outside India only as permitted under the DPDP Act.
9. How long we keep it
Retention periods, and what happens when you leave.
| Data | How long we keep it |
|---|---|
| Client account and business details | While your account is active, and up to 90 days after it closes |
| Message content and media | As set by the client. By default, 12 months from the date of the message |
| Contacts | Until the client deletes them or the account closes |
| Consent and opt-out records | As long as needed to honour opt-outs and to prove compliance, which may be longer than the other data |
| Invoices and tax records | As long as Indian tax and accounting laws require (generally up to 8 years) |
| Technical logs and webhook records | Up to 30 days, or longer if needed to investigate a security incident |
| Backups | Replaced on a rolling basis within 35 days |
When a client closes their account, they have 30 days to export their data. Within the following 60 days, we delete or anonymise the data, except data the law requires us to keep.
10. How we protect it
The safeguards we use.
- Encryption in transit (HTTPS/TLS) and at rest.
- WhatsApp access tokens encrypted separately and never exposed in the browser.
- Role-based access: each user sees only what their role allows, and each client sees only its own data.
- Staff access only when needed to provide support or keep the service secure, with activity logged.
- Regular backups and monitoring.
No system is completely secure. If a personal data breach happens, we will inform the affected clients and individuals, and the Data Protection Board of India, as the DPDP Act requires. If you believe your account has been compromised, write to us immediately at support@eazywebsite.in.
11. Your rights and choices
What you can ask us to do, and how.
Under the DPDP Act, you can ask us to:
- give you a summary of the personal data we hold about you and how we use it;
- correct, complete or update data that is inaccurate or incomplete;
- erase data we no longer need, or data you have withdrawn consent for, unless the law requires us to keep it;
- stop processing data based on consent you have withdrawn;
- let another person you nominate exercise your rights if you die or become unable to do so;
- resolve a grievance about how we handle your data.
To make a request, write to our Grievance Officer (section 15). Use the email address linked to your account, or include enough detail for us to identify you. We may need to verify your identity. We acknowledge requests within 3 business days and respond within 30 days.
If you received messages from a business that uses our Messaging Platform:
- Reply STOP in the chat to stop marketing messages from that business, or contact the business directly.
- You can also write to us with your phone number and the business's name. We will pass your request to the business and help it act on it.
If you are not satisfied with our response, you may complain to the Data Protection Board of India.
12. Children
Our services are for businesses.
Our services are meant for businesses and for people aged 18 or over. We do not knowingly collect personal data from children for our own purposes.
Clients must not use the Messaging Platform to message children unless they have verifiable consent from a parent or lawful guardian, as the DPDP Act requires.
14. Changes to this policy
How we tell you about updates.
We may update this policy when our services or the law change. When we do, we will change the "Last updated" date at the top of this page. For significant changes, we will also notify clients by email or in the Messaging Platform before the changes take effect.
15. Contact and Grievance Officer
How to reach us about privacy.
- Business
- EazyWebsite, a brand of StellarCart
- GSTIN
- 32DBIPR9609N1ZY
- Address
- 55, Krishnakripa House, Kuruppan Kulangara Road, Maruthorvattom East, Cherthala, Alappuzha, Kerala 688539, India
- Grievance Officer
- Krishnakumar P R
- Website
- eazywebsite.in
Write to us with the subject line "Privacy request". The Grievance Officer handles complaints about how we process personal data, within the timelines set by the DPDP Act and other applicable law.