Effective date: 13 October 2026
How MessageBhejo, the WhatsApp Business software platform operated by Simpleops Private Limited, collects, uses, shares and protects personal data, and the rights you have over it.
This summary is for convenience only. The full Policy below governs. This Policy is available in Hindi on request.
1.1 Simpleops Private Limited ("Simpleops", "we", "us" or "our"), a company incorporated under the Companies Act, 2013 with its registered office at First Floor, 2570, Near Raja Harish Chandra Marg, Sector E, Sudama Nagar, Indore, Madhya Pradesh 452012, India, operates the WhatsApp Business software platform marketed as MessageBhejo, including the website at messagebhejo.com, its sub-domains, applications and APIs (together, the "Service").
1.2 This Privacy Policy is the notice required by the Digital Personal Data Protection Act, 2023 and the rules under it, by the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and by the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021. It also describes how we handle data received through Meta's WhatsApp Business Platform and through Google sign-in.
1.3 It applies to visitors of our website, to people who register or are invited to use the Service ("you", "Users"), and, as described in Section 2, to the personal data of the people our customers message through the Service. It forms part of our Terms of Service.
1.4 Our group company Gems Essence Infotech Pvt Ltd develops the MessageBhejo software and is the approved Meta Tech Provider through which your WhatsApp Business account is connected. It processes data only on our instructions. Simpleops Private Limited remains responsible for your data.
2.1 Your data: we are the Data Fiduciary. For the personal data of Users, of website visitors and of people who contact us, we decide the purpose and means of processing. This Policy describes that processing in full.
2.2 Your Customers' data: you are the Data Fiduciary, we are your Data Processor. The contacts you upload, the people who message your WhatsApp number and the content of those conversations ("Customer Data") are processed by us only on your instructions, given through the Service and the Terms of Service, and only to provide the Service to you. You decide what to collect, whom to message and why. You are responsible for having a lawful basis and for giving your customers the notices the law requires. Our processor commitments are set out in the Terms of Service.
2.3 If you are a customer of a business that uses MessageBhejo and you have a question about how that business handles your data, please contact that business first. We will help it respond. You may also contact our Grievance Officer (Section 17).
We collect the following categories of personal data. We do not collect more than we need for the purposes in Section 5.
| Category | What it includes | Whose data |
|---|---|---|
| Account and sign-in data | Name, email address, mobile number, password (stored only as a one-way hash), role, Google account identifier and profile name and picture if you sign in with Google, email and phone verification status, sign-in and lock-out timestamps. | Users |
| Business and billing data | Business name, address, GSTIN where you give one, invoices, payment references (UPI or bank transaction IDs). We never receive or store full card numbers or bank passwords. | Users, your business |
| WhatsApp Business Account data | WhatsApp Business Account ID, phone number IDs, display names, business verification and quality status, message templates and their approval status, access tokens (encrypted at rest), webhook configuration. | Your business |
| Customer Data (processed for you) | Contacts' phone numbers, names, WhatsApp profile names, tags, notes, custom attributes, opt-in and opt-out status; the content, media references, timestamps and delivery status of messages; chatbot session histories; campaign audiences; files you import or export. | Your customers |
| Integration data | Tokens and identifiers for integrations you connect, and the event data those systems send us (for example a delivery or a bill) to trigger messages. | Your business, your customers |
| Usage and technical data | IP address, browser and device type, pages and features used, API calls, timestamps, error reports and security events such as failed sign-ins and rate-limit hits. | Users, visitors |
| Support and sales communications | Emails, WhatsApp chats and calls with our team, and the name, phone number and source you give us when you request a demo on our website. | Users, visitors |
Message content and contact lists may include whatever your customers choose to write or you choose to store. Do not store sensitive personal data such as health, financial account, biometric or caste information in the Service unless your own lawful basis permits it.
5.1 We use personal data for these purposes, each of which is necessary to provide the Service you have asked for or is a legitimate use permitted by Section 7 of the Digital Personal Data Protection Act, 2023:
5.2 Consent. Where we rely on your consent, for example to send you marketing about our own products, you may withdraw it at any time as easily as you gave it, by using the unsubscribe link or writing to us. Withdrawal does not affect processing already done, or processing that does not depend on consent.
5.3 What we never do. We do not sell or rent personal data. We do not use personal data or message content for advertising, profiling for third parties, or to train artificial-intelligence models. We do not read your conversations except where you ask us to for support, or where law or the investigation of abuse requires it.
5.4 Google user data. Data received from Google sign-in is used only to create and authenticate your Account and to show your name and picture inside it. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We do not transfer Google user data to anyone except as needed to provide the Service, comply with law or as part of a merger or acquisition with notice to you.
6.1 MessageBhejo uses the official WhatsApp Business Platform (Cloud API) provided by Meta. When you connect your WhatsApp Business Account, Meta becomes a party to your use of WhatsApp under the Meta Terms for WhatsApp Business Platform, the WhatsApp Business Messaging Policy and Meta's own privacy terms. Messages are transmitted and, where Meta's terms say so, temporarily stored by Meta on its own infrastructure, which may be outside India.
6.2 We use WhatsApp Business Platform data solely to provide messaging services on your behalf. We do not use it for advertising, resale, model training or any purpose unrelated to the Service, and we do not share it with anyone other than the parties listed in Section 7.
6.3 Media (images, documents, audio, video) is fetched from Meta when you open it in the inbox and is not kept on our servers. Meta deletes media after its own retention period, after which it is no longer available in the Service unless you have downloaded it.
6.4 When you register, we send a one-time verification code to your mobile number as a WhatsApp message from our own business number. Your number is processed by Meta to deliver that message.
6.5 Our group company Gems Essence Infotech Pvt Ltd is the Meta Tech Provider through which your account is connected. Under Meta's Platform Terms it processes platform data only on behalf of and at the direction of Simpleops Private Limited and you.
9.1 Location. The Service, its database and its backups are hosted on servers located in India. Meta, Google and Cloudflare process the data described above on their own infrastructure, which may be outside India (see Section 14).
9.2 Safeguards. We apply reasonable security practices and procedures of the kind the Information Technology Act, 2000 and the Digital Personal Data Protection Rules require, including: encryption of data in transit (TLS); one-way hashing of passwords; encryption at rest of WhatsApp access tokens and other secrets; role-based access within Accounts; verification of email and mobile number; rate limiting, bot protection and account lock-out after repeated failed sign-ins; signed webhooks; access controls and logging on our infrastructure; and regular backups.
9.3 No method of transmission or storage is completely secure. You are responsible for keeping your passwords, API keys and devices secure, for assigning roles carefully, and for removing Users who leave your business.
10.1 We keep personal data only as long as needed for the purposes above or as the law requires, then delete or anonymise it:
| Data | Kept for |
|---|---|
| Account, WhatsApp Business Account and Customer Data | While your Account is active. After cancellation or closure, available for export for 30 days, then deleted within 90 days, except as the law requires us to keep it. |
| Message media | Not stored by us; fetched from Meta on demand while Meta retains it. |
| Invoices, payment records and tax data | 8 years from the end of the relevant financial year, as tax and company law require. |
| Security, access and traffic logs | 180 days, the minimum the CERT-In directions of April 2022 require of every Indian service provider; one year once Rule 8(3) of the Digital Personal Data Protection Rules, 2025 takes effect. |
| Demo requests from the website | Until your enquiry is closed or you ask us to delete it, whichever is earlier. |
| Support correspondence | While your Account is active and for the period above after closure, to handle follow-up questions and claims. |
| Backups | Purged on a rolling basis within the deletion period above. Data in backups is not restored to live systems after deletion except to recover from a disaster. |
10.2 We may keep data longer where needed to comply with a legal obligation, resolve a dispute, enforce our agreements or investigate abuse, and we may retain de-identified statistics indefinitely.
10.3 You are responsible for exporting Customer Data before the export window ends. Meta deletes WhatsApp Business Platform data when a WhatsApp Business Account is terminated and provides no backups.
11.1 Under the Digital Personal Data Protection Act, 2023 and other applicable law, you have the right to:
11.2 How to exercise them. Users can update their name, email and mobile number and delete their Account from the settings pages. For anything else, write to our Grievance Officer (Section 17) from the email address registered on your Account, or with enough detail for us to verify your identity. We will acknowledge your request within 24 hours and respond within 30 days or any shorter period the law prescribes. We will tell you if we need more time, if we must refuse all or part of a request, and why.
11.3 Customer Data. If your request concerns data that a business processes through MessageBhejo, we will forward it to that business or ask you to contact it directly, because that business decides how your data is used. We will help it respond.
11.4 Your duties. When exercising rights you must not impersonate anyone, suppress material information or file a false or frivolous complaint, and you must give only data that is accurate.
If you use MessageBhejo to message your own customers, you are their Data Fiduciary. You must:
The Service is for businesses and may be used only by people aged 18 or over. We do not knowingly collect personal data from children. If you believe a child has created an Account, write to our Grievance Officer and we will delete it. Businesses that message children through the Service must themselves obtain verifiable parental consent as the Digital Personal Data Protection Act, 2023 requires.
14.1 We store personal data in India. Some recipients listed in Section 7, in particular Meta, Google and Cloudflare, operate globally and may process data outside India under their own terms and safeguards. By using WhatsApp, Google sign-in or our protected forms, you accept that processing.
14.2 We will not transfer personal data to any country or territory that the Government of India has restricted under Section 16 of the Digital Personal Data Protection Act, 2023.
14.3 If you message people outside India, you are responsible for complying with the data protection law of their country.
15.1 If a personal data breach affects data for which we are the Data Fiduciary, we will notify each affected person and the Data Protection Board of India in the manner and within the time the Digital Personal Data Protection Act, 2023 and its rules require, describing the nature of the breach, its likely consequences, the measures taken and how to reduce the risk.
15.2 If a breach affects Customer Data we process for you, we will notify you without undue delay after becoming aware of it, with the information available to us, so that you can meet your own notification duties. We will also report cyber-security incidents to CERT-In where the law requires.
16.1 We may update this Policy. The current version, with its effective date, is always published at messagebhejo.com/privacy. Material changes, including new categories of data, purposes or sub-processors for Customer Data, will be notified by email to Account owners or in-app at least 15 days before they take effect, unless the change is required by law, in which case it may take effect immediately.
16.2 Continued use after the effective date is acceptance of the updated Policy. If you do not agree, stop using the Service and exercise your rights under Section 11.
17.1 Grievance mechanism. Our Grievance Officer handles questions, requests and complaints about personal data under the Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000 and the rules under them, and the Consumer Protection (E-Commerce) Rules, 2020. Write from the email registered on your Account, or with enough detail for us to verify you, describing the issue and what you want us to do. We acknowledge every complaint within 24 hours and resolve it within 30 days, or within any shorter period the law prescribes for that type of complaint. If you are not satisfied with our response, you may complain to the Data Protection Board of India.
17.2 Contact details.
Simpleops Private Limited
First Floor, 2570, Near Raja Harish Chandra Marg, Sector E, Sudama Nagar, Indore, Madhya Pradesh 452012, India
Email: support@simpleops.co.in
WhatsApp: +91 62657 54402
Grievance Officer
Email: support@simpleops.co.in
Postal address: as above.
17.3 Group company and Meta Tech Provider. Gems Essence Infotech Pvt Ltd, 2nd Floor, Surya Avenue, Indore 452012, India.
Last reviewed: 13 October 2026. Earlier versions are available on request.