Privacy Policy

AgatePro ("we," "us," or "our") is a business software platform registered in India. We operate the AgatePro service at mbglobalagate.com.

• Address: Khambhat, Gujarat, India – 388 620
• Data Contact: privacy@mbglobalagate.com
• Response time: 30 days for all data requests

2a. From Business Owners (Sellers — our customers)

• Name, email address, phone number, business name, GSTIN
• Instagram Business Account ID and connected Facebook Page ID (obtained via Meta's official OAuth flow — only when you choose to connect)
• WhatsApp Business Account (WABA) ID and Phone Number ID (obtained via Meta's official Embedded Signup — only when you choose to connect)
• Content of Instagram Direct Messages and WhatsApp messages received in your business account — processed solely to generate and send customer replies on your behalf
• Buyer inquiry data from IndiaMart and Alibaba (forwarded to us by you via email forwarding or API)
• Dashboard usage data (login times, features used, reply counts) for service quality
• Payment reference IDs and GST invoice data (processed by Razorpay — we store only order/subscription IDs, not card numbers)

2b. From Buyer Contacts (third parties who message your business)

• Instagram User ID of a person who sends a DM to your connected Instagram Business account
• WhatsApp number of a person who messages your connected WhatsApp Business number
• Name (if provided), inquiry text, product queries — solely to generate an appropriate reply
• Contact information from IndiaMart and Alibaba inquiry emails (buyer name, phone/email, country, product interest)

• Instagram and WhatsApp message data: Contract performance — we process this data only because you (the seller) have contracted us to reply to your customers on your behalf.
• Buyer contact information: Legitimate interest — sellers have a legitimate business interest in managing customer inquiries received on platforms they operate.
• Payment and tax data: Legal obligation under the GST Act, 2017 (India).
• Account data: Contract performance for providing the AgatePro service.

• We access Instagram Direct Messages only to enable the automated customer reply feature. When a buyer sends a DM to your business Instagram account, we read that message to generate an appropriate reply and send it back on your behalf.
• We access WhatsApp messages only to enable the automated customer reply feature on your WhatsApp Business number.
• We do not use Meta platform data for advertising targeting or audience building.
• We do not sell, license, or share Meta platform data with any third parties for their own use.
• We do not use Meta platform data to train artificial intelligence or machine learning models.
• AI processing (via Anthropic Claude API): Message content is sent to Anthropic solely to generate a reply draft. Per Anthropic's API terms, input data is not retained or used for model training.
• Message content is stored encrypted (AES-256-GCM) and automatically deleted after 90 days of inactivity.
• We apply the principle of minimum necessary access — we request only the permissions required to deliver the specific feature you have enabled.
• You can revoke AgatePro's access to your Instagram or WhatsApp account at any time by visiting your Meta Business Settings and removing AgatePro from your connected apps.

We share data only with the following service providers, strictly as necessary to operate the AgatePro service:

• Anthropic (Claude API): Message content is sent for AI reply generation. Anthropic does not retain API input for training.
• Google (Gemini API): Used only to generate product listing copy from a seller's own catalogue entries, when a seller asks for it. Buyer messages and buyer contact details are never sent to Google.
• Supabase (Database): All data is stored in Supabase Postgres hosted in the Mumbai region (ap-south-1, India).
• Vercel (Hosting): Application hosting. No business data is permanently stored on Vercel beyond short-lived request logs.
• Razorpay (Payments): Payment processing. Razorpay is an independent data controller for payment information.

We never share your data with advertisers, data brokers, marketing companies, or any other businesses for their own purposes.

• Message content (Instagram DMs, WhatsApp messages): 90 days after the last activity in the conversation, then permanently deleted.
• Buyer contact information: Retained while your seller account is active, plus 30 days after account cancellation.
• Account and profile data: Deleted within 30 days of a verified deletion request or account cancellation.
• Payment and tax records: Retained for 7 years as required by the GST Act, 2017 (India).
• Access tokens for Meta accounts: Stored encrypted and immediately revoked when you disconnect your Instagram or WhatsApp account.

Under the Digital Personal Data Protection Act, 2023 (India) and, where applicable, the GDPR (for EU-based users), you have the following rights:

• Right to Access: Request a copy of all data we hold about you. Email privacy@mbglobalagate.com.
• Right to Correction: Edit your profile and business details directly in the AgatePro dashboard.
• Right to Deletion: Dashboard → Settings → Delete Account. All your data is permanently erased within 30 days. Buyer contact data linked to your account is also deleted.
• Right to Export: Dashboard → Settings → Export My Data. Download all your inquiries and buyer contacts as a CSV file.
• Right to Restrict Processing: Disconnect any channel (Instagram, WhatsApp) at any time to stop us processing data from that channel.
• Revoking Meta Access: Visit Meta Business Settings → Apps → Remove AgatePro. This immediately revokes all access to your Instagram and WhatsApp data.

• Session cookies only: Used for authentication (keeping you logged in). No advertising cookies.
• Analytics, with consent: We use Google Analytics to understand site usage. It loads only after you accept analytics cookies in the consent banner (Google Consent Mode v2, denied by default). We do not embed Facebook Pixel or any advertising/retargeting scripts.
• No cross-site tracking: Your activity on AgatePro is not shared with any advertising platforms.

• AgatePro is a registered Meta Tech Provider operating under Meta's Platform Terms and Developer Policies.
• Access to Instagram and WhatsApp data is granted exclusively by business owners (sellers) through Meta's official OAuth and Embedded Signup authorization flows. We never collect passwords.
• Business owners can revoke AgatePro's access at any time through Meta Business Settings. Upon revocation, we cease all data processing within 24 hours and delete associated tokens immediately.
• We maintain and comply with Meta's data deletion callback requirement. When a user removes our app from Meta, we receive a deletion signal and process it within 30 days. View our Data Deletion Policy →
• We do not scrape Meta platforms, access any data beyond what is explicitly authorized by the business owner, or violate Meta's Messaging Policy regarding spam or unsolicited communications.

• All data is encrypted in transit (TLS 1.2+) and at rest (AES-256-GCM for sensitive fields such as API tokens).
• Database hosted in India (Mumbai, ap-south-1) with row-level security.
• Access tokens for third-party services are never stored in plaintext.
• Security issues: email security@mbglobalagate.com.

We may update this Privacy Policy from time to time. When we make material changes, we will notify sellers via email and update the "Last updated" date at the top of this page. Continued use of AgatePro after such notice constitutes acceptance of the revised policy.

For all privacy-related inquiries, data requests, or complaints:

• Email: privacy@mbglobalagate.com
• Address: AgatePro, Khambhat, Gujarat, India – 388 620
• Response time: We respond to all privacy requests within 30 days.

For data deletion requests related to Meta platform data, you may also revoke access directly via Meta Business Settings.