Privacy Policy

1. Who we are and scope

This Privacy Policy explains how Vayce Innovations Private Limited, a company incorporated in India and operating the Hypersona platform (“Hypersona”, “we”, “us” or “our”), collects, uses, stores, shares, protects and deletes personal data.

The “Platform” includes https://hypersona.io, https://app.hypersona.io, our APIs, dashboards, integrations, communications, support services and any related feature that links to this Policy.

This Policy applies to: (a) business owners, administrators, marketers, developers, support agents and other authorised users of a Client account (“Client Users”); (b) customers and other individuals whose data a Client uploads, syncs or processes through Hypersona (“End Customers”); and (c) website visitors, prospects, applicants, support contacts and authorised integration users.

This Policy is a privacy notice. Where consent or another specific authorisation is required, Hypersona or the relevant Client will request it separately.

2. Our role for different data

Clients must process End Customer data lawfully, provide required notices, obtain valid permissions, respect communication preferences and issue only lawful instructions. Hypersona may refuse an instruction that we reasonably believe is unlawful, insecure or inconsistent with applicable platform rules.

3. Personal data we collect

4. How we use personal data

1. Create, authenticate, administer and support Client accounts and authorised users.
2. Provide messaging, inbox, automation, cart-recovery, template, analytics, attribution, wallet, AI, voice, API and integration features selected by the Client.
3. Process and route communications and End Customer data on a Client’s documented instructions.
4. Onboard and verify businesses, senders, phone numbers, domains, templates, connected assets and integrations.
5. Calculate usage, deduct wallet charges, process payments, issue GST invoices, prevent duplicate or fraudulent transactions and resolve billing disputes.
6. Provide support, troubleshoot errors, communicate service notices, manage incidents and respond to privacy or deletion requests.
7. Protect the Platform, recipients and Clients; enforce consent and opt-outs; detect abuse, spam, fraud and unlawful activity; and maintain audit records.
8. Analyse performance and improve features using aggregated, statistical or de-identified data where reasonably possible.
9. Comply with applicable law, binding legal process and channel/provider policies; and establish, exercise or defend legal claims.
10. Send product, educational or marketing communications to Client Users where permitted, with an unsubscribe option for non-essential messages.

5. Legal grounds, consent and messaging responsibility

The applicable legal ground depends on the person, purpose and jurisdiction. Under Indian law, personal data is processed for a lawful purpose with consent or another permitted use where and when applicable. Account, billing and essential service data may also be processed to take steps requested by a Client User, perform our agreement, protect the Platform, prevent fraud and comply with law.

For individuals in the EEA or United Kingdom, where applicable, we rely on performance of a contract, legitimate interests, consent and legal obligations. A person may contact privacy@hypersona.io for information about the ground used for a particular activity.

For End Customer communications, the Client is the sender and is responsible for valid channel-specific consent, DND and telecom compliance, message content, frequency, timing, audience selection and proof of permission. Clients must not upload purchased, scraped, rented or unlawfully obtained contact lists. Hypersona’s consent and suppression features assist compliance but do not transfer the Client’s legal responsibility to us.

6. AI, automation and voice processing

When a Client enables an AI or voice feature, relevant prompts, knowledge-base content, customer inputs, conversation context and call data may be sent to an AI, speech or telephony provider to generate a reply, transcription, summary, classification, recommendation or call response.

Hypersona does not use Client Content or End Customer personal data to train general-purpose models for other customers unless the Client expressly agrees in writing or through a clearly described opt-in feature. We require service providers to process data for the contracted service and apply confidentiality and security obligations appropriate to their role.

AI output can be inaccurate, incomplete or unsuitable. Clients are responsible for testing prompts and knowledge sources, configuring human escalation, reviewing high-risk uses and not using Hypersona to make solely automated decisions that create legal or similarly significant effects unless the Client has independently assessed and implemented the required safeguards.

Clients enabling recorded or automated voice calls must provide all legally required notices, obtain consent where required, comply with permitted calling windows and honour DND, opt-out and sector-specific restrictions.

7. Meta Platform Data

When a Client connects Meta, WhatsApp Business, Facebook or Instagram assets, Hypersona may receive business portfolio IDs, WABA IDs, phone-number details, page or Instagram account IDs, message templates, quality and messaging-limit information, access tokens, webhooks, delivery/read/failure events and inbound messages needed for the connected features.

• We use Meta Platform Data only for connected onboarding, account management, messaging, templates, inbox, analytics, support, security and deletion purposes disclosed to the Client.
• We do not sell, rent, license or broker Meta Platform Data, use it to create unrelated advertising profiles, or disclose it to data brokers or advertising networks.
• We logically separate Client environments and do not use one Client’s Meta Platform Data to benefit another Client except through aggregated, non-identifying service metrics.
• Access tokens and credentials are restricted, protected and used only for authorised actions.
• A Client may revoke access through Hypersona or Meta settings. We then stop new access and delete or de-identify associated tokens and Platform Data according to Section 11 and the Data Deletion Policy, subject to legal and security exceptions.
• We process valid user-data deletion requests received through Meta’s required mechanisms and provide confirmation or status information where required.

8. How we share personal data

9. International processing and data location

The Platform may process data in India and in other countries where our providers operate. Those countries may have different privacy laws. We use contractual, organisational and technical safeguards appropriate to the transfer and provider relationship. Clients are responsible for assessing any localisation or restricted-transfer requirement specific to their industry, customers or jurisdiction.

For EEA or UK restricted transfers, where applicable, the parties may use approved mechanisms such as Standard Contractual Clauses, the UK Addendum or another lawful transfer tool.

10. Data retention

We retain personal data only for the period reasonably necessary for the purpose described below, a Client’s valid instruction, security and dispute resolution, or applicable law. Actual retention may be shorter where the Client deletes data or configures a shorter period, and longer where a legal hold or binding requirement applies.

11. Security and personal-data breaches

We maintain reasonable technical and organisational safeguards proportionate to the nature and risk of processing. Controls may include:

• TLS or equivalent protection for data in transit and protection of stored credentials, access tokens and secrets.
• Role-based and least-privilege access, authentication controls, tenant separation and personnel confidentiality.
• Access logging, monitoring, rate limiting, dependency and vulnerability management, malware protection and secure change practices.
• Backups, recovery procedures, incident response, vendor assessment and contractual processor safeguards.
• Procedures to detect, investigate, contain, remediate and document personal-data breaches.

No system is completely secure. Clients are responsible for secure devices, strong credentials, appropriate user roles, API-key protection, lawful configuration and prompt reporting of suspected compromise to security@hypersona.io.

If we become aware of a personal-data breach affecting Client data, we will investigate, take reasonable containment and remediation steps, and notify the affected Client without undue delay, taking account of the nature of the processing and available information. Where Hypersona is the Data Fiduciary/controller, we will notify affected individuals and competent authorities within the timeline required by applicable law, including the applicable DPDP Rules timeline where and when that requirement is in force.

12. Rights and choices

Depending on applicable law and our role, an individual may request access to or a summary of personal data, correction, completion, erasure, withdrawal of consent, grievance redressal, nomination of another person where provided by law, objection or restriction, and a copy or export where available. These rights are subject to identity verification, legal exceptions, security requirements and our role as controller or processor.

Client Users may submit a request through available account settings or by emailing privacy@hypersona.io. End Customers should first contact the business that messaged them because that Client controls the purpose and use of their data. If an End Customer contacts us, we will identify and forward the request to the relevant Client and provide reasonable assistance.

Withdrawing consent does not affect processing already carried out lawfully and may prevent delivery of a requested feature. Essential service, security, billing and legal communications cannot be opted out of while the account remains active.

We aim to acknowledge privacy grievances promptly and respond within 30 days, or within another period required by applicable law. Where a person remains dissatisfied, they may use the escalation mechanism available under the applicable data-protection law.

13. Cookies and similar technologies

Hypersona may use: (a) strictly necessary technologies for login, security, load balancing and fraud prevention; (b) preference technologies for language, interface and saved settings; and (c) limited analytics technologies to understand product use and errors. We do not use third-party advertising cookies in the authenticated Platform unless this Policy and the consent interface are updated before doing so.

Browser settings can block or delete cookies. Blocking necessary cookies may prevent login or cause features to fail. Where applicable, a cookie banner or preference centre will provide additional choices. We do not currently respond to “Do Not Track” signals. Where a legally recognised opt-out signal applies to a future activity, we will process it as required.

14. Children

Client accounts are for adults acting for businesses. We do not knowingly allow anyone under 18 to create a Client account. Hypersona is not designed for Clients to intentionally target or profile children. A Client that lawfully processes a child’s data must first obtain verifiable parental consent and implement all required safeguards, notices and restrictions. We may suspend a configuration that presents an unacceptable child-safety or compliance risk.

15. Third-party sites and services

The Platform may link to or connect with third-party services. Their privacy practices and terms apply independently. Hypersona is not responsible for a third party’s independent processing after data is transmitted under the Client’s instruction or when a person leaves our website.

16. Changes to this Policy

We may update this Policy to reflect legal, product, vendor, security or operational changes. We will revise the “Last updated” date and provide reasonable advance notice of material changes through email, dashboard notice or the website, unless an urgent legal or security change requires earlier effect.

17. Contact and grievance channel