Data protection and India's DPDP Act

India's Digital Personal Data Protection Act, 2023 and its Rules, 2025 set the rules for how businesses handle people's personal details. The main duties start in May 2027. We follow them already, and this page says in plain words what that means for you. It sits alongside our Privacy Policy, Terms and Data Processing Agreement.

Who is responsible for what

• Your own details (you, as a business owner using RateKaro): RateKaro decides how they are used, so RateKaro is responsible for them.
• Your customers' details (names and phone numbers you add): you decide why they are used, so you are responsible for having their permission. RateKaro handles them only on your instructions, to send the review requests you set up.

If you are a business using RateKaro

• When you sign up, you accept the Terms, the Privacy Policy, the Data Processing Agreement and your responsibility for your customers' permission. We keep a record of each, with its version and the time.
• Before you add customers, you must have their permission to message them, you must have told them how their details are used, and none may be under 18. We ask you to confirm this every time you add or upload customers, and we record who confirmed and when.
• Every message names your business and tells the customer they can reply STOP. The first message to a customer you uploaded also says why they are receiving it and links to how their details are used.
• If something goes wrong with your customers' data, we tell you without delay so you can meet your own duty to inform the people affected and the Data Protection Board.

If you received a message from a business through RateKaro

• To stop messages: reply STOP. We stop all further messages from that business to your number.
• To see, correct or delete your details, or to withdraw your permission: email privacy@ratekaro.in with the business name and the phone number involved. We act on it and pass it to the business where needed.
• To complain: write to our Grievance Officer, Rituparno Majumdar, at the same address. If you are not satisfied, you can complain to the Data Protection Board of India.

How we protect data

• Connections to our servers are encrypted. The database cannot be reached directly from the internet; it is reached only through our servers.
• We keep a record, for at least one year, of who accessed personal data (the record does not hold the details themselves).
• We take a nightly encrypted backup of the database.
• Passwords are handled by our login provider and are never kept by us in readable form. One-time login codes are not stored in readable form. The access tokens we hold for a business's Google or WhatsApp connection are not yet encrypted in our database; we are moving them to encrypted storage.

Who helps us run RateKaro

These services can handle personal data on our behalf:

• Supabase: database and logins (Mumbai, India).
• Vercel: runs the website and its servers (United States).
• Meta (WhatsApp Business Platform): delivers WhatsApp messages.
• OpenRouter and the AI model providers it uses: only if a business uses AI reply drafting, and only for public review text, rating and business name.
• Google: reads public reviews and posts replies when a business connects its Google account.
• Razorpay: subscription payments for businesses (India).
• GoDaddy (Titan Email): sends account and billing emails to business owners.
• A private server we run, hosted by aiccloud (an Indian company), with the server located in France: monitoring and encrypted backups.

Some of these are outside India. The Act allows this unless the Government restricts a country, and we will follow any restriction.

Questions

Privacy questions and requests: privacy@ratekaro.in. To report a security problem: security@ratekaro.in. This page is information, not legal advice, and we update it as the law and our service change.