Privacy Policy & Data Governance

1. Overview & DPDP Act 2023 Alignment

Jhatpatly ("we", "our", "us") is an India-headquartered SaaS platform offering social media post scheduling, comment-to-DM automation, and multi-channel analytics. We process personal data in strict alignment with India's Digital Personal Data Protection (DPDP) Act, 2023 as well as international data protection principles (GDPR/CCPA).

This policy outlines the categories of personal data collected, lawful bases for processing (explicit consent), purpose limitation, data retention schedules, cross-border transfer rules, and how you as a Data Principal can exercise your statutory rights.

3. Personal Data Collected & Purpose Limitation

We collect personal data strictly necessary to deliver the requested social media management and automation services:

• Account Credentials: Full name, email address, password hash, and 2FA authentication state.
• OAuth Tokens: Short-lived and long-lived OAuth access tokens for Instagram, Facebook Pages, X (Twitter), and LinkedIn.
• Technical & Session Data: IP address, device type, browser, OS, and city/country level location for security logging.
• Content & Analytics: Post captions, media assets, schedule times, comment interaction logs, and post performance metrics.

4. Lawful Basis & Explicit Consent Capture

In compliance with DPDP Act Section 6, data processing is conducted exclusively on the basis of free, specific, informed, unconditional, and unambiguous consent given at signup or during social account connection. Consent can be revoked at any time by disconnecting social profiles or deleting your Jhatpatly account.

5. Data Retention & Erasure Schedule

We retain personal data only for as long as your account remains active. Upon initiating "Delete My Account":

• All connected OAuth tokens and secret credentials are destroyed immediately.
• Account data enters a 30-day soft-deletion purge queue, after which all database records and media assets are permanently purged.

6. Cross-Border Data Transfer & Infrastructure

Personal data is stored and processed on secure cloud infrastructure adhering to international security standards (AES-256 encryption at rest, TLS 1.3 in transit). Cross-border transfers to cloud data centers comply with notified Central Government rules under the DPDP Act 2023.