This policy covers the StoreTalk platform, including the web dashboard and the StoreTalk Business mobile app.

StoreTalk ("we", "our", or "us") is a product of CityMapia, a technology company registered in Kochi, Kerala, India. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use the StoreTalk platform ("the Service") — a WhatsApp Business automation SaaS platform for businesses, available through the web dashboard and the StoreTalk Business mobile app for iPhone and iPad. By using StoreTalk, you agree to the collection and use of information as described in this policy. If you do not agree, please discontinue use of the Service.

2.1 Business Account Information When you register as a business on StoreTalk, we collect: • Business name, owner name, and email address • WhatsApp Business Account (WABA) ID and Phone Number ID • Facebook Business Manager ID • Subscription and billing information (processed by Razorpay) • API access tokens (encrypted at rest) 2.2 WhatsApp Platform Data Through the Meta WhatsApp Business API, we access and process on your behalf: • Customer phone numbers that interact with your WhatsApp Business number • Inbound and outbound message content (text messages) • Message delivery and read status • WhatsApp message template submission and approval status Important: WhatsApp message data is processed exclusively to deliver the automation services you have configured. We do not use customer message content for advertising, profiling, or any purpose beyond operating the Service on your behalf. 2.3 Usage Data We automatically collect platform usage data including: • Login activity and session information • Feature usage patterns (templates created, flows built, messages sent) • IP address and browser/device information 2.4 Mobile App Data If you use the StoreTalk Business mobile app, we also process a small amount of device data. Section 10 explains exactly what and why.

We use the data we collect solely for the following purposes: • Service delivery: Sending and receiving WhatsApp messages on behalf of your business • Automation execution: Running chatbot flows and message triggers you have configured • Template management: Submitting and tracking message templates with Meta on your behalf • Account management: Managing your WhatsApp Business Account settings via the Meta API • Analytics: Providing you with delivery, read rate, and flow performance metrics • Billing: Calculating conversation usage for subscription invoicing • Support: Diagnosing technical issues when you raise a support request • Notifications: Alerting you and your team to new customer messages, including push notifications on the mobile app • AI features: When your business turns on AI replies, voice transcription or translation, the relevant message content is processed by our AI providers (see Section 4) to produce that output We do not sell, share, rent, or trade Platform Data with third parties for their own marketing purposes. Our access to and use of data obtained through the WhatsApp Business API ("Platform Data") complies with Meta's Platform Terms and the WhatsApp Business Solution Terms. We use Platform Data solely to provide and operate the Service on your behalf, and we retain it only for as long as necessary to do so.

We share data only with the following service providers, strictly to operate the platform: • Meta Platforms, Inc.: WhatsApp Business API (underlying messaging platform) • Razorpay: Payment processing and subscription billing • Hetzner Online GmbH: Server infrastructure (EU data centers in Germany and Finland) • Cloudflare, Inc.: CDN, DNS, file storage (R2) and AI inference (Workers AI) • Apple Inc.: Delivering push notifications to the StoreTalk Business iOS app (Apple Push Notification service) • Google LLC, OpenAI, L.L.C. and Anthropic, PBC: AI models that power AI replies, voice transcription and translation, used only when your business turns those features on AI providers receive only the content needed to produce a response. We use them under business API terms that do not allow them to use your data to train their models. Customer message content is never sent to AI providers unless your business has turned on an AI feature.

• Conversation logs: Retained for 90 days (Starter), 1 year (Growth/Pro), as configured for Enterprise • Account data: Retained for the duration of your subscription plus 30 days after cancellation • Billing records: Retained for 7 years as required under Indian tax law • After retention periods, data is permanently deleted from our systems Deletion of WhatsApp Platform Data In line with Meta's Platform Terms, when you disconnect StoreTalk from your WhatsApp Business Account, close your account, or submit a deletion request, we delete the WhatsApp Platform Data we processed on your behalf within 90 days — except where we are legally required to retain certain records (for example, billing data under Indian tax law). To request deletion of your data, email hello@storetalk.app with the subject "Data Deletion Request". We will confirm completion within 30 days.

Your business customers (the end recipients of WhatsApp messages) can opt out of receiving messages from your business at any time by replying STOP to any message. StoreTalk automatically processes and respects opt-out requests in compliance with Meta's messaging policies. Businesses using StoreTalk are responsible for maintaining opt-out records and not re-contacting customers who have opted out.

Under India's Digital Personal Data Protection Act 2023, you have the right to: • Access: Request a copy of the personal data we hold about you • Correction: Request correction of inaccurate personal data • Erasure: Request deletion of your data (subject to legal retention obligations) • Grievance redressal: Raise a complaint with our Data Protection Officer To exercise these rights, email us at hello@storetalk.app. We will respond within 30 days.

We protect your data with the following measures: • API tokens and sensitive credentials are encrypted at rest using AES-256 • All data in transit is encrypted using TLS 1.2+ • Access to production systems is restricted to authorised personnel only • Regular security reviews and dependency audits

StoreTalk uses only essential cookies required to maintain your login session and platform functionality. We do not use advertising cookies or cross-site tracking cookies.

The StoreTalk Business app for iPhone and iPad lets you and your team use the Service on the go. It shows the same account data as the web dashboard, and it collects only what it needs to work: • Sign-in: Your email address and password are sent to StoreTalk to sign you in. Session tokens are stored in the iOS Keychain on your device. • Push notifications: If you allow notifications, we store your device's push token so we can alert you to new messages through Apple Push Notification service. You can turn notifications off at any time in iOS Settings. • Camera and photos: Used only when you choose to take or attach a photo, video or file to send to a customer. • Microphone: Used only while you record a voice note to send to a customer. • Phone contacts: Used only when you choose a contact to share with a customer, or save a customer to your phone. We never upload your address book. Only the contact you pick, and only the details you select, are sent. • Face ID / Touch ID: If you turn on App Lock, iOS checks your identity on the device. We never receive your biometric data. • On-device storage: Recent conversations and contacts may be kept on your device so the app opens quickly. They are deleted if you uninstall the app. The app shows no ads. It contains no third-party analytics, advertising or tracking SDKs, and it does not track you across other companies' apps or websites. Account deletion: You can ask us to delete your StoreTalk account and its data at any time. Email hello@storetalk.app with the subject "Account Deletion Request" from your registered email address. We will confirm completion within 30 days, subject to the retention rules in Section 5.

StoreTalk is a business tool for people aged 18 and over. It is not directed at children, and we do not knowingly collect personal data from anyone under 18.

We may update this Privacy Policy periodically. When we do, we will update the "Last updated" date at the top of this page and notify registered users by email for material changes.

For any privacy-related questions, data requests, or complaints: CityMapia Product: StoreTalk Location: Kochi, Kerala, India Email: hello@storetalk.app