Privacy Policy

This policy concerns three groups of people:

• Merchants - businesses that create a MetaBaskets account, and the team members they invite. For Merchant account data, MetaBaskets is the data fiduciary / controller.
• End Users - a Merchant's customers who talk to that Merchant's AI agent by WhatsApp, Instagram, website chat, email or phone, or who receive the Merchant's campaigns.
• Store Visitors - people who browse a Merchant's online store where the Merchant has enabled MetaBaskets' chat widget and visitor analytics.

For End User and Store Visitor data, the Merchant decides why and how that data is used and is the data fiduciary / controller; MetaBaskets acts as a data processor on the Merchant's documented instructions. If you are an End User or Store Visitor, please contact the business you interacted with first - we will help them respond to you.

2.1 Merchants and team members

• Account details: business name, email address, role, and a password stored only as a salted one-way hash (never in readable form).
• Sign-in and security data: one-time verification codes (stored only as hashes and valid for 10 minutes), the secret for an authenticator app if you enable two-step verification (encrypted), recovery codes (stored only as hashes), signed-in sessions and trusted devices (IP address, browser and device type, time of sign-in and last activity), and a security activity log (sign-ins, failed attempts, password and two-step changes).
• Business profile and settings: store address and hours, website, agent name, persona and instructions, campaign content and templates.
• Website profile: when you add your website, we read its public pages and extract business details already published there (for example address, phone, opening hours, owners or team named on the site) so your agent can answer accurately. You can view and refresh this on the Knowledge page.
• Integration credentials for services you connect (Shopify, WooCommerce, WhatsApp / 360dialog, Instagram, Razorpay, Twilio, your own email (SMTP) account) - encrypted at rest with AES-256-GCM and never shown back in full.
• Knowledge content you upload: documents, web pages, images and FAQs.
• Service and usage logs: requests, AI tool calls, errors and audit events, used for reliability, security and support.

2.2 End Users (processed for the Merchant)

• Identifiers: WhatsApp phone number, Instagram account ID, email address, or an anonymous website-chat ID; the name shown on the messaging profile.
• Conversation content: text messages, photos and voice notes (voice notes are converted to text, and a copy of each photo and voice note is stored so the Merchant's team can see and play it in the inbox), files the Merchant's team sends, any text the AI reads from a photo and, for phone calls with the voice agent, the call audio processed in real time and its transcript. If a Merchant turns on call recording, the call is recorded and the caller is told at the start of the call.
• Order and checkout details an End User chooses to provide - such as name, phone, email, delivery address, city and PIN code, cart items, and order numbers - used to look up orders, prepare carts and create payment links. Card and UPI details are entered on the payment provider's page; MetaBaskets never sees or stores them.
• Marketing preferences: campaign delivery and reply status, WhatsApp/Instagram “STOP” opt-outs, and email unsubscribes.
• A rolling AI-generated summary of the conversation, so the agent remembers context.
• AI chat analysis for the Merchant's dashboard: for each customer chat, the sentiment, buying stage, products and budget mentioned, likely reason for not buying, and the customer group this places them in (which the Merchant may use to choose who receives a campaign).

2.3 Store Visitors (storefront analytics, processed for the Merchant)

When a Merchant enables visitor analytics, a small script in the store's chat widget records, for each page viewed:

• The page address and title, product or collection viewed, on-site search terms, time spent on the page, and the referring website or campaign (UTM) tags.
• Device type, operating system, browser, language and screen size.
• Approximate location - country, and where available state and city - derived from the visitor's IP address by our network provider (Cloudflare). We do not store the IP address itself; we keep only a keyed, one-way hash of it to count unique visitors. We never use GPS or device location for this.
• A random visitor ID and visit (session) ID kept in the browser's local storage, so repeat visits and the chat can be recognised as the same browser. If the visitor is signed in to the store, the store's customer number (verified with a signature from the store).
• A hidden attribute on the store cart containing the visitor ID, so that an order can be matched to the visit that led to it. When a Store Visitor places an order or completes the chat checkout, the Merchant can see the details the visitor gave for that order (such as name and delivery area) alongside their visits.

We do not use device fingerprinting, cross-site tracking, third-party advertising cookies, or covert collection of contact details. Visitors who decline analytics in the store's cookie banner (Shopify Customer Privacy) or whose browser sends a Global Privacy Control signal are not counted.

We do not sell personal data, do not share it for advertising, and do not use Merchant, End User or Store Visitor content to train general-purpose AI models.

Replies are generated automatically by an AI model. By default this model runs on servers operated for MetaBaskets. A Merchant can instead choose an external AI model (currently Claude Haiku, made by Anthropic and reached through OpenRouter) for chat replies, for reading customer photos, or for both; the message or photo being processed, the recent conversation and the relevant product details are then sent to those providers to produce the reply. We ask OpenRouter to use only providers that do not collect this data for training. Answers about products, prices, stock and orders are checked against the Merchant's own systems before they are sent. The agent does not make decisions that have legal or similarly significant effects on End Users; any End User can ask to speak to a person, and Merchants can review and take over any conversation from the inbox. AI output can occasionally be inaccurate - Merchants remain responsible for their offers, prices and policies.

We share personal data only with the service providers needed to run MetaBaskets, under contracts that require them to protect it:

When a customer opens a cart link from a chat, checkout happens on the Merchant's own store, using the checkout and payment providers the Merchant has chosen (for example GoKwik or Razorpay), under the Merchant's and those providers' policies. MetaBaskets reads the payment method name on the resulting order for the Merchant's reports.

We may also disclose data where required by law, to protect the rights and safety of users or the public, or as part of a merger or acquisition (with notice to affected Merchants).

• Each Merchant's data is logically isolated; every request is checked against the Merchant it belongs to.
• Credentials, authenticator secrets and sensitive tokens are encrypted at rest (AES-256-GCM); passwords, verification codes and recovery codes are stored only as hashes.
• Traffic is encrypted in transit (HTTPS/TLS). Internal databases are not reachable from the internet.
• Sign-in is protected by two-step verification (email code or authenticator app), rate limits and account lockout; sessions last 24 hours, can be signed out remotely, and are revoked when a password is changed or reset.
• Settings that affect payments, channels and credentials can only be changed by a workspace owner or admin. Security-relevant actions are written to an audit log.
• Incoming webhooks from Meta, 360dialog, Shopify, Razorpay and Twilio are verified by signature.

No system is perfectly secure, but we review and test these controls regularly.

If a personal data breach affects you, we will notify affected Merchants without undue delay, and notify the Data Protection Board of India and other authorities where the law requires, with the information needed to respond and protect End Users.

On the MetaBaskets dashboard we use only essential, httpOnly cookies: a sign-in session cookie (24 hours), a short-lived cookie while a verification code is pending (10 minutes), and - only if you tick “Trust this device” - a trusted-device cookie (30 days). We use no advertising or third-party tracking cookies.

On a Merchant's store, the chat widget uses the browser's local storage (not cookies) for the anonymous visitor ID, the current visit (expires after 30 minutes of inactivity) and the visitor's own recent chat history (kept for up to 7 days). The Merchant's store and Shopify may set their own cookies under the Merchant's policy.

Depending on where you live, you have the right to:

• access a summary of your personal data and how it is processed;
• correct, complete or update inaccurate data;
• have your data erased, and withdraw consent at any time (this does not affect processing already carried out);
• object to or restrict certain processing, and receive your data in a portable format (GDPR);
• nominate another person to exercise your rights in the event of death or incapacity (DPDP Act);
• have a grievance addressed, and complain to the Data Protection Board of India or your local supervisory authority.

Merchants can update most data in Settings, or write to us. End Users can reply “STOP” to stop WhatsApp or Instagram campaigns, use the unsubscribe link in any campaign email, and contact the business for access or deletion. Store Visitors can decline analytics in the store's cookie banner, enable Global Privacy Control in their browser, or clear the site's storage. We respond to verified requests within 30 days.

Merchants who use MetaBaskets agree to:

• tell their customers and store visitors, in their own privacy notice, that they use an AI assistant, store analytics and the service providers listed above;
• obtain any consent required before sending marketing campaigns, and offer a cookie or analytics choice where the law requires;
• upload only data they are entitled to use, and not upload sensitive data (such as health, financial account or government ID numbers) into the knowledge base;
• keep their team's access appropriate and enable two-step verification.

Our servers and service providers may be located outside your country. Where personal data is transferred across borders, we do so in line with the DPDP Act and, for GDPR-covered data, using appropriate safeguards such as Standard Contractual Clauses.

MetaBaskets is a business tool and is not directed at children. Merchants must not knowingly use it to process children's data without verifiable parental consent as required by the DPDP Act. If you believe a child's data has been processed, contact us and we will help remove it.

We will update this page when our practices change and change the “Last updated” date. For material changes we will notify workspace owners by email or in the dashboard before they take effect.

For privacy questions, requests or complaints, contact our Grievance Officer at [email protected]. Please include the business name and the email or phone number your request relates to, so we can verify and locate the data.
Post: MetaBaskets, Flat No. 2, Plot No. 1051, Arun Builders Ground Floor, I Block, 35th Street, 18th Main Rd, Anna Nagar, Chennai, Tamil Nadu 600040. Phone / WhatsApp: +91 70925 75859.