1. Who we are
This policy is issued by BVTL INFOTECH, which operates the brand Media Sathi ("Media Sathi", "we", "us"), with its office at Baradih Gandhar, Manpur, Gaya, Bihar, India - 823003. It covers our website mediasathi.in, the Booking Sathi platform, our app on the Meta (Facebook) developer platform, and our marketing and website services.
2. Our two roles
- For our own website visitors, leads and clients, we decide how personal data is used. Under the Digital Personal Data Protection Act, 2023 ("DPDP Act"), we are the Data Fiduciary.
- For the customers of businesses that use Booking Sathi (for example, a couple who messages a photography studio), the business decides how that data is used. The business is the Data Fiduciary and we are its Data Processor. We process that data only on the business's instructions, under our Data Processing Terms. If you are such a customer, please contact the business first; we will help them respond.
3. Personal data we collect
| Whose data | What we collect | Where it comes from |
|---|---|---|
| Website visitors | IP address, device and browser type, pages visited, in server logs | Automatically |
| Enquiries and leads | Name, WhatsApp/phone number, email, business name, city, message, consent choices | You, through our form, WhatsApp, calls or ads |
| Clients (account holders) | Name, business name and address, GSTIN, login email/phone, team member names and roles, invoices, support chats | You |
| Payments | Payment status, amount, transaction ID. Card, UPI and bank details are collected by our payment gateway, not stored by us | Payment gateway (Razorpay) |
| Data from Meta, when you connect your account | Meta Business ID, WhatsApp Business Account ID, phone number ID, display name, business profile, message templates, quality rating, messaging limits, access tokens | Meta, with your permission (Embedded Signup) |
| Messaging data processed for clients | End-customer name, WhatsApp number, message content and media, timestamps, delivery and read status, lead details captured in chat (for example event date, venue, budget), opt-in and opt-out status | Messages sent and received through the client's WhatsApp number |
When you connect through Meta, we request only the permissions needed to run the service, such as whatsapp_business_management and whatsapp_business_messaging.
4. Why we use it
- To provide and support our services, including sending and receiving WhatsApp messages on behalf of our clients.
- To generate automated replies with an AI model, limited to the client's business topics, when the client uses the AI chatbot add-on.
- To respond to your enquiry and give you a demo or quote.
- To bill you, keep accounts and meet tax and legal duties.
- To keep our systems secure and prevent fraud and misuse.
- To send you updates and offers about Media Sathi, only if you opt in. You can opt out anytime by replying STOP or emailing us.
- To improve our services using aggregated, de-identified statistics.
We process personal data on the basis of your consent, or for legitimate uses permitted by Section 7 of the DPDP Act (for example, data you voluntarily give us for a specific purpose, or compliance with law).
What we never do: we do not sell personal data. We do not use data received from Meta, or our clients' customer messages, for advertising or profiling, and we do not use it to train AI models. Our AI provider processes message text only to generate replies.
5. Who we share it with
- Meta Platforms: WhatsApp messages travel through the WhatsApp Business Platform (Cloud API), operated by Meta under its own terms and privacy policy.
- Cloud hosting provider: to run our website and platform on secure servers.
- AI model provider: to generate automated replies, only for clients who use the AI chatbot add-on.
- Payment gateway (Razorpay): for payment links and invoices.
- Email and office tools: to communicate with you.
- Government authorities: only when required by law.
- Business transfer: if our business is merged or sold, under the same protections.
All our service providers are bound by contracts that require them to protect personal data.
6. Transfers outside India
Some providers, including Meta and our AI provider, may process data outside India. We transfer data only as permitted under the DPDP Act and never to a country restricted by the Government of India.
7. How long we keep it
- Enquiries and leads that did not become clients: up to 24 months after the last contact.
- Client account data: as long as the account is active, then deleted within 30 days of closure.
- Messaging data processed for a client: as long as the client's account is active; on closure, exported to the client on request within 30 days and then deleted.
- Invoices and payment records: as long as tax laws require.
- Security logs: at least one year, as required by law.
8. How we protect it
Encrypted connections (HTTPS/TLS), encrypted storage of access tokens, role-based access, the least access needed for each team member, regular backups and access logs. If a personal data breach occurs, we will inform affected people and report it to the Data Protection Board of India and CERT-In as required by law.
9. Your rights
Under the DPDP Act, you can:
- get a summary of your personal data and how we use it;
- ask us to correct, complete, update or erase it;
- withdraw your consent at any time, as easily as you gave it;
- nominate another person to exercise your rights in case of death or incapacity;
- raise a grievance with us, and then with the Data Protection Board of India.
To use these rights, email info@mediasathi.in or WhatsApp us at +91 84341 15565. We respond within 30 days. To stop marketing messages, reply STOP on WhatsApp.
10. Data deletion
See our Data Deletion Instructions to remove your Meta connection and have your data deleted.
11. Cookies
This website uses no advertising or analytics cookies. Our server keeps standard logs for security. If we add analytics or advertising tools in future, we will ask for your permission first and update this policy.
12. Children
Our services are for businesses. We do not knowingly collect personal data of children under 18. Clients must not use Booking Sathi to message children without verifiable parental consent, as required by law.
13. Changes to this policy
We will post any change on this page with a new "Last updated" date. For important changes, we will also inform clients by email or WhatsApp.
14. Contact and Grievance Officer
Ravikant Kumar, Founder · info@mediasathi.in · +91 84341 15565 · Baradih Gandhar, Manpur, Gaya, Bihar, India - 823003. We acknowledge complaints within 48 hours and resolve them within 30 days.