Privacy Policy
How RapidShift Labs collects, isolates, encrypts, and protects business, accounting, and customer communication data under Indian law and global API standards.
- Every customer business gets its own isolated SQLite database file — your Tally Prime bills, contacts, and chats are never mixed with any other company.
- We never sell customer data, never run third-party advertising trackers, and never train public AI models on your business records or Tally vouchers.
- OAuth tokens (Google Drive, Google Business Profile, Meta, WhatsApp Cloud API) are encrypted at rest with AES-256-GCM envelope encryption and can be revoked in 1 click.
- You can export a signed portable backup or request permanent cryptographic deletion of your workspace at any time.
1. Scope, Data Fiduciary & Processor Roles
This Privacy Policy explains how RSL Marketing Technologies ("RapidShift Labs", "we", "us", or "our"), operating the RSL Marketing & Tally Suite at rapidshiftlabs.in and http://localhost:4500, collects, uses, stores, and safeguards information.
Under India's Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology Act, 2000 (read with the IT Reasonable Security Practices and Procedures Rules, 2011), RapidShift Labs acts as a Data Fiduciary with respect to workspace account holders and billing records, and as a Data Processor acting strictly on your documented instructions with respect to your end-customers' Tally Prime invoices, receivables, and WhatsApp/Instagram/Facebook/Google conversations.
2. Categories of Information We Process
We collect only the minimum data necessary to provision your workspace, synchronize accounting vouchers, deliver customer messages, and issue statutory GST tax invoices:
- Workspace & Account Identity: Full name, work email address, hashed password (scrypt/argon-grade KDF), team member role assignments, firm/company name, billing state, and optional 15-character GSTIN.
- Tally Prime Accounting Sync Data: Party ledger names, mobile numbers, voucher numbers, bill dates, due dates, line-item tax splits, receivable balances, and generated PDF tax invoices transmitted by your paired Windows Tally Connector.
- Customer Messaging & Shared Inbox Data: Inbound and outbound WhatsApp Cloud API template/session messages, Instagram Direct Messages, Facebook Page comments, Google Business Profile reviews, opt-in timestamps, and STOP/suppression records.
- Connected Channel Credentials: OAuth 2.0 access/refresh tokens and webhook secrets for Google Drive, Google Business Profile, and Meta/WhatsApp, stored exclusively in AES-256-GCM encrypted form.
- Billing, Wallet & Statutory Tax Records: Prepaid wallet ledger entries, Razorpay order/payment references, UTR bank transfer references, and SAC 998314 GST invoices/credit notes.
- Security & Tamper-Evident Audit Logs: Redacted diagnostic logs (with phone numbers, emails, and tokens automatically masked) and SHA-256 hash-chained workspace activity records.
3. Google API Services User Data Policy (Limited Use Disclosure)
RapidShift Labs's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Specifically, when you connect Google Drive for automated cloud backups or Google Business Profile for customer review management:
- Scoped Google Drive Access (
drive.file): When you click 'Connect to Google Drive', we request only narrow file-level scope to create and upload signed, AES-256-GCM encrypted.rslbackuparchives created by RapidShift Labs into your designated backup folder. We cannot view, list, modify, or delete any unrelated personal or business files in your Google Drive. - Scoped Google Business Profile Access: Used solely to fetch customer star ratings and review text for your authorized locations and to publish owner replies that your authorized staff explicitly submit.
- Strict Prohibition on Secondary Use: Google user data is never sold, never shared with advertising networks or data brokers, never used for creditworthiness profiling, and never used to train generalized or foundation AI/ML models.
- Human Access Restriction: Our staff cannot read your Google API data unless you explicitly initiate a time-boxed (maximum 30-minute), audited support session with written consent to troubleshoot a specific issue, or where strictly required by applicable law.
You can disconnect Google Drive or Google Business Profile immediately from Connected Channels (http://localhost:4500/connections) or revoke access directly at myaccount.google.com/permissions.
4. Meta Platforms & Official WhatsApp Cloud API Data
When you connect a WhatsApp Business Account (WABA), Facebook Page, or Instagram Professional Account via Meta's official Graph API:
- Inbound webhooks are cryptographically verified using
X-Hub-Signature-256HMAC-SHA256 before ingestion. - Duplicate-send protection (
SendGuard) stores SHA-256 salted hashes of recipient identifiers rather than raw phone numbers in operational deduplication tables. - Automated
STOP/UNSUBSCRIBEreplies immediately add the recipient to your workspace suppression list, blocking subsequent promotional broadcasts.
5. Per-Business Database Isolation & Encryption Controls
Unlike conventional multi-tenant tools that place every customer's rows into one shared table, RapidShift Labs provisions physically separate SQLite database files (data.db and logs/current.db) inside an isolated directory (0700 OS permissions) for each business workspace.
- Encryption in Transit: All web, API, webhook, and Windows Tally Connector traffic enforces HTTPS (TLS 1.2 / TLS 1.3) with HTTP Strict Transport Security (HSTS).
- Encryption at Rest for Secrets & Backups: All OAuth tokens, API keys, and
.rslbackuparchives are encrypted with authenticated AES-256-GCM envelope encryption and Ed25519/HMAC integrity signatures. - PII Log Redaction: Server diagnostic logs automatically scrub bearer tokens, API keys, passwords, email addresses, and phone numbers prior to disk write.
7. Data Retention, Export & Your DPDP Act Rights
Active workspace data is retained for the duration of your subscription. Completed background queue locks expire after 7–90 days, and expired browser sessions are purged automatically every 20 minutes. Statutory GST tax invoices and wallet ledger entries are retained for eight (8) years as mandated under Section 36 of the Central Goods and Services Tax (CGST) Act, 2017.
As a Data Principal or Workspace Owner, you have the right to access, correct, export (via http://localhost:4500/backups), withdraw consent, and request permanent erasure (via http://localhost:4500/data-deletion or by emailing privacy@rapidshiftlabs.in).
8. Grievance Officer & Privacy Contact
In accordance with Rule 5(9) of the IT Rules, 2011, Rule 3(2) of the IT (Intermediary Guidelines) Rules, 2021, and the DPDP Act, 2023, privacy inquiries or grievances may be addressed to our Grievance & Data Protection Officer at privacy@rapidshiftlabs.in or billing@rapidshiftlabs.in (Phone: +91 98200 00000). Every request is acknowledged within 24 hours and resolved within 15 days.