Overview & scope
This Privacy Policy describes how Mfluence Private Limited, a company incorporated in India with its registered office at 307, The Atlantic, Near Indian Oil Petrol Pump, Makarpura, Vadodara, Gujarat, India ("Mfluence," "we," "us"), processes Personal Data in connection with the Mfluence platform and website (the "Services").
It covers Personal Data about two groups: (1) our Customers and their authorised users, who register for and administer the Services; and (2) End Users, the people who contact a Customer through the Services via WhatsApp, web chat, email, SMS, or voice. This policy does not govern how a Customer independently uses End User data outside the Services — for that, see the relevant Customer's own privacy notice.
Definitions
We use the same defined terms across our Terms of Service, this policy, our Cookie Policy, and our Security page.
- Customer
- The organisation that subscribes to or uses the Services, and its authorised users (for example, your agents, administrators, and team members).
- End User
- A person who interacts with the Customer through the Services — for example, someone who messages the Customer on WhatsApp, web chat, SMS, email, or voice.
- Personal Data
- Any information relating to an identified or identifiable individual, including an End User's phone number, email address, and conversation content.
- Agent
- An AI agent configured within the Services that responds to conversations and can take actions using connected Tools, grounded in the Customer's Knowledge Base.
- Content
- All data, documents, Knowledge Base material, CRM records, messages, and other materials the Customer or its End Users submit to or generate within the Services ("Customer Content").
Our role: controller vs processor
Our role depends on the data:
- As a processor. For Customer Content and End User Personal Data that a Customer processes through the Services, the Customer is the controller and Mfluence acts as a processor acting on the Customer's instructions. The Customer is responsible for having a lawful basis and any required consents for the data it brings into the Services.
- As a controller. For data we determine the purposes of — such as Customer account, billing, and support data, and our own website analytics — Mfluence acts as a controller.
We do not currently offer a separate Data Processing Addendum (DPA); the processing terms set out in these documents apply.
Personal Data we process
About Customers and their users
- Account and profile details (name, business email, phone number, role, organisation);
- Authentication data (credentials, single sign-on identifiers, security logs);
- Billing and payment information (processed via our payment provider — see How we share data);
- Support communications and product usage and analytics data.
About End Users
- Contact identifiers such as phone number and email address;
- Conversation content across WhatsApp, web chat, SMS, email, and voice (including transcripts and, where applicable, call recordings);
- CRM records, lead and pipeline data, and consent/opt-out status;
- Web visitor and device data collected through the webchat widget and visitor tracking (see our Cookie Policy).
Knowledge Base documents that Customers upload may also contain Personal Data, depending on what the Customer chooses to include.
How we collect it
- Directly from Customers — when you register, configure the Services, or contact support;
- From End Users — through conversations on connected channels and via forms and the webchat widget;
- Through integrations and APIs — data the Customer connects from WhatsApp/Meta, email, SMS, voice, calendar, CRM, and other systems;
- Automatically — usage, device, and analytics data, and cookies and similar technologies as described in our Cookie Policy.
Legal bases for processing
Where data-protection law requires a lawful basis, we rely on the following as a controller:
- Contract — to provide the Services to Customers and administer accounts and billing;
- Legitimate interests — to secure, support, and improve the Services, and for limited direct communications, balanced against your rights;
- Consent — where required, for example certain cookies and marketing communications (you can withdraw consent at any time);
- Legal obligation — to comply with applicable laws.
When Mfluence acts as a processor, the Customer (as controller) is responsible for establishing the legal basis for processing End User Personal Data. The Services are provided under, and this policy is framed around, the Digital Personal Data Protection Act, 2023 (India).
How we use Personal Data
- To deliver and operate the Services, including routing conversations and generating Agent responses;
- To enable AI Agents to answer from a Customer's Knowledge Base and take actions via connected Tools;
- To provide analytics and reporting to Customers about their own conversations;
- To process billing and payments and manage subscriptions;
- To provide customer support and communicate about the Services;
- To secure the Services, prevent abuse, and meet legal obligations; and
- To maintain activity and audit logs of actions taken in the Services.
AI & your data
AI Agents process conversation content and Knowledge Base material to generate responses and take actions on the Customer's behalf. Mfluence does not use Customer Content or End User Personal Data to train shared or public AI models. Data is processed to provide the Services within the Customer's workspace, not to build models that benefit other customers or the public.
AI processing is performed using open-source AI models, which are strictly barred from training on Customer Content or End User Personal Data. Data is processed to provide the Services within the Customer's workspace — see How we share data.
Data retention
We retain Personal Data for as long as needed to provide the Services and for legitimate business and legal purposes. As a general rule, data associated with trial accounts is retained for up to 90 days, and data associated with subscribed accounts for up to 365 days after the relevant account or record is closed or terminated, after which it is deleted or anonymised, subject to any longer retention required by law.
Your rights
Subject to applicable law, individuals may have the right to:
- Access the Personal Data held about them;
- Correct inaccurate or incomplete data;
- Delete data ("right to erasure");
- Receive their data in a portable format;
- Object to or restrict certain processing; and
- Withdraw consent where processing is based on consent.
We honour these rights as provided under the Digital Personal Data Protection Act, 2023 (India), including the right to access and to correction, completion, updating, and erasure of your Personal Data, the right to grievance redressal, and the right to nominate another individual to exercise your rights in the event of death or incapacity.
Note for End Users: because Mfluence usually processes End User data as a processor on a Customer's behalf, requests are often best directed to the relevant Customer (the controller). We will assist Customers in responding, and will forward requests we receive to the appropriate Customer.
Exercising your rights
To make a request or ask a privacy question, contact us at info@mfluence.ai. We may need to verify your identity before acting, and we will respond within the timeframe required by applicable law. You also have the right to lodge a complaint with your local data-protection authority.
Security
Personal Data and Customer Content are encrypted in transit and at rest, access is controlled with role-based permissions, and every Agent action runs under scoped, per-conversation permissions and is recorded in an activity log. For a fuller description of our safeguards, see our Security page.
Children's privacy
The Services are a B2B product intended for organisations and their authorised representatives. They are not directed to children, and we do not knowingly collect Personal Data from children under 18. Customers are responsible for their own compliance where their End User audiences may include minors.
Changes to this policy
We may update this policy from time to time. Material changes will be reflected here with a new "Last updated" date and, where appropriate, communicated in-product or by email. Please review it periodically.
Contact
For privacy questions or requests, contact info@mfluence.ai. A Data Protection Officer is not required for the Services and has not been appointed. Formal notices may be sent to our registered office: 307, The Atlantic, Near Indian Oil Petrol Pump, Makarpura, Vadodara, Gujarat, India.