Privacy policy
What personal data Soosh handles, why, who we share it with, how long we keep it, and how to use your rights.
1. Who we are
Soosh is a WhatsApp Business platform run by Voscart Labs, 615, STC, Near Vakil Bridge, Ambli, Ahmedabad 380058, India ("Voscart Labs", "we", "us"). This policy explains what personal data we handle when you visit soosh.io or use the Soosh app at app.soosh.io, why, who we share it with and the choices you have.
Businesses use Soosh to talk to their own customers on WhatsApp. That gives us two roles, and this policy covers both:
- For the people who use Soosh (the business's owners, admins and agents), we decide how their account data is used. We're the data fiduciary, or controller, for it.
- For the business's customers (the people who message a business on WhatsApp), the business decides what is collected and why, and we process it only on the business's instructions. The business is the data fiduciary, or controller, and we're its processor. If you've messaged a business that uses Soosh, contact that business first about your data; we'll help them answer you.
2. The data we handle
About people who use Soosh
- Account details: name, work email, phone number, role, the workspaces you belong to, your password (stored only as a one-way hash) and two-factor settings. If you sign in with Google, Microsoft or Facebook, we receive your name and email from them.
- Billing details: the business's name, address and tax details, plan and payment history. Card and bank details go straight to our payment provider; we never see or store full card numbers.
- How you use the app: pages you open, features you use, errors you run into, your device, browser and approximate location from your IP address, and recordings of your sessions in the app. Recordings hide the text on screen and everything typed into fields, so customers' messages, names and phone numbers aren't captured.
- Support: what you send us when you ask for help, by email or in the app's support chat.
About a business's customers, on the business's behalf
- Contact details: WhatsApp phone number, profile name and any details the business adds, such as tags, notes or order information from a connected store.
- Messages and media: the content of WhatsApp messages sent and received, with images, documents, voice notes and their delivery status.
- Calls: details of WhatsApp calls and, where call recording is turned on, recordings of them. The business must tell callers when calls are recorded.
- Customer memory: if a business turns on AI features, short notes Soosh keeps about a customer from past chats.
When you visit soosh.io
The website has no analytics or advertising trackers. Our host keeps standard server logs (IP address, page and browser) for security, and the site's font is loaded from Google Fonts, which receives your IP address.
3. How we use it
- To run Soosh: send and receive WhatsApp messages and calls, show chats to the right people, run campaigns, chatbots and automations, and keep the service secure.
- AI features, when a business turns them on: to write and suggest replies, translate and summarise chats, keep customer memory, and decide when a chat needs a person and which team should take it. Card numbers, one-time codes and account numbers are removed from messages before they're sent for summaries, customer memory and these decisions.
- Billing: to charge for plans and wallet top-ups, send receipts and keep the records the law requires.
- Improving Soosh: to understand which features are used, find and fix errors, and plan what to build. We use account usage for this, never the content of customers' messages.
- Telling you things: emails about your account, security, billing and changes to the service. We don't send marketing email without your permission.
- The law: to meet legal obligations and to protect Soosh, our users and their customers from fraud and abuse.
We use account data to provide the service you or your business signed up for, because the law requires it, or for our legitimate interest in running and improving a secure service. We process customers' data on the business's instructions; the business is responsible for having its customers' consent or another lawful reason, including WhatsApp opt-in before it sends them messages.
We don't sell personal data, and we don't use customers' messages to advertise to anyone.
4. Who we share it with
We share data only with the service providers that help us run Soosh, only as much as they need, and under contracts that stop them using it for their own purposes:
| Provider | What for | Where |
|---|---|---|
| Hostinger International Ltd. | Servers that run the app and its database | India (Mumbai) |
| Cloudflare, Inc. | Network security and delivery for our sites, storage of media files, call recordings and encrypted backups, and our status page | Global network; storage in the United States |
| Meta Platforms, Inc. (WhatsApp) | Sending and receiving WhatsApp messages and calls through the WhatsApp Business Platform | United States and other countries |
| PostHog, Inc. | Product analytics, session recordings with on-screen text hidden, error tracking, in-app support chat and app performance | United States |
| Grafana Labs | Server logs and performance monitoring | India (Mumbai) |
| Resend | Sending account and billing emails, and receiving the emails you send to our soosh.io addresses | United States |
| OpenRouter, Inc. | Passing requests from our AI features to the AI model providers below | United States |
| Anthropic, PBC | The Claude models that write AI replies, chat summaries and customer memory, reached through OpenRouter (which may run them on Anthropic, Amazon Web Services or Google Cloud) or directly when OpenRouter is unavailable | United States |
| TypeSafe, through OpenRouter | The model that decides whether a chat needs a person and which team should take it. These requests go only to providers that neither keep nor train on the data | United States |
| Razorpay Software Pvt. Ltd. | Taking payments for plans and wallet top-ups | India |
| Your browser's push service (Google, Apple or Mozilla) | Delivering notifications you've turned on. Their content is encrypted so the push service can't read it | Varies |
A business can also connect services of its own, such as a Shopify store, its own webhooks or its own systems through our API. Data sent to those goes where the business directs, under the business's own terms with that service.
We may disclose data when the law requires it. We check each request and disclose only what's needed. If Soosh is ever sold or merged, data would move to the new owner under this policy, and we'd tell you first.
5. Where data is stored
The Soosh app and its database run on servers in India. Some of the providers above handle data in other countries, mainly the United States. When data leaves India we rely on these providers' contractual commitments to protect it, and we don't send it to any country the Government of India restricts. For people in the UK and the European Economic Area, we use standard contractual clauses or another approved safeguard.
6. How long we keep it
- Account and workspace data: while the account is open. When a business leaves Soosh, we delete its workspace within 30 days of its request, except what the law requires us to keep.
- Customers' messages, media and contacts: for as long as the business keeps them in Soosh, or until it asks us to delete them.
- Encrypted backups: daily backups are kept for 14 days and weekly backups for 60 days, then deleted. Deleted data disappears from backups within that time.
- Server logs: 14 days.
- Usage analytics and session recordings: up to 1 year for usage events and errors, and 30 days for session recordings.
- AI usage records: about 13 months, for billing.
- Billing records: as long as Indian tax and company law requires, up to 8 years.
7. How we protect it
Data travels encrypted between your browser, our servers and our providers. Access tokens and other secrets are encrypted in our database, and backups are encrypted before they leave the server. Sign-ins can use two-factor authentication, and each workspace sees only its own data. Only the people at Voscart Labs who need access to run and support Soosh have it. If a breach affects your data, we'll tell you and the relevant authorities as the law requires.
8. Your rights
Depending on where you live, including under India's Digital Personal Data Protection Act, 2023, you can ask us to:
- tell you what personal data we hold about you and who we've shared it with
- correct or complete it
- delete it
- withdraw a consent you gave, such as for marketing email
- name someone to act for you if you die or can't act yourself
If you're in the UK or the European Economic Area you can also object to some uses, ask us to restrict them, or ask for a copy of your data in a portable format.
Write to support@soosh.io. We'll reply within 30 days. If your request is about a business's chat with you, we'll pass it to that business and help them answer. You can also complain to the Data Protection Board of India, or to your local data protection authority.
9. Deleting your data
To have data deleted, email support@soosh.io with the subject "Data deletion request" and include:
- for your Soosh account: the email you sign in with
- for a business's customer: the WhatsApp phone number, and the business's name if you know it
We'll confirm the request and delete the contacts, messages, media and related records within 30 days, except what the law requires us to keep. Businesses can also erase a customer's data themselves in Soosh, from the customer's contact page. Deleting data from Soosh doesn't delete messages already on the WhatsApp apps of the people in the chat.
10. Cookies and similar storage
- Needed to sign in: the app sets cookies that keep you signed in and protect forms from forgery. It can't work without them.
- Settings: the app remembers choices such as your layout and notification settings in your browser.
- Analytics: PostHog sets a cookie and uses browser storage to tell visits apart, so we can see how the app is used.
The soosh.io website sets no cookies.
11. Children
Soosh is for businesses. It isn't meant for anyone under 18, and we don't knowingly collect children's data for our own purposes. A business that uses Soosh to talk to children is responsible for getting a parent's consent where the law requires it.
12. WhatsApp and Meta
Soosh uses the WhatsApp Business Platform provided by Meta. Meta handles WhatsApp messages and calls under its own WhatsApp Privacy Policy and the WhatsApp Business Terms of Service. We use WhatsApp data only to provide Soosh to the business that connected the number.
13. Changes to this policy
When we change this policy we'll update the date at the top. If a change matters, we'll tell workspace admins by email at least 14 days before it takes effect.
14. Contact and grievance officer
For anything about privacy, write to support@soosh.io.
Our grievance officer is Nilay Gajera, Voscart Labs, 615, STC, Near Vakil Bridge, Ambli, Ahmedabad 380058, India, nilay@soosh.io. We reply to complaints within 30 days.