Data Processing Policy
Last updated: 24 October 2026 · Branova Reach (reach.branova.in)
This policy describes how Branova Reach processes personal data on your behalf as a data processor, where your business is the data controller.
1. Roles
You decide which contacts to upload, what to send them and why. We process contact and message data solely to provide the service under your instructions. You are responsible for consent and for honouring opt-outs; Reach helps by excluding contacts who reply STOP or unsubscribe.
2. What we process
- Contact details: names, phone numbers, email addresses, tags, notes and status.
- Messages you send and replies you receive, with delivery status.
- Lead-form submissions from your website visitors.
3. Security measures
- Business-level data isolation and role-based access control.
- Passwords hashed with bcrypt; sessions hardened (HttpOnly, SameSite, Secure over HTTPS).
- Channel credentials stored server-side and never returned to the browser in full.
- Webhook signature checks, CSRF protection, rate limiting, input validation and audit logging.
4. Sub-processors
Hosting infrastructure and Razorpay (payments) act as sub-processors. When you connect a channel or use the AI writer, the relevant data is passed to Meta (WhatsApp Cloud API), the email (SMTP) service you connect, the SMS and RCS providers you connect, and Anthropic (Claude) for the AI writer. These accounts are yours, and each provider processes data under its own terms.
5. Data retention & deletion
We retain data for as long as your business is active. Deleting a contact removes it from Reach; deleting your business removes all of its contacts, messages and settings. Copies already delivered to recipients, or held by your providers, are outside our control.
6. International transfers & breach
Some providers (for example Meta and Anthropic) may process data outside India. We take reasonable steps to protect data in transit and at rest, and will notify you without undue delay of any breach affecting your data.