Privacy Policy

Shankh Labs is a software company in Surat, Gujarat, India. We make Aura for marketing, Hella for WhatsApp and Nexus CMS for websites, and we build custom software for businesses. We are a Meta Authorised Tech Provider. We are not owned by Meta or affiliated with it. WhatsApp, Facebook and Instagram are Meta's trademarks.

Shankh Labs, Shop No. 329, Joyos Hubtown, S T Depo, Adajan Cir, Adajan, Surat, Gujarat 395009, India. Email admin@shankhlabs.com or call +91 72083 91705.

Our customers: the businesses that use our products, and the people on their teams who sign in.

Their customers and visitors: people who message a business on WhatsApp through Hella, or send an enquiry, job application or order through a website that runs on Nexus CMS. For this data, the business decides what is collected and why, and we handle it on their instructions. If that is you and you want your data removed, you can ask the business or come to us directly. Either route works.

When you sign in to any of our products

• Your name, work email and the organisation you belong to
• Your role, and what you are allowed to see and change
• Your password, stored only as a salted hash that nobody can read
• A record of the changes you make, so your team can see who did what

Aura

• Your brand guide: name, voice, colours, logo, products and the photos you upload
• The social accounts you connect (Facebook, Instagram, LinkedIn, X and Google) and the access keys those platforms issue, encrypted before we store them
• The posts, captions, images and campaigns Aura drafts, and what you approve, edit or reject
• The performance numbers those platforms report for your posts
• Lead searches you run: the type of business and the area you ask for, and the publicly listed business details Aura finds, such as a business name, website and public phone number

Hella

• Your WhatsApp Business Account, phone number IDs and the access keys Meta issues so we can send and receive messages for you
• Messages sent and received, including photos and files, and whether they were delivered and read
• Contacts: phone number, name, tags, custom fields, and opt-in and opt-out records
• Orders placed in chat and their payment reference. We never see card or bank details.

Nexus CMS

• Your website's content: pages, posts, lists, products, images, files, settings and redirects
• What visitors send through your website: enquiries (name, email, phone, message and the page it came from), job applications and attached files, and customer records, orders and delivery addresses where a site sells online

Our own websites

• What you type into a contact form: name, email, phone, company and message
• Your number and the conversation, if you message us on WhatsApp

Everywhere

• Usage counts against your plan's allowances
• Application logs that help us keep the service secure and fix faults. Hella removes phone numbers and message text from its logs before they are written.

• To run the products you use: publishing posts, delivering messages, running automations, publishing websites and passing enquiries to the business they were meant for
• To check what your plan allows and bill you correctly
• To keep the service secure, stop abuse and fix faults
• To send the emails the service needs, such as invitations, password resets and alerts
• To reply when you contact us, and to tell account owners about important changes

We do not sell personal data. We do not use it for advertising, and we do not build advertising profiles.

Aura, Hella and Nexus CMS use AI models to draft posts, captions, images, replies and product descriptions. When you use one of these features, the information that draft needs is sent to our model providers, Google (Gemini) and OpenAI, and the draft comes back to you. For example, your brand guide and product details for a caption, or the recent conversation for a WhatsApp reply.

• Nothing is published or sent to your customers until a person on your team approves it, unless you have switched on an automation that replies for you
• Your data is not used to train AI models, ours or anyone else's
• One customer's data is never shown to another

We use a small number of outside services to run our products. Each one gets only what it needs.

• Google Cloud and Firebase: servers, databases and file storage for every product and website
• Google (Gemini) and OpenAI: AI drafting, when you use an AI feature
• Meta: WhatsApp messaging for Hella, and Facebook and Instagram publishing and insights for Aura
• LinkedIn, X and Google: publishing and insights, only for the accounts you connect to Aura
• Razorpay: payments, including our subscriptions and the orders you take through Hella or a Nexus CMS website
• Our email provider: invitations, password resets and alerts
• Cloudflare: domain and network services for our websites

Once a message or post reaches Meta, LinkedIn, X or Google, that platform's own terms and privacy policy apply to it.

We share personal data with government authorities only when Indian law requires it.

All our products run on Google Cloud.

• Aura and Nexus CMS: Google Cloud's Mumbai region, in India
• Hella: Google Cloud's Iowa region, in the United States
• Our websites: delivered through Google's and Cloudflare's global networks

Some of the services above, such as the AI providers and Meta, may process data outside India. Where they do, it is covered by their business terms with us.

• While your account is active, we keep your data so the product works
• When an account closes, we delete its data or make it permanently anonymous within 90 days
• When you ask us to delete something, we do it within 30 days. See data deletion.
• Invoices and payment records are kept for as long as Indian tax and company law requires. They hold billing details only, not your content or conversations.
• Deleted data can remain in our encrypted backups for a short time, until those backups are replaced in the normal cycle

Under India's Digital Personal Data Protection Act, 2023, and any similar law that applies to you, you can ask us to:

• Tell you what personal data we hold about you and who we have shared it with
• Correct or complete anything that is wrong
• Delete your data
• Withdraw a consent you gave earlier. This does not undo what was done before you withdrew it.
• Let someone you nominate act for you if you cannot

Write to admin@shankhlabs.com. We reply within 30 days, and usually much sooner. If the data belongs to a business that uses our products, we pass your request to them too.

Complaints. If you are unhappy with how we handled your data, email admin@shankhlabs.com with the subject "Grievance" and we will respond within 30 days. You can also complain to the Data Protection Board of India.

• Every request is checked against the organisation or project it belongs to, so one customer can never see another's data
• Passwords are hashed, and the access keys from Meta and other platforms are encrypted before we store them
• All traffic is encrypted in transit
• The updates our systems send to websites are signed, so they cannot be faked
• Only a few people at Shankh Labs can reach customer data, and only to support you or fix a fault

No system is perfectly secure. If a breach affects your data, we will tell you and the authorities as the law requires, and explain what we are doing about it.

Our products are for businesses. They are not meant for anyone under 18, and we do not knowingly collect children's data.

Our cookies and storage page lists exactly what we keep in your browser. In short: no advertising cookies, and no tracking across other websites.

When we change this policy in a way that matters, we update the date at the top and email account owners before the change takes effect.