Legal

Privacy Policy

Last updated: 12 July 2026

This policy describes how Vechilo handles personal information when you create a business page, use our dashboard, browse Explore, or submit a WhatsApp inquiry on a published page.

Contact: contact@vechilo.in

Overview

Vechilo is a platform that lets local businesses create a mobile-friendly page with products, posts, business hours, and WhatsApp inquiries, and optionally appear in our public Explore directory. This Privacy Policy explains how we collect, use, store, and share personal information when you use our platform and related services (the "Service").

We operate the Service for business owners ("Account holders") who create pages, and for visitors who browse public pages or submit inquiries. Some visitor information is also shared with the business that receives the inquiry.

Who is responsible for your data

Under India's Digital Personal Data Protection Act, 2023 (where it applies), Vechilo generally acts as a Data Fiduciary for platform account data, inquiry records stored in our systems, and analytics described in this policy.

When a visitor submits an inquiry on a business page, the business owner also receives and may process that visitor's name and phone number to respond on WhatsApp. The business owner is responsible for how they use, retain, and protect that information after it is shared with them.

Information we collect from account holders

When you register and use Vechilo, we may collect:

  • Account details: name, email address, and password (stored as a secure hash, not plain text).
  • Profile settings such as your preferred default WhatsApp message language.
  • Business profile data you enter: business name, page link (slug), category, WhatsApp number, description, address, opening hours, theme choices, products, posts, and logo or product images you upload.
  • Authentication data if you sign in with Google (name, email, profile image, and OAuth tokens stored to maintain your session).
  • Usage data related to your dashboard, such as page view counts and WhatsApp click analytics for your business pages.

Information we collect from visitors

When someone browses or interacts with a published business page, we may process:

Before submitting an inquiry, visitors are shown a notice and must confirm consent that their name and mobile number may be stored by Vechilo and shared with the business to handle the inquiry.

  • Inquiry details: visitor name and Indian mobile number when they use the inquiry flow before opening WhatsApp.
  • Browser data: user-agent string submitted with inquiries and some WhatsApp click events. We derive only a broad device category (phone, tablet, or computer) from it for the business dashboard.
  • Local storage on the visitor's device: name and phone may be saved in the browser (localStorage) so returning visitors can inquire faster. We also store a randomly generated visitor identifier and a session identifier, which let us count returning visitors without knowing who they are. Visitors can clear all of this in browser settings.
  • Page activity: which page or product was opened, roughly how long it was open, and actions such as opening WhatsApp, tapping a phone number or social link, sharing the page, or searching. These are linked to the random visitor identifier described above, never to a name.
  • Referring website: the site a visitor arrived from (for example a search engine or social network), stored as the website name only, so businesses can see which channels bring them customers.
  • IP addresses: we do NOT store visitor IP addresses, in any form, hashed or otherwise. An IP is read momentarily in memory to limit automated abuse of our endpoints, then discarded. We do not derive or record any location from it.
  • WhatsApp click analytics: event type, business page, optional product or post reference, and optional visitor name or phone if already known.

Cookies & Tracking Technologies

Vechilo uses cookies, local storage, and similar technologies to provide, secure, and improve the platform. We use these technologies to:

We may also use third-party analytics services (such as Google Analytics or Microsoft Clarity) to help us understand how users interact with Vechilo. These services may collect anonymous usage information (such as page views, scroll activity, and browser types) to help us optimize our platform's performance and user experience.

  • Keep you signed in during your session.
  • Remember your dashboard settings and UI preferences.
  • Optimize website performance and load times.
  • Analyze overall platform usage and traffic trends.
  • Enhance and customize your user experience.
  • Provide business owners with analytics about their own page. Vechilo runs its own first-party analytics: when someone visits a published business page, we store a randomly generated visitor and session identifier in that browser's local storage so the business can see visitor counts, returning visitors, popular products, and which actions lead to an inquiry. This identifier is random, is not linked to a name unless the visitor separately submits an inquiry, and is not shared with any advertising network.

How we use information

We use personal information to:

  • Create and manage your account and business pages.
  • Display published business information on public pages and in Explore.
  • Route inquiries to the correct business and open WhatsApp with a pre-filled message.
  • Show business owners inquiry and WhatsApp click history in their dashboard.
  • Operate, secure, and improve the Service, including rate-limiting abuse.
  • Comply with law and enforce our Terms of Service.

How we share information & Third-Party Services

We do not sell personal information. We share data only as needed to run the Service. Vechilo relies on trusted third-party providers to power our platform. These providers only receive the specific information necessary to perform their respective services under confidentiality obligations:

  • With business owners: visitor inquiry details are visible in the business dashboard.
  • With WhatsApp / Meta: when a user taps to message a business, they leave Vechilo and communicate through WhatsApp under WhatsApp's own terms and privacy policy.
  • With Google (Google OAuth): if you choose Google sign-in, Google processes your login credentials according to Google's policies.
  • With Amazon Web Services (AWS): uploaded images, logos, and static assets are securely stored on AWS S3.
  • With Cloudflare: we use Cloudflare for domain performance, security routing, SSL management, and DDoS protection.
  • With MongoDB Atlas: our secure database hosting and infrastructure provider.
  • When required by law, regulation, legal process, or to protect rights, safety, and security.

Public business information

When you publish your business page, information you choose to include (such as business name, logo, description, category, address, hours, products, and posts) may be visible to anyone with your page link or through Explore search and category browsing.

Your WhatsApp number is used so customers can contact you. Consider what you publish carefully.

Email Communications

We may use your email address to send you critical, transaction-related communications, including:

If we introduce promotional or marketing emails in the future, you will always have the option to unsubscribe or opt out of receiving those messages by following the unsubscribe link included at the bottom of the email.

  • Account registration and email verification links.
  • Password reset instructions.
  • Security alerts and access notifications.
  • Important service announcements regarding your account or billing.

Data retention

We retain account and business data while your account is active and as needed to provide the Service.

Inquiry records (name, phone, product inquired about, and related metadata) are retained while the receiving business account remains active, so the business owner can view customer activity in their dashboard.

WhatsApp click analytics are retained for the same period unless deleted earlier upon request.

Page activity events used for business page analytics are deleted automatically about 400 days after they are recorded, so a business can compare the current period against the same period last year and no longer.

We will delete or anonymize personal information within 30 days after receiving and verifying a deletion request, unless we are legally required to retain certain information. Encrypted backups may temporarily retain deleted information before permanent removal.

You may delete or update much of your business content from the dashboard at any time. Account holders and visitors may request deletion using the contact email below.

Security

We use industry-standard technical and organizational security measures to protect your personal information. These include secure authentication methods, password hashing, data encryption in transit, strict access controls on our APIs and databases, and regular security updates to our systems.

However, please note that no method of electronic transmission or storage is completely secure, and no online service can guarantee absolute security. We recommend using a strong, unique password and keeping your login credentials confidential.

Your choices and rights

Account holders can update profile and business information in the dashboard, change password in account settings, and unpublish pages to remove them from public discovery.

Depending on applicable law (including India's Digital Personal Data Protection Act, 2023 where it applies), you may have rights to access, correct, delete, or withdraw consent for certain processing.

Visitors who submitted an inquiry may request access to or deletion of their inquiry data by emailing us with the business name, approximate date of inquiry, and the mobile number used. We may need to verify the request before acting.

Visitors can avoid saving details in localStorage by using private browsing or clearing site data, and can choose not to submit inquiries.

International Users

Vechilo is operated and hosted in India. If you access the Service from outside India, please be aware that your personal information may be transferred to, processed, and stored in India or other countries where Vechilo, its affiliates, or its third-party infrastructure providers operate. Data protection laws in these countries may differ from those in your jurisdiction.

Children

The Service is intended for businesses and adults. It is not directed to children under 18, and we do not knowingly collect personal information from children.

Changes to this policy

We may update this Privacy Policy from time to time. We will revise the "Last updated" date and, where required, ask account holders to accept updated terms before continuing to use the Service.

Contact

For privacy questions or requests, email us at the address shown on this page. Please include enough detail for us to verify your account or request.

See also Terms of Service and Privacy Policy.