Legal
Privacy Policy
Last updated: 12 July 2026
This policy describes how Vechilo handles personal information when you create a business page, use our dashboard, browse Explore, or submit a WhatsApp inquiry on a published page.
Contact: contact@vechilo.in
Overview
Vechilo is a platform that lets local businesses create a mobile-friendly page with products, posts, business hours, and WhatsApp inquiries, and optionally appear in our public Explore directory. This Privacy Policy explains how we collect, use, store, and share personal information when you use our platform and related services (the "Service").
We operate the Service for business owners ("Account holders") who create pages, and for visitors who browse public pages or submit inquiries. Some visitor information is also shared with the business that receives the inquiry.
Who is responsible for your data
Under India's Digital Personal Data Protection Act, 2023 (where it applies), Vechilo generally acts as a Data Fiduciary for platform account data, inquiry records stored in our systems, and analytics described in this policy.
When a visitor submits an inquiry on a business page, the business owner also receives and may process that visitor's name and phone number to respond on WhatsApp. The business owner is responsible for how they use, retain, and protect that information after it is shared with them.
Information we collect from account holders
When you register and use Vechilo, we may collect:
- Account details: name, email address, and password (stored as a secure hash, not plain text).
- Profile settings such as your preferred default WhatsApp message language.
- Business profile data you enter: business name, page link (slug), category, WhatsApp number, description, address, opening hours, theme choices, products, posts, and logo or product images you upload.
- Authentication data if you sign in with Google (name, email, profile image, and OAuth tokens stored to maintain your session).
- Usage data related to your dashboard, such as page view counts and WhatsApp click analytics for your business pages.
Information we collect from visitors
When someone browses or interacts with a published business page, we may process:
Before submitting an inquiry, visitors are shown a notice and must confirm consent that their name and mobile number may be stored by Vechilo and shared with the business to handle the inquiry.
- Inquiry details: visitor name and Indian mobile number when they use the inquiry flow before opening WhatsApp.
- Browser data: user-agent string submitted with inquiries and some WhatsApp click events. We derive only a broad device category (phone, tablet, or computer) from it for the business dashboard.
- Local storage on the visitor's device: name and phone may be saved in the browser (localStorage) so returning visitors can inquire faster. We also store a randomly generated visitor identifier and a session identifier, which let us count returning visitors without knowing who they are. Visitors can clear all of this in browser settings.
- Page activity: which page or product was opened, roughly how long it was open, and actions such as opening WhatsApp, tapping a phone number or social link, sharing the page, or searching. These are linked to the random visitor identifier described above, never to a name.
- Referring website: the site a visitor arrived from (for example a search engine or social network), stored as the website name only, so businesses can see which channels bring them customers.
- IP addresses: we do NOT store visitor IP addresses, in any form, hashed or otherwise. An IP is read momentarily in memory to limit automated abuse of our endpoints, then discarded. We do not derive or record any location from it.
- WhatsApp click analytics: event type, business page, optional product or post reference, and optional visitor name or phone if already known.
Legal basis for processing
We process personal information only where we have a valid basis under applicable law.
- Visitor inquiries: based on your consent when you confirm before continuing to WhatsApp, and as needed to connect you with the business you contacted.
- Account and business data: based on our contract with account holders to provide the Service, and our legitimate interest in operating and securing the platform.
- Analytics and abuse prevention: based on our legitimate interest in understanding usage, improving the Service, and preventing misuse.
- Legal compliance: where required to comply with law or protect rights and safety.
How we use information
We use personal information to:
- Create and manage your account and business pages.
- Display published business information on public pages and in Explore.
- Route inquiries to the correct business and open WhatsApp with a pre-filled message.
- Show business owners inquiry and WhatsApp click history in their dashboard.
- Operate, secure, and improve the Service, including rate-limiting abuse.
- Comply with law and enforce our Terms of Service.
Public business information
When you publish your business page, information you choose to include (such as business name, logo, description, category, address, hours, products, and posts) may be visible to anyone with your page link or through Explore search and category browsing.
Your WhatsApp number is used so customers can contact you. Consider what you publish carefully.
Email Communications
We may use your email address to send you critical, transaction-related communications, including:
If we introduce promotional or marketing emails in the future, you will always have the option to unsubscribe or opt out of receiving those messages by following the unsubscribe link included at the bottom of the email.
- Account registration and email verification links.
- Password reset instructions.
- Security alerts and access notifications.
- Important service announcements regarding your account or billing.
Data retention
We retain account and business data while your account is active and as needed to provide the Service.
Inquiry records (name, phone, product inquired about, and related metadata) are retained while the receiving business account remains active, so the business owner can view customer activity in their dashboard.
WhatsApp click analytics are retained for the same period unless deleted earlier upon request.
Page activity events used for business page analytics are deleted automatically about 400 days after they are recorded, so a business can compare the current period against the same period last year and no longer.
We will delete or anonymize personal information within 30 days after receiving and verifying a deletion request, unless we are legally required to retain certain information. Encrypted backups may temporarily retain deleted information before permanent removal.
You may delete or update much of your business content from the dashboard at any time. Account holders and visitors may request deletion using the contact email below.
Security
We use industry-standard technical and organizational security measures to protect your personal information. These include secure authentication methods, password hashing, data encryption in transit, strict access controls on our APIs and databases, and regular security updates to our systems.
However, please note that no method of electronic transmission or storage is completely secure, and no online service can guarantee absolute security. We recommend using a strong, unique password and keeping your login credentials confidential.
Your choices and rights
Account holders can update profile and business information in the dashboard, change password in account settings, and unpublish pages to remove them from public discovery.
Depending on applicable law (including India's Digital Personal Data Protection Act, 2023 where it applies), you may have rights to access, correct, delete, or withdraw consent for certain processing.
Visitors who submitted an inquiry may request access to or deletion of their inquiry data by emailing us with the business name, approximate date of inquiry, and the mobile number used. We may need to verify the request before acting.
Visitors can avoid saving details in localStorage by using private browsing or clearing site data, and can choose not to submit inquiries.
International Users
Vechilo is operated and hosted in India. If you access the Service from outside India, please be aware that your personal information may be transferred to, processed, and stored in India or other countries where Vechilo, its affiliates, or its third-party infrastructure providers operate. Data protection laws in these countries may differ from those in your jurisdiction.
Children
The Service is intended for businesses and adults. It is not directed to children under 18, and we do not knowingly collect personal information from children.
Changes to this policy
We may update this Privacy Policy from time to time. We will revise the "Last updated" date and, where required, ask account holders to accept updated terms before continuing to use the Service.
Contact
For privacy questions or requests, email us at the address shown on this page. Please include enough detail for us to verify your account or request.
See also Terms of Service and Privacy Policy.
