Privacy Policy

Slot Reply is operated by Ondravan Private Limited (CIN U62011TN2026PTC195416), at 19/35 Mount Road, Little Mount, Saidapet, Chennai 600015, Tamil Nadu, India. Contact us at admin@ondravan.com.

We are the controller for account, billing and service-administration data. For WhatsApp conversations handled for a subscribed business, that business is normally the controller and Ondravan acts as its processor.

• Account data: name, email address, phone number, business name and subscription plan.
• WhatsApp connection data: authorised WhatsApp Business Account and phone-number identifiers, business profile details, webhook status and encrypted access credentials.
• Conversation data: customer profile name and phone number, messages and media sent to the connected business, timestamps, delivery/read status and the business's replies.
• Configuration data: services, prices, FAQs, bot instructions, flows and handoff preferences supplied by the business. Message templates are read directly from Meta and are not copied into our database.
• Billing and technical data: payment/order status, IP address, browser/device information, security events and diagnostic logs. We do not receive or store complete card details.

• To authenticate users, provide the dashboard and maintain the subscription.
• To connect the business-authorised WhatsApp account and route signed webhook events to the correct tenant.
• To display conversations, send manual or automated replies and report delivery status.
• To generate a suggested or automated reply using the business configuration and recent conversation context.
• To prevent abuse, investigate incidents, debug faults and meet legal obligations.

We do not sell personal data or use WhatsApp conversation content for advertising.

A business administrator must explicitly authorise Slot Reply through Meta's Embedded Signup. We use only the WhatsApp Business assets shared during that flow. Meta delivers message and status webhooks to our signed endpoint, and we send replies through the WhatsApp Cloud API.

A business can disconnect its account at any time. Disconnecting unsubscribes our app from the WhatsApp Business Account and removes the stored access credential.

When automation is enabled, relevant conversation text and the business's configured instructions may be sent to our language-model provider, currently Groq, to generate a reply. Anthropic may be used only if configured by Ondravan for the service. We do not use customer content to train our own models.

Businesses can use deterministic flows or take over a conversation instead of relying on an automated reply.

We disclose only what is needed to providers that help operate Slot Reply:

• Meta Platforms: WhatsApp account authorisation and message transport.
• Groq or an enabled model provider: generation of assistant replies.
• Hostinger: infrastructure hosting for the application and tenant databases.
• Razorpay: subscription payment processing and payment status.

We may also disclose information when required by law or to establish, exercise or defend legal claims.

• Each subscribed business is provisioned a separate tenant database.
• WhatsApp access credentials are encrypted at rest and are not exposed to the browser.
• Production traffic uses HTTPS, secure session cookies and signed authentication tokens.
• WhatsApp webhooks are verified using Meta's request signature before processing.
• Administrative access is restricted and production configuration is checked at startup.

Account and conversation data is kept while the account is active. When an account is deleted, its tenant database and connected WhatsApp credentials are removed. We may retain payment and tax records where Indian law requires it. Security and diagnostic logs are retained only for the period reasonably needed to protect and operate the service.

You may request access, correction, export, restriction or deletion of your personal data by emailing admin@ondravan.com. If the information belongs to a business's customer conversation, we may refer the request to that business as controller.

Account owners can delete the account from Settings → Danger zone. This permanently removes the tenant database. You can also follow our data deletion instructions or email us with the subject “Slot Reply data deletion”. We verify the requester and normally complete a valid request within 30 days.

We are based in India. Some providers may process data in other countries. We select providers with data-protection commitments and limit transfers to the information needed to deliver their service.

Slot Reply is a business service and is not directed to anyone under 18. Contact us if you believe a child has provided personal data through the service.

We may update this policy as Slot Reply changes. We will update the date above and provide notice of material changes through the service or by email.