1. Who we are
This Privacy Policy explains how Neebora Technologies ("Neebora", "we", "us", "our") collects, uses, shares and protects personal information when you visit neebora.com, apply for early access, or use the Neebora platform.
Neebora Technologies is a brand operated by Viraj Bharat Pokar, a sole proprietorship registered in India. Our registered address is A/503, Parampara Building, Cosmos Heritage Complex, Tikuji Ni Wadi Road, Manpada, Thane West, Maharashtra 400610, India. You can reach us at hello@neebora.com.
By accessing our website or using our platform, you acknowledge that you have read and understood this policy. If you do not agree, please do not use our services.
2. Definitions
Authorized Customer (or "Customer"): A business or professional (such as an event management company or wedding planner) that registers for and uses the Neebora platform.
Guest (or "End User"): An individual whose details a Customer adds to a project guest list, and who may receive WhatsApp messages sent through the platform on a Customer's behalf.
WhatsApp Data: Any data processed through Neebora's integration with the WhatsApp Business Platform. This includes WhatsApp Business Account (WABA) identifiers, phone number IDs, access tokens, message content (text, media, documents), message metadata (timestamps, delivery and read status), and guest WhatsApp profile information.
Technical Service Provider (TSP): The role Neebora plays when processing WhatsApp Data on behalf of and as instructed by a Customer. In this role, the Customer is the data controller (data fiduciary) and Neebora is the data processor.
Personal Data: Any information that identifies or can identify a living individual, as defined under India's Digital Personal Data Protection Act, 2023 ("DPDP Act") and applicable rules.
Project: A workspace a Customer creates inside Neebora for a specific event (such as a wedding or corporate summit), with its own dedicated WhatsApp number and guest list.
3. Our role with your data
Because Neebora is a platform used by businesses to communicate with their guests, we handle personal information in two different roles:
- Data fiduciary (controller) for Customer and website data: For information provided by website visitors, early-access applicants and Customers (such as account details and billing information), Neebora decides the purpose and means of processing. We are the data fiduciary for this data.
- Data processor (TSP) for Guest data: For personal information that Customers upload about their guests — names, phone numbers, RSVP responses and message history — the Customer is the data fiduciary. Neebora processes this data only on the Customer's instructions and solely to provide the service. We do not use Guest data for our own marketing, profiling or any purpose beyond delivering the platform features the Customer has requested.
Customers are responsible for ensuring they have a valid legal basis (including guest consent where required) to collect, upload and use their guests' personal information through Neebora, and for complying with all applicable laws and WhatsApp's policies.
4. Information we collect
4.1 Information you give us directly
- Early-access requests: Your name, work email, company name, type of events you run, and any other details you include in your request.
- Account registration: Your name, business name, email address, phone number and login credentials.
- Billing information: Contact and billing details provided when you subscribe to a paid plan. Payment card details are processed by our payment service provider (Razorpay or an equivalent authorised payment gateway) and are not stored on Neebora's servers.
- Support and correspondence: Messages you send us, including support requests, complaints and data rights requests.
4.2 Information Customers put into the platform (Guest data)
- Guest names, WhatsApp phone numbers, RSVP responses, attendance status and any other information a Customer adds to a project.
- Message content and attachments sent to and received from guests through WhatsApp.
- Message metadata: timestamps, delivery status, read receipts and message identifiers.
4.3 Information from the WhatsApp Business Platform
- When a Customer connects a WhatsApp number via Meta's Coexistence feature, we receive the WABA identifier, phone number ID and access token provided through Meta's OAuth flow. We use these solely to operate the connection the Customer has authorised.
4.4 Information collected automatically
- Standard technical data such as IP address, browser type, device information, pages visited and access timestamps, collected in server logs for security and operational purposes.
- Cookie and session data as described in Section 15.
5. How we use information
- To provide, operate, maintain and secure the Neebora website and platform.
- To review early-access applications and communicate with applicants.
- To create and manage Customer accounts and authenticate users.
- To process subscription payments and usage-based charges.
- To send and receive WhatsApp messages on behalf of Customers as instructed, and to display delivery status, replies and RSVP data in the portal.
- To send Customers service-related communications: account notices, billing receipts, policy updates and security alerts.
- To respond to support requests, complaints and data rights requests.
- To detect, prevent and investigate security incidents, fraud, abuse and violations of our Terms of Service.
- To comply with legal obligations under Indian and applicable international law.
- To improve the platform based on usage patterns (using aggregated and anonymised data only).
We do not sell personal information. We do not use Guest data for advertising or to market Neebora's services to guests.
6. Consent and legal basis
We process personal information on the following bases under the DPDP Act and applicable law:
- Consent: For early-access requests and marketing communications, with the ability to withdraw at any time by contacting us.
- Contract: To perform our agreement with Customers, including account management, platform delivery and billing.
- Legitimate interest: For security monitoring, fraud prevention and improving the platform, where these do not override individual rights.
- Legal obligation: Where Indian law or a court order requires us to process or retain data.
Customers are independently responsible for identifying and documenting a valid legal basis (including obtaining any required consents) for collecting and processing their guests' personal information through Neebora.
7. WhatsApp data — our TSP obligations
Neebora acts as a Technical Service Provider (TSP) for the WhatsApp Business Platform. In this role:
- We process WhatsApp Data only on behalf of and as directed by our Customers. We do not access, use or share WhatsApp Data for any purpose beyond providing the platform to that specific Customer, except as required by law or Meta.
- We do not use WhatsApp Data to train machine learning models, build user profiles for advertising, or share it with third parties for their own purposes.
- We implement technical and organisational measures to protect WhatsApp Data, as described in Section 12.
- When a Customer's account is closed or a project is deleted, associated WhatsApp Data is deleted within 30 days, subject to any legal retention requirements and backup rotation cycles.
- Our Customers are the data controllers for the WhatsApp Data of their guests. Guests wishing to exercise rights over their data should contact the Customer (the event company that messaged them) directly. We will assist Customers in responding to such requests.
- Meta Platforms, Inc. processes message data through its own infrastructure under its own terms and privacy policy. Neebora is independent of Meta and is not an official Meta partner, endorsed product or sponsored service.
8. Who we share information with
We share personal information only where necessary:
- Meta Platforms (WhatsApp Business Platform): Messages are transmitted through Meta's infrastructure. Meta processes this data under its own WhatsApp Business Terms of Service and privacy policy.
- Payment service providers: Razorpay (or an equivalent RBI-authorised payment gateway) processes subscription and usage payments. They receive billing contact details and transaction data; they do not receive Guest data.
- Hosting and infrastructure providers: Cloud and infrastructure providers that host the platform. They process data only to provide services to Neebora under contractual data protection obligations.
- Email and form service providers: Zoho, for email and early-access form services. Subject to Zoho's privacy policy.
- Legal and regulatory: Authorities, courts or other parties where required by Indian law, a court order, or to protect rights, safety and security.
- Business transfer: A successor entity if Neebora is sold, merged or transferred, subject to this policy.
Guest data is shared only with the Customer whose project it belongs to, and is never visible to other Customers.
9. Payment data
Neebora's billing model includes an annual business subscription fee, a monthly per-project fee, and usage-based message charges that reflect Meta's conversation-based pricing for the WhatsApp Business Platform. Exact pricing is published on our pricing page (to be published before paid plans launch).
Payment transactions are processed by Razorpay or an equivalent RBI-authorised payment gateway. We do not store full payment card numbers, CVV codes or UPI credentials on our servers. We retain transaction records (amount, date, invoice reference) for accounting and legal compliance purposes.
Usage charges for WhatsApp messages are based on Meta's published conversation rates and are passed through to Customers. Neebora does not mark up Meta's messaging fees beyond what is stated in the applicable pricing plan.
10. International transfers
Neebora is operated from India. Our infrastructure providers, Meta, and Zoho may process data in other countries. Where personal data is transferred outside India, we take reasonable steps to ensure it remains protected in line with the DPDP Act and applicable cross-border transfer restrictions. By using the platform, Customers acknowledge that such transfers may occur as part of delivering the WhatsApp integration.
11. Data retention
- Early-access request data is retained while we evaluate and follow up on your request, and for up to 12 months thereafter.
- Account and billing data is retained for the duration of the Customer relationship and for 7 years after account closure for accounting and legal compliance.
- Project and Guest data is retained while the project is active. When a Customer deletes a project or closes their account, associated Guest data is deleted within 30 days, except where retention is required by law.
- Server logs are retained for up to 90 days for security purposes, then deleted or anonymised.
- Backup copies are overwritten on a rolling cycle within 30 days.
To request early deletion, see Section 18 or our Data deletion page.
12. How we protect information
We implement appropriate technical and organisational safeguards, including:
- Encryption of data in transit using TLS/HTTPS and encryption of sensitive data at rest.
- Access controls limiting who within Neebora can access personal data, on a need-to-know basis.
- Complete isolation of each Customer's project data — no Guest data from one project is accessible in another project or to another Customer.
- Regular review of security practices as the platform develops.
We comply with security requirements under the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the DPDP Act.
No security system is completely impenetrable. We cannot guarantee absolute security. If we become aware of a personal data breach that affects you, we will notify you and the relevant authority as required by applicable law.
13. Your rights
Under the DPDP Act and applicable law, you may have the right to:
- Access a summary of the personal data we process about you;
- Correct or update inaccurate or incomplete personal data;
- Request erasure of your personal data;
- Withdraw consent you have given (without affecting the lawfulness of processing before withdrawal);
- Seek grievance redressal through our grievance officer;
- Nominate a person to exercise your rights if you are incapacitated.
To exercise any of these rights, email hello@neebora.com with the subject line "Data rights request". We may need to verify your identity before acting on your request. We aim to respond within 30 days.
If your request concerns Guest data held on behalf of one of our Customers, we may direct you to that Customer, who is the data controller for that data.
14. If you are a guest
If you received a WhatsApp message about an event that was sent through Neebora, the event company that messaged you is the data controller for your personal information. To stop receiving messages, you can:
- Reply STOP or OPT OUT to the message;
- Block the sender's number in WhatsApp;
- Contact the event company directly and ask to be removed.
You can also email hello@neebora.com with your name and WhatsApp number and we will pass your request to the relevant Customer or act on it directly where we are able to do so.
15. Cookies and similar technologies
Our website uses session cookies for authentication and to maintain your logged-in state. We do not currently use advertising or behavioural tracking cookies. Our website loads fonts from Google Fonts, which means your browser contacts Google's servers and Google receives your IP address as part of that request.
The Zoho Forms embed on our early-access page is subject to Zoho's privacy policy. If we add analytics or other cookies in future, we will update this policy and, where required, seek your consent.
16. Children
Neebora is a business platform intended for professionals aged 18 and above. We do not knowingly collect personal data from individuals under 18 for our own purposes. Customers are responsible for the lawfulness of any Guest data they upload, including ensuring that if a guest is a minor, there is a valid basis for processing their information.
17. Changes to this policy
We will update this policy as Neebora develops and new features are added. We will post the updated version at neebora.com/privacy.html and update the "Last updated" date. For significant changes, we will also notify account holders by email at least 14 days before the change takes effect. Continued use of the platform after that date constitutes acceptance of the updated policy.
18. Contact and grievance officer
For questions about this policy, to exercise your data rights, or to raise a complaint:
Viraj Bharat Pokar, Grievance Officer
Neebora Technologies
A/503, Parampara Building, Cosmos Heritage Complex,
Tikuji Ni Wadi Road, Manpada, Thane West,
Maharashtra 400610, India
Email: hello@neebora.com
Subject line: "Privacy — [your request]"
We acknowledge grievances within 48 hours and aim to resolve them within 30 days, as required under the DPDP Act.
If you are not satisfied with our response, you may escalate to the Data Protection Board of India once it is constituted under the DPDP Act.