Privacy Policy

This Privacy Policy explains how Northstar Edtech Private Limited ("Northstar Edtech", "we", "us", or "our"), the company that owns and operates the Greeto brand and platform ("Greeto", the "Service"), collects, uses, discloses, and safeguards information when you use Greeto, including our website, web application, and any connected channels such as WhatsApp, Instagram, Facebook Messenger, Telegram, Google Business Profile and YouTube (collectively, the "Platforms").

Greeto is a business messaging and customer conversation platform. Our customers ("Business Users") use Greeto to communicate with their own end customers ("End Users") over WhatsApp, Instagram, Facebook Messenger, Telegram and other supported channels, to manage contacts, campaigns, automated workflows, and support conversations, and to manage their Google Business Profile locations. This policy describes our practices for both Business Users (who create accounts with us) and End Users (whose messages Business Users process through Greeto).

1. Information We Collect

1.1 Account Information

When a Business User signs up for Greeto, we collect:

• Name, email address, phone number, and password (stored as a salted hash, never in plain text).
• Business/workspace details such as company name and team member roles.
• Billing information processed via our payment provider (see Section 4).

1.2 Messaging Data

When a Business User connects a WhatsApp Business Account, Instagram professional account, Facebook Page, or Telegram bot to Greeto, we process, on the Business User's behalf:

• Message content (text, images, audio, documents, video, location, button and quick-reply selections) sent and received through the connected channel.
• Sender/recipient identifiers (e.g., WhatsApp phone number, Instagram-scoped user ID, Page-scoped user ID on Messenger, Telegram user ID) needed to route conversations.
• Message delivery metadata (sent, delivered, read, failed) and timestamps.
• Contact profile information made available by the messaging platform (e.g., a WhatsApp display name, an Instagram name and username, or a Messenger first and last name) or entered manually by the Business User's team.

We act as a data processor with respect to this messaging data: it is collected and controlled by the Business User for their own business purposes, and we process it only to provide, maintain, and improve the Service on their instructions.

1.3 Platform (Meta) Data

Where a Business User connects a Meta product to Greeto, we receive and store only what is needed to run the connected channel:

• WhatsApp Business Platform (via Embedded Signup): the WhatsApp Business Account ID, phone number ID, display phone number, an access token, message templates submitted to Meta, and webhook events for messages and delivery status.
• Instagram (via Instagram Login): the Instagram professional account ID, username, name, profile picture and account type, and a long-lived Instagram access token. We also receive webhook events for Direct Messages sent to the account, replies to buttons we sent, and comments on the account's posts and reels.
• Facebook Messenger (via Facebook Login for Business): the ID, name and picture of each Facebook Page the Business User chooses to connect, and that Page's access token. We also receive webhook events for Messenger conversations with the Page (messages, button taps, read receipts, reactions, and replies the business sends from Meta Business Suite) and new comments on the Page's posts.

1.4 How We Use Instagram Permissions

When a Business User connects an Instagram professional account, they grant Greeto the following permissions, which we use only as described:

• instagram_business_basic — to identify the connected account (ID, username, name and profile picture) and show it in the Business User's Greeto workspace.
• instagram_business_manage_messages — to receive Direct Messages that End Users send to the business, show them in the Greeto team inbox, and send the replies that the Business User's team or the automations they configure write. We only message people who have messaged the business first, within the time limits Instagram sets.
• instagram_business_manage_comments — to receive comments on the business's own posts and reels and, when the Business User sets up a comment automation, to reply to the comment or send the commenter one private message about it.

We use data received from Meta's APIs solely to send and receive messages, manage templates and comments, and provide the conversation-management features Business Users configure, consistent with the Meta Platform Terms and Meta Developer Policies. We do not use data received from Meta's APIs for advertising, to build profiles of users, or to train AI models, and we do not sell or transfer this data to data brokers or other third parties except as described in Section 3.

1.5 How We Use Facebook Page Permissions

When a Business User connects a Facebook Page, they grant Greeto the following permissions, which we use only as described:

• pages_show_list and business_management — to list the Pages the Business User chose in Facebook's login dialog (including Pages owned through a Business Portfolio), so they can be connected to their Greeto workspace.
• pages_manage_metadata — to subscribe the connected Page to our webhook when it is connected, and unsubscribe it when it is disconnected. We do not change any Page settings.
• pages_messaging — to receive the messages End Users send to the Page, show them in the Greeto team inbox, and send the replies the Business User's team or their automations write. We only message people who have messaged the Page first, within the time limits Messenger sets.
• pages_read_engagement, pages_read_user_content and pages_manage_engagement — to read the Page's own posts and new comments on them, and, when the Business User sets up a comment automation, to reply to a comment publicly or send the commenter one private message about it.
• Human Agent — so that a member of the Business User's support team (never an automation) can personally answer a customer up to 7 days after the customer's last message.

1.6 Google Business Profile Data

When a Business User connects Google Business Profile, they sign in with Google and grant Greeto these permissions (scopes):

• openid and email — to read the email address of the Google account used, so the workspace can show which login connected each location.
• https://www.googleapis.com/auth/business.manage — to list the business accounts and locations that Google account manages, so the Business User can choose which ones Greeto manages, and to manage the chosen locations' reviews for them.

With these permissions, Greeto accesses and stores:

• The Google account's email address, and an OAuth refresh token, encrypted at rest (AES-256-GCM).
• For each location the Business User connects: its name, address, Google Maps link, Place ID, and the name of the business account it belongs to. Locations that are listed but not chosen are not stored.
• For connected locations: reviews (reviewer name and profile photo as shown publicly on Google, star rating, review text and date) and the business's replies, so the Business User's team can read and answer reviews in Greeto. Replies are posted to Google only when a team member sends one, or under an auto-reply rule the Business User turned on.

We use Google user data only to provide these user-facing features in the Business User's workspace. We do not sell it, use it for advertising, or use it to build user profiles. We do not use it to train AI or machine-learning models. When a Business User asks for an AI-drafted reply, only that review's text, rating and the business name are sent to the AI provider to generate the draft (see Section 3). Greeto staff do not read this data, except with the Business User's permission for support, where needed for security, or to comply with law.

Greeto's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

A Business User can disconnect a location at any time in Greeto (Settings → Integrations → Google Business Profile). When the last location connected with a Google account is disconnected, we revoke Greeto's access with Google and delete the stored token. Access can also be removed at any time from the Google account at myaccount.google.com/permissions. To have the stored location and review data deleted, follow our Data Deletion page.

1.7 YouTube Data

Greeto's YouTube feature uses YouTube API Services. When a Business User connects a YouTube channel, they sign in with Google and grant Greeto the https://www.googleapis.com/auth/youtube.force-ssl and https://www.googleapis.com/auth/yt-analytics.readonly permissions (plus openid and email to show which Google login connected it). We use them only to:

• Identify the connected channel (its ID, title, custom URL and thumbnail).
• Read comments and replies on that channel's own videos (the commenter's public display name, profile picture and channel ID, the comment text, like count and date) and the titles of those videos, so the Business User's team can read them in Greeto.
• Post the replies a team member writes, as the channel, and hide (remove) comments a team member chooses to remove from the video.
• List the channel's uploaded videos with their public statistics (views, likes, comment count), and show the channel's YouTube Analytics (views, watch time, average view duration, subscribers gained and lost, likes, comments and shares, per day and per video) for the period a team member picks.
• Upload a video a team member chooses, with the title, description, tags, visibility, schedule and "made for kids" setting they enter. The file goes from their browser directly to YouTube; Greeto does not store the video.

We check for new comments about every 15 minutes while the channel is connected (every minute while a team member has the comments open), and keep the channel's video list (titles, thumbnails, publish dates, visibility and public view, like and comment counts) up to date using YouTube's notifications for new or changed videos. Analytics are fetched when a team member opens them and kept only in a short-lived cache (up to an hour), not in our database. We store the refresh token encrypted at rest (AES-256-GCM). We do not access the channel's subscribers list, playlists, private messages or any other YouTube data, we do not post or upload anything the team did not send, and we do not use YouTube data for advertising or to train AI models. Greeto's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Disconnecting a channel in Greeto (Settings → Integrations → YouTube) stops all access immediately and deletes that channel's stored comments from Greeto. When it was the last channel connected with that Google login, we also revoke Greeto's access with Google. Access can also be removed at any time from the Google security settings page; once access is removed, we delete any remaining stored YouTube data within 30 days. How Google itself handles personal data is described in the Google Privacy Policy.

1.8 Automatically Collected Information

• Log data such as IP address, browser type, device identifiers, and pages visited within the Greeto web application.
• Cookies and similar technologies used to keep you signed in and remember preferences (see Section 8).

2. How We Use Information

• To provide, operate, and maintain the Service, including delivering and receiving messages across connected channels.
• To authenticate accounts, enforce role-based permissions, and secure the platform.
• To route inbound conversations to the correct team member and support assignment, tagging, notes, and reporting features.
• To run automated workflows a Business User configures, such as keyword replies, comment-to-message automations, and follow-ups.
• To send transactional email (account verification, password resets, team invitations, billing notices).
• To process payments and manage subscriptions.
• Where a Business User enables an AI-assisted feature, to generate suggested replies, workflow drafts, or message templates.
• To detect, investigate, and prevent fraud, abuse, and security incidents.
• To comply with legal obligations and enforce our Terms & Conditions.

We do not use message content to serve advertising, and we do not sell personal information to third parties.

3. How We Share Information

We disclose information only as described below:

• With the platforms you connect. Meta (WhatsApp, Instagram, Messenger) and Telegram necessarily receive the messages Business Users send through those channels, and Google receives the review replies a Business User posts, as required to deliver them.
• With sub-processors who help us run the Service, under contractual confidentiality and data-protection obligations, including:
  • Cloud hosting, database, and S3-compatible object storage providers, for running the Service and storing media attachments exchanged in conversations.
  • ZeptoMail, for sending transactional email.
  • Razorpay, for processing subscription payments (Razorpay receives payment details directly; we do not store full card numbers).
  • Anthropic and Google (Gemini), only where a Business User enables an AI-assisted feature, limited to the text needed for that request.
• For legal reasons, if required by law, court order, or other legal process, or to protect the rights, property, or safety of Northstar Edtech, our users, or the public.
• With your consent, or at the direction of the Business User who controls the relevant conversation data.
• In a business transfer, such as a merger, acquisition, or sale of assets, subject to standard confidentiality protections.

4. Payments

Subscription payments are processed by Razorpay. We store subscription status, plan, and invoice records, but do not store full payment card numbers or bank account credentials on our servers.

5. Data Retention

We retain account and messaging data for as long as a Business User's workspace remains active, and for a reasonable period afterward to comply with legal, accounting, or reporting obligations, resolve disputes, and enforce our agreements. Media attachments follow the same retention as the conversation they belong to.

When a Business User disconnects a channel in Greeto, we immediately delete its access token and stop receiving new messages for it. Conversations already received remain in the workspace until the Business User deletes them or requests deletion of their workspace data as described in Section 7.

6. Data Security

We use industry-standard safeguards to protect information, including encrypted connections (TLS/HTTPS) for data in transit, encryption of channel access tokens at rest (AES-256-GCM), hashed password storage, role-based access controls, and signature verification for inbound webhook events. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

7. Your Rights and Choices

Subject to applicable law, including India's Digital Personal Data Protection Act, 2023, you may have the right to:

• Access, correct, or request a copy of your personal information.
• Request deletion of your account or personal information, subject to legal retention requirements — see our Data Deletion page for how to submit this request.
• Withdraw consent for optional processing, such as AI-assisted features, or for messages (for example, by replying STOP on WhatsApp).
• Object to or restrict certain processing of your information.
• Raise a grievance about how your data is handled.

Business Users can disconnect an Instagram account at any time from Greeto (Settings → Integrations → Instagram), or remove Greeto's access from the Instagram app under Settings → Apps and websites. A Facebook Page can be disconnected in Greeto (Settings → Integrations → Facebook Messenger) or removed under Facebook Settings → Business Integrations. A Google Business Profile location can be disconnected in Greeto, or Greeto's access removed at myaccount.google.com/permissions. In every case, we stop receiving data for that account.

End Users who message a Business User through WhatsApp, Instagram, or another connected channel and wish to exercise these rights should contact that Business User directly, as they control the underlying conversation data. Business Users may exercise these rights by contacting us at the address in Section 11.

8. Cookies and Similar Technologies

We use strictly necessary cookies and browser local storage to keep you signed in, remember your workspace preferences, and maintain session security. We do not use third-party advertising cookies.

9. Children's Privacy

Greeto is intended for business use and is not directed to children under 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can delete it.

10. International Data Transfers

Greeto is operated from India, and information may be stored and processed in India or other countries where our service providers operate. Where required, we take steps intended to ensure such transfers comply with applicable data protection law.

11. Contact Us

If you have questions about this Privacy Policy, wish to exercise your data protection rights, or want to raise a grievance, contact us at:

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated version on this page with a revised "Last updated" date, and, for material changes, provide additional notice where required by law.