Privacy Policy

1. Introduction

This Privacy Policy describes how Xzect Labs Private Limited ("we," "us") collects, uses, discloses, and protects personal information when you visit hyperfast.in, submit a lead or opt-in form, create a customer account, or use HyperFast products including HyperFast News, HyperFast Connect (WhatsApp/CRM), and related applications (collectively, the "Service").

By using the Service, you acknowledge this Policy and our Cookie Policy. Where required, we rely on consent, contract performance, legitimate interests, or legal obligation as described below.

We design our practices to align with India's Digital Personal Data Protection Act, 2023 (DPDP Act) and related rules, GDPR-style privacy expectations, payment gateway compliance requirements, major platform API policies (including Meta and Google), international SaaS standards, and trust & safety best practices, as further described in this Policy and our Platform Usage Policy.

2. Scope & Roles

HyperFast is both a company website and a SaaS platform. Roles depend on whose data is processed:

• Data Fiduciary / Controller (our own operations). Xzect Labs Private Limited is the data fiduciary (controller) for personal data we collect about website visitors, marketing leads, and HyperFast customer accounts — for example names, emails, and phone numbers from contact, demo, or WhatsApp opt-in forms on hyperfast.in, plus billing and account credentials.
• Data Processor (on behalf of customers). When a HyperFast customer uses the Service to run WhatsApp, CRM, campaigns, or similar workflows, that customer is typically the data fiduciary (controller) for their end users' personal data (contacts, chat history, campaign audiences). We act as a data processor under our Data Processing Agreement and the customer's instructions. We do not claim ownership of customer end-user data and do not use it to market HyperFast's own products.

This Policy does not apply to third-party websites, social networks, or services you connect to the Service; those are governed by their own policies.

3. Information We Collect

We may collect the following categories of information:

• Identity & Contact: names, email addresses, and phone numbers collected from lead forms, demo requests, contact pages, and WhatsApp opt-in forms on hyperfast.in, as well as customer account registration (organization, role, password hashes, authentication tokens, team membership, and preferences).
• Communication Data: WhatsApp message history, chat logs, templates, automated responses and API payloads processed via HyperFast Connect / the HyperFast API; emails, in-product chat, surveys, and marketing preference records. Where we process this data for a customer workspace, we do so as processor.
• Technical & Tracking: IP address, browser type and version, device identifiers, operating system, language, referrer URLs, session IDs, timestamps, cookies and similar technologies, Meta Pixel (where campaign tags are enabled), and Google Analytics. We also collect request and error logs for security and reliability.
• Billing data: subscription plan, transaction IDs, invoices, tax identifiers (where provided), billing address; payment card data is handled by payment processors (e.g., Razorpay), not stored by us in full.
• Content & usage: articles, prompts, media, schedules, publishing logs, connected account metadata, CRM records you store in HyperFast, feature usage, and support tickets.
• Inferences: aggregated analytics derived from usage (not used for automated legal decisions with significant effect unless disclosed).

You may choose not to provide certain information, but some features may be unavailable.

4. Analytics & Tracking

We use analytics and tracking solely to measure website and product performance and to improve user experience (page load, navigation, errors, and whether key flows work). We do not use tracking as a catch-all purpose to "improve our services" without these limits.

Analytics and tracking may involve:

• Google Analytics on hyperfast.in (including IP, browser, and page-view events as configured);
• Cookies and similar technologies as described in Section 14 and our Cookie Policy;
• Meta Pixel (Meta/Facebook Pixel) and similar campaign tags where we run or measure advertising — used to understand whether ads and landing pages perform, not to sell your data;
• Usage metrics: feature adoption, session duration, clicks, funnels, and performance monitoring (latency, errors, uptime);
• Abuse prevention: signals used to detect suspicious logins, spam, automation abuse, payment fraud, and policy violations.

Where required by law (including in the EU/UK and under applicable Indian consent rules), we obtain consent before non-essential analytics or marketing cookies. You may withdraw consent via cookie controls. Aggregated or de-identified analytics may be used without identifying you personally.

Third-party analytics providers process data under their own policies. We configure providers where possible to minimize data collection and honor regional requirements.

5. OAuth & Social Login

When you sign in with Google, Facebook, LinkedIn, or connect social publishing accounts, we receive tokens and profile information permitted by your authorization (e.g., name, email, page/account IDs, profile picture). We store tokens securely to operate integrations until you disconnect or they expire.

We do not post on your behalf except as directed through the Service. You can revoke access via the third-party platform or our settings. Revocation may disable scheduled publishing.

6. AI Processing

To provide AI features, we process prompts, source material, drafts, and configuration you submit. This may involve third-party AI model providers and cloud infrastructure. Content may be temporarily cached for performance, quality, safety filtering, and abuse prevention.

We do not use your private workspace content to train public foundation models unless clearly disclosed and opted in. We may use aggregated, de-identified data for analytics and service improvement.

AI processing carries inherent risks; see our Terms of Service regarding accuracy and your review obligations.

7. How We Use Information

• Provide, maintain, and secure the Service, including customer accounts, billing, authentication, and workspace features;
• Direct marketing and broadcasts: use phone numbers and email addresses you provide so we can send requested business updates, product information, marketing, and automated WhatsApp notifications (for example demo follow-ups or service alerts you asked for). We do this only where you have opted in or another lawful basis applies;
• Process WhatsApp, CRM, and campaign workflows that you (as a HyperFast customer) configure — as processor, solely on your instructions;
• Measure website and product performance and user experience as described in Section 4 (not as an unbounded "improve our services" purpose);
• Authenticate users and prevent fraud, abuse, suspicious activity, and security incidents;
• Process subscriptions, payments, and tax documentation;
• Publish and schedule content per your instructions;
• Provide support and respond to inquiries;
• Comply with law, enforce terms, and protect rights and safety;
• Generate aggregated analytics and service metrics.

8. Sharing & Processors

We share personal data only as needed to operate HyperFast. We do not sell, rent, or trade personal data to data brokers or other third parties for their independent marketing.

We may share information with:

• HyperFast CRM, campaigns, and Connect: our own systems on hyperfast.in / the HyperFast application that store leads, customer accounts, and (for customers) their CRM contacts and campaign audiences. These systems are operated by Xzect Labs Private Limited; they are not a sale of data.
• Meta (WhatsApp Cloud API / WhatsApp Business API): message content, phone numbers, and related metadata required to send and receive WhatsApp messages you or your end users initiate or opt into. Meta processes this data under its WhatsApp Business terms.
• Google: Google Analytics (website measurement) and Google OAuth or other Google APIs you connect.
• Payment processors: Razorpay and others for billing, fraud screening, and chargeback handling.
• Infrastructure processors: cloud hosting, databases, CDN, email delivery, error monitoring, and security vendors that process data only to provide their services to us.
• Third-Party Platforms: when you direct publishing or authentication (e.g., social networks).
• Professional advisors: lawyers, accountants, insurers, under confidentiality.
• Authorities: when required by law or to protect rights and safety.
• Business transfers: merger, acquisition, or asset sale, subject to this Policy or notice.

We require processors to protect personal data by contract. A current list of key sub-processors may be provided on request or in our DPA.

9. International Transfers

We are based in India and may process data in India and other countries where we or our processors operate. Where required, we implement appropriate safeguards such as standard contractual clauses, contractual protections, or other lawful transfer mechanisms.

By using the Service, you acknowledge that cross-border transfers may occur. See our DPA for enterprise transfer terms.

10. Security

We implement reasonable administrative, technical, and organizational measures described in our Security Policy, including encryption in transit, access controls, and monitoring. No method of transmission or storage is 100% secure.

You are responsible for safeguarding credentials and configuring team access. Report suspected incidents to [email protected].

11. Retention & Backups

Active leads and marketing contacts that we hold as data fiduciary (for example hyperfast.in lead or WhatsApp opt-in records) are stored for two (2) years after your last user-initiated interaction with us (such as a form submission, reply, or account login), unless a longer period is required by law or you ask us to delete sooner.

Opt-out and suppression. When you opt out of marketing (WhatsApp STOP, email Unsubscribe, or a request to [email protected]), we flag that preference immediately so further promotional messages stop. We then purge the contact from active marketing databases within thirty (30) days. We may keep a minimal suppression record (e.g., phone or email plus opt-out flag) so we do not message you again by mistake.

Customer accounts, billing records, and workspace data are retained while the account is active and as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce agreements. Where we act as processor, retention follows the customer's instructions and our DPA.

Backups and logs. Deleted data may persist in encrypted backups, server logs, analytics, and disaster-recovery systems for a limited period before automated purge. Backup restoration is not used to reactivate deleted accounts except where required for integrity or legal hold.

Legal hold. We may retain data longer when litigation, investigation, regulatory request, or compliance obligations require it.

12. Your Rights & Choices

As a data principal (and, where applicable, a data subject), you may:

• Access and correction: request a copy of CRM and account data we hold about you and ask us to correct inaccurate or incomplete records;
• Erasure: request deletion of your personal data from HyperFast databases and connected tools we control (including our CRM and marketing lists), subject to legal retention (e.g., invoices, security logs, suppression lists);
• Withdraw consent at any time, without penalty or loss of a paid service you are otherwise entitled to: reply STOP on WhatsApp, use Unsubscribe in marketing emails, or email [email protected]. Transactional messages (receipts, security alerts) may still be sent where needed to operate your account;
• Restrict or object to certain processing, request portability, and lodge a complaint with a supervisory authority, where those rights apply in your location.

To exercise rights, email [email protected] with verification information. We may deny requests where permitted by law (e.g., conflicting legal obligations or others' rights). We respond within the timelines in Section 20 (generally 7–30 days) and any longer period required by applicable law.

If your data was collected by a HyperFast customer (for example you chatted with a brand on WhatsApp through HyperFast Connect), that customer is typically the controller. We will forward verified requests to them or assist them under our DPA, unless we are legally required to act directly.

13. Account Deletion

You may request account deletion via settings (where available) or by emailing [email protected]. Upon verified request, we will deactivate your account and initiate deletion of personal data from active systems, subject to retention described above.

Deletion does not remove content already published on Third-Party Platforms; you must remove it there directly. Billing records may be retained for tax and accounting compliance.

14. Cookies & Similar Technologies

We use cookies, pixels (including Google Analytics and, where enabled, Meta Pixel), local storage, session storage, tags, and similar technologies for authentication, security, preferences, website performance and UX measurement, marketing (where permitted), and abuse prevention. See our Cookie Policy for categories, retention, and third-party providers. You can manage preferences via consent tools and browser settings.

15. Communications

We send service-related emails (receipts, security alerts, product changes) and, with consent or as permitted by law, marketing about features and offers. Phone and WhatsApp messages, if enabled, are used for requested business updates, marketing, and automated notifications per your opt-in and applicable regulations (including Meta WhatsApp policies).

You may withdraw marketing consent at any time without penalty: reply STOP to a WhatsApp message, click Unsubscribe in an email, or contact [email protected]. Opt-out is flagged immediately and processed as described in Section 11.

16. Child Safety & Age Restrictions

The Service is not intended for children under 13, or under the minimum age for digital consent in your jurisdiction (whichever is higher). We do not knowingly collect personal data from children below these thresholds.

Account holders must be legally capable of entering binding contracts—typically at least 18 years old or the age of majority in your jurisdiction, as stated in our Terms of Service.

We maintain a zero tolerance policy for child sexual abuse material (CSAM), exploitation, grooming, or other illegal child-related content. We may remove content, suspend accounts immediately, preserve evidence, and report to law enforcement, the National Center for Missing & Exploited Children (NCMEC) or equivalent bodies, and platform partners where applicable.

You are solely responsible for ensuring that any uploaded or AI-generated content involving minors complies with law, obtains required parental consent, and does not exploit or endanger children. Report concerns to [email protected].

17. Trust & Safety

We may use automated systems and human review for trust & safety, including abuse detection, spam prevention, malware scanning, and policy enforcement. AI safety filtering and automated classifiers are not perfect and may produce false positives or miss harmful content.

We reserve the right to monitor abuse indicators (including usage patterns, report signals, and integrity checks) and to remove, restrict, or escalate harmful or high-risk content or accounts, as described in our Platform Usage Policy.

We maintain logging and audit trails for security, fraud prevention, dispute resolution, and compliance purposes, subject to retention limits in this Policy.

18. Regulatory Compliance

Our privacy and data practices are designed to support compliance with:

• DPDP Act, 2023 (India) — lawful processing, data principal rights, grievance redressal, and processor obligations as described in this Policy and our DPA;
• GDPR-style expectations (lawful bases, data subject rights, processor terms, transfer safeguards);
• Payment gateway requirements (billing transparency, fraud monitoring, chargeback cooperation—see Refund Policy);
• Platform API policies (Meta WhatsApp Cloud API, Google/YouTube, LinkedIn, X, and similar developer and community standards);
• International SaaS standards for security, incident response, and subprocessors (see Security Policy);
• Trust & safety best practices for harmful content, child safety, and law enforcement cooperation.

No certification or statement in this Policy guarantees compliance in every jurisdiction; you remain responsible for your own legal obligations when using the Service (including notices and consents for your end users).

19. Policy Changes

We may update this Policy. Material changes will be notified via the Service or email where required. Continued use after the effective date constitutes acceptance unless prohibited by law.

20. Contact & Grievance Officer

For privacy, DPDP, and data-principal requests, contact the designated Grievance Officer:

• Name: Sandeep Kapri
• Designation: Director
• Organisation: Xzect Labs Private Limited, India
• Email: [email protected]
• Phone: +91 88602 61521

Additional privacy contact: [email protected].

We will acknowledge and respond to verified grievances and rights requests within 7 to 30 days of receipt (sooner where a specific law requires it). Complex cases may need extra verification; we will tell you if more time is required.

General inquiries: [email protected]. Security incidents: [email protected].