Privacy Policy
1. Relationship to the company privacy principles
The company’s published privacy page states a no-data-sale principle and recognises customers’ ownership of their business information. This product follows those principles while describing its actual processing separately. Read the company privacy page. We do not represent that a future platform’s storage encryption, AI handling or compliance controls have already been implemented.
2. What the current preview processes
Simulation selections and planner entries are processed locally in your browser. The sandbox stores flow names, sample replies and monthly run counts in local storage; downloading a brief creates a local file. These entries are not submitted to Bytes Booster. Hosting can process IP address, timestamp, requested URL, browser metadata and error/security logs. Google Fonts receives technical network requests when external fonts load. No marketing pixel or analytics SDK is intentionally deployed in this preview.
Current Free account registration
Registration now stores your name, email, a one-way password hash, email-verification state, client role, Free plan, account creation time and authentication version in a private server-side SQLite database. Passwords are not stored as readable text. Hashed single-use verification/reset tokens expire after 24 hours / 30 minutes. Unverified registrations older than seven days are removed when the account service next runs. Security events are retained for up to 180 days and cleaned on account-service requests.
Login and email-request limits use a hash of the connection IP and email. A Secure, HttpOnly, SameSite session cookie is necessary for authentication, expires with the browser session and has a 30-minute inactivity timeout enforced on requests. The mail server processes your address and verification/reset email; automated messages use noreply@automate.bytesbooster.com with replies directed to bytesbooster@gmail.com. Inbox delivery is not yet end-to-end verified. We do not add you to marketing lists by registering.
The Free account profile remains until you request account deletion or we communicate an account-cleanup policy. Paid-expiry deletion rules do not currently run on Free accounts. Contact bytesbooster@gmail.com for verified access, correction or deletion requests. Only the public simulator stores its explicitly saved drafts on your browser; no chat history is stored in the account database. Live messaging, payment processing and AI support are not active.
3. What changes at live launch
Live accounts will require identity/contact information, billing references, workspace roles, business assets, contacts, messages, delivery metadata and security records necessary to provide the service. A separate collection notice and processing agreement must identify purposes, roles, service providers, transfers and controls before this processing begins. Customer businesses determine the purposes of their recipient messaging; Bytes Booster processes agreed service data on their instructions, while handling its own billing, support and security obligations.
4. AI support and privacy
The planned AI help layer must be clearly identified. Only the minimum approved support context may be passed to an authorised model provider. Do not include customer lists, payment data, credentials, confidential message history or special-category information in support prompts. Private tenant data must not become another tenant’s knowledge base. Automated troubleshooting may suggest actions; refunds, security-sensitive changes and misuse appeals require authorised review. Actual AI providers and their retention/processing terms will be disclosed before activation.
5. Proposed retention schedule
The following is the production retention specification. It does not claim a database or deletion scheduler is already running in the preview.
| When | Access & data handling at paid launch |
|---|---|
| Before expiry | Renewal reminders targeted at 7 days and 1 day before expiry, plus an expiry notice. No automatic debit without an explicit recurring mandate. |
| At expiry · Day 0 | Outbound sends, API sends, campaign queues, paid AI calls and workflows pause immediately. Pending jobs do not silently restart or back-send on renewal. |
| Days 1–30 | Read-only workspace and self-service export for the verified account owner. No paid sending. Renewal restores eligible data and settings after checks. |
| Days 31–90 | Restricted recovery archive; ordinary workspace access ends. A verified owner may request export or paid reactivation before day 90. No new message capture. Reminder targets: days 23, 60 and 83. |
| After day 90 | Primary customer contacts, conversations, media and flow data are scheduled for permanent deletion within 7 days. Recovery is not promised after day 90. |
| Backup expiry | Deleted customer content ages out of rotating backups within 30 days after primary deletion. Backups are restricted, not a customer recovery service. Restoration must reapply deletion records. |
The clock starts at the paid subscription’s effective expiry, not the day a reminder is read. An earlier verified deletion request overrides the ordinary recovery window where legally permitted. Fraud investigations, litigation holds or mandatory records may require narrowly scoped retention; access is restricted and retention is reviewed. Data held separately by Meta, an AI provider or a downloaded export is governed by that holder.
| Active-account record | Default retention target |
|---|---|
| Customer chat content and media | 90 days rolling; owner can export and select a shorter retention period. Extended storage requires a separate quoted agreement. |
| Contacts and flow configuration | For the active subscription, subject to a verified earlier deletion instruction and the post-expiry schedule. |
| Delivery / workflow event metadata | 90 days rolling; message content excluded where unnecessary. |
| Security and access audit logs | 180 days, minimised and access-restricted, or longer only where law or a documented incident hold requires. |
| Support / AI-support conversation records | 90 days after ticket closure; relevant evidence retained separately only for a documented dispute or legal obligation. |
| Invoices, tax and transaction records | For the applicable statutory period, recorded before billing activation; not an indefinite copy of chat content. |
| Consent and opt-out evidence | While needed to demonstrate consent, prevent re-contact and meet legal obligations; use minimal identifiers, restrict access and review necessity regularly. |
6. Your rights and choices
Contact bytesbooster@gmail.com for access, correction, export, deletion, consent withdrawal or a privacy grievance. Verification must be proportionate. Local-only preview data can be removed using browser site-data settings; we do not hold a server copy to export. Valid privacy requests are not blocked by subscription expiry or a support quota. Lawful record-retention duties may prevent immediate erasure of a narrow subset, which will be explained where permitted.
7. Security, transfers and updates
HTTPS is active for this site. Future production requires tenant isolation, encryption at rest, role-based access, secret management, backups, vendor agreements and incident procedures before customer datasets are accepted. External providers may process data across borders under applicable requirements. No security system is absolute. Material changes to the processing notice will be dated and communicated as required.
Business location: Barrackpore, Kolkata, India.
Product support, privacy, misuse reports and refund requests: bytesbooster@gmail.com
WhatsApp: +91 87774 38845 ↗