Privacy Policy

DotSpheres Technologies Pvt Ltd (“ReachBell”, “we”, “us”, “our”) operates ReachBell, a customer engagement platform that lets businesses send web and mobile push notifications, email, SMS, and WhatsApp messages, build audience segments, and run visual automations. This Privacy Policy explains what personal data we process, why we process it, who we share it with, and the rights you have over it. It is written to reflect our obligations under India’s Digital Personal Data Protection Act, 2023 (the “DPDP Act”) and the European Union General Data Protection Regulation (the “GDPR”).

It applies to https://www.reachbell.com (our marketing website), https://app.reachbell.com (the ReachBell application and dashboard), and the APIs and SDKs we make available to customers.

The two roles we play

ReachBell processes personal data in two distinct capacities, and your rights and our responsibilities differ depending on which applies.

• As a controller (Data Fiduciary) — account & billing data. When we decide how and why to process data about our own customers — the account holders, billing contacts, and dashboard users who sign up for and administer ReachBell — we act as the controller under the GDPR and as the Data Fiduciary under the DPDP Act. This policy governs that processing directly.
• As a processor (Data Processor) — subscriber data. When our customers use ReachBell to message their own subscribers and end users, the customer decides what data to upload and why it is processed. For that data the customer is the controller / Data Fiduciary and we act only as a processor / Data Processor, handling the data on the customer’s documented instructions under our Data Processing Addendum. If you are a subscriber and want to exercise rights over your data, please contact the business whose messages you receive — they control that data, and we will assist them in responding.

Data we collect

• Account data — your name, email address, hashed password, organization name, role, and the settings and content you create in the dashboard.
• Billing data — your plan, invoices, payment status, and GSTIN (where provided). Card, UPI, and bank details are collected and processed by our payment provider, Cashfree; we receive only payment metadata (such as a transaction reference and outcome) and never store full card or UPI credentials on our servers.
• Subscriber data processed on behalf of customers — data our customers send messages to or about, which may include push notification tokens, email addresses and phone numbers (where the customer uses the email, SMS, or WhatsApp channels), tags and custom attributes, coarse geolocation derived from IP address (typically city and country), device and browser information, and engagement events such as deliveries, opens, clicks, and unsubscribes.
• Usage & log data — technical records generated as you use the Service, including IP address, user-agent, a per-request request identifier, dashboard actions captured in a 90-day audit log, and diagnostic logs used to operate and secure the platform.

Legal bases for processing (GDPR)

Where the GDPR applies, we rely on the following legal bases. The DPDP Act’s comparable grounds — consent and certain legitimate uses — are reflected in the same activities.

• Performance of a contract — to create and administer your account, deliver the Service, and bill you for it.
• Legitimate interests — to secure, maintain, debug, and improve the Service and to prevent fraud and abuse, balanced against your rights and freedoms.
• Consent — for end-user opt-ins to notifications and marketing, which our customers capture from their subscribers, and for any optional processing where we ask for your agreement. Consent can be withdrawn at any time.
• Legal obligation — to comply with tax, accounting, and other legal requirements, and to respond to lawful requests from authorities.

Why we process it

• To provide the Service — deliver messages across channels, render analytics, and enforce frequency caps and subscriber preferences.
• To secure the platform — detect and prevent fraud and abuse, and maintain audit logs.
• To support you — respond to questions, diagnose issues, and provide service communications.
• To bill you — process payments and issue GST invoices.
• To comply — meet our legal, tax, and regulatory obligations and respond to lawful requests.

Sub-processors

We use a small number of vetted third-party sub-processors — for hosting, email and message delivery, payments, and error monitoring — to operate the Service. Each is bound by data-protection terms consistent with this policy and with applicable law. The current list of sub-processors is maintained at https://www.reachbell.com/subprocessors, and our processor commitments are set out in our Data Processing Agreement. We give advance notice of material changes to our sub-processors so customers can review them. We do not sell personal data.

International transfers

ReachBell relies on infrastructure and sub-processors that may process data outside the country in which a data principal is located, including in the European Union and the United States. Where personal data is transferred across borders, we put appropriate safeguards in place — such as the European Commission’s Standard Contractual Clauses for transfers from the EU, and equivalent contractual and technical measures for transfers out of India — so that the data continues to receive a level of protection consistent with this policy and applicable law.

Retention

We keep personal data only for as long as we need it for the purposes described above.

• Subscriber and attribute data is retained while the customer’s project is active and is deleted or returned when the project is closed or on the customer’s instruction.
• Engagement events and operational logs are kept on rolling time-to-live windows of approximately 90 days.
• Account and billing records are retained for as long as required by Indian tax and company law.

Your rights

Subject to applicable law, you have the right to access your personal data, to correct inaccurate data, to export or receive a portable copy of it, to request erasure, to restrict or object to certain processing, and to withdraw consent where processing is based on consent. Subscribers can withdraw consent and unsubscribe instantly using the preference-center link included in every message.

Under the DPDP Act you also have the right to nominate another individual to exercise your rights in the event of death or incapacity, and the right to grievance redressal. We respond to verified requests within the timelines required by applicable law. If you are not satisfied with our response, you may escalate to the Data Protection Board of India or, in the EU, to your local supervisory authority. Account holders can exercise these rights from the dashboard or by contacting our Grievance Officer below; subscribers should contact the business whose messages they receive, and we will assist that business as its processor.

Children

ReachBell is a business tool and is not directed at children under 18, and we do not knowingly process the personal data of children as a controller. Customers must not use ReachBell to process the personal data of children unlawfully, and must comply with the DPDP Act’s requirements on children’s data — including obtaining verifiable parental consent where required and refraining from tracking, behavioural monitoring, or targeted advertising directed at children.

Cookies

We use a limited set of cookies and similar technologies to operate our website and application and to understand usage. For details on what we set and how to control them, see our Cookie Policy.

Security

We protect personal data with technical and organizational measures appropriate to the risk. Data in transit is encrypted with TLS. Sensitive credentials — such as FCM service accounts, APNs keys, and DNS tokens — are encrypted at rest with AES-256-GCM. Access to production systems is role-based and least-privilege, and administrative actions are captured in our audit log. You can read more about our practices on our Security page.

Breach notification

If a personal data breach occurs, we will assess it promptly and notify affected customers, data principals, and the relevant authorities as and within the timelines required by applicable law, including the DPDP Act and the GDPR.

Grievance Officer & contact

If you have a question, concern, or complaint about how your personal data is handled, you can contact our Grievance Officer:

• Grievance Officer
• Email: support@reachbell.com
• DotSpheres Technologies Pvt Ltd
• Registered office: Jaipur, Rajasthan, India

We acknowledge complaints promptly and work to resolve them within the timelines required by applicable law.

Changes & contact

We may update this Privacy Policy from time to time. When we make material changes, we will announce them and update the “Last updated” date above. For any privacy question, write to support@reachbell.com · DotSpheres Technologies Pvt Ltd, Jaipur, Rajasthan, India.