VANDORIO GLOBAL TECH PRIVATE LIMITED
Aleph Privacy Policy
What information Aleph holds about businesses that use it, their team members and the customers who message those businesses, and how it is used, kept and deleted.
1. Who this is for
Aleph is a WhatsApp-based tool for small businesses. It helps a business keep customer records, answer customers, raise invoices and (later) chase payments, all from WhatsApp and a web dashboard. The app may appear under the name Mayatrix.
Two groups of people have data in Aleph. This policy speaks to both.
- Businesses that use Aleph. The owner, the team members they add, and the business details they give us.
- Customers of those businesses. People who message a business that uses Aleph on WhatsApp. You never sign up with us. The business you are messaging chose to use Aleph.
If you only message a business and want the short version, we will publish a separate notice for people who message a business before any real customer messaging starts. Until then, sections 6, 6A, 7, 9, 10 and 11 are the parts that matter to you.
Our public website has its own privacy policy: vandorio.com/privacy.
2. Who we are
Aleph is run by VANDORIO GLOBAL TECH PRIVATE LIMITED ("Vandorio", "we").
- CIN: U62010AP2026PTC127544
- Registered office: Prime hill crest flat 403, near DGP office, Mangalagiri, Guntur- 522503, Andhra Pradesh
- Privacy and grievance contact: Darren Joy Vipparty, legal@vandorio.com
3. Where Aleph is today
Aleph is in pre-launch testing. It is not open to the public.
| State | What it covers |
|---|---|
| Running on a hosted test environment (last signed-in test 6 November 2026) | Sign-in for the business owner and team. A shared inbox for WhatsApp conversations. Replying by hand, with a person taking over a chat. Catalogue records and syncing them to the business's Meta catalogue. Delivery and read status. Daily encrypted backups are scheduled; a restore on the hosted system with earlier deletions re-applied has not yet been proven. |
| Built and tested on our side, switched off for real customers | Owner-only privacy requests: creating a request and exporting data work; deleting a business account is blocked in some cases (section 11). Invoices and credit notes. Orders, bookings and reminders. Customer records, notes, tags and loyalty counts. Optional product analytics and screen replay (off unless the business opts in). Optional research sharing (off unless the business opts in; see section 5). |
| Built, held back, not offered | AI replies to customers. An AI assistant for the owner. A website chat. Google Calendar, Gmail and Drive connections. Zoho connections. Location and proximity alerts. Broadcast campaigns. |
| Planned, not built | Collections: a balance per customer, "who owes me", payment reminders with opt-out. Stock levels beyond a simple count. Partner-delivered websites and ads. |
We will update this policy before we switch on anything in the second, third or fourth rows for real customers, where it changes how data is used.
During testing, the hosted environment holds one test business with made-up records and a small number of authorised testers, including Meta's app reviewers, when they test Aleph. Testers' own numbers and messages are still personal information, and this policy covers them.
4. Our role, in plain terms
For a business's own account (owner and team details, sign-in, billing, security), Vandorio is the data controller: we decide why and how the data is used, and we are responsible for it.
For a business's customers (their numbers, messages, orders, invoices), the business is the data controller and Vandorio is its data processor: the business decides why the data is collected and how it is used. We hold and process it for the business, on its instructions, to run Aleph. The business is responsible for telling its customers and for having a lawful reason to message them. A business's own privacy notice covers its use of customer information.
This is our working description of the roles and may be refined.
We may also use some data for our own purposes: keeping Aleph secure, finding faults, stopping abuse, meeting legal duties, and handling requests. We say where below.
5. What we collect about businesses and their team
| What | Where it comes from | Why we use it |
|---|---|---|
| Name, phone number, role, profile photo (if added) of the owner and each team member | The business | Sign-in, access by role, showing who did what |
| Email address of the person who registers | The business, at sign-up | Sending a sign-up verification code |
| Sign-in material: one-time codes sent by WhatsApp (stored as hashes), passkey public keys, recovery codes (stored as hashes), session records | Generated when you sign in | Secure sign-in and recovery |
| Network address of the device you sign in or register from | Your device | Short-lived limits on repeated attempts, and the hosting providers' request logs |
| Device and browser push tokens (off in the pilot setup) | Your device, if you turn on notifications | Sending alerts to the owner |
| Business profile: name, type, category, description, address, opening hours, services, language, tone, legal name, tax and registration numbers (for example GSTIN) | The business | Running Aleph, putting details on invoices, setting how replies sound |
| Registration documents: owner identity, address proof, business registration, GST certificate, licence, PAN | The business, at registration | Checking the business before approval. We accept an Aadhaar offline e-KYC file or QR, not the number. |
| Your onboarding chat with Aleph's own WhatsApp number: your number, the details and commands you send, and Aleph's automatic replies | You, through WhatsApp | Registering a business. Ordinary sign-up is closed during testing |
| Application status, owner name, business page link, what we asked you to fix, and our reviewers' internal notes | You and our reviewers | Deciding whether to approve a business |
| WhatsApp setup: WhatsApp Business account ID, phone number ID, the display number, catalogue ID | The business and Meta | Connecting the business's number to Aleph |
| Catalogue items: names, descriptions, prices, stock counts, images | The business | Showing products in chats, syncing to the Meta catalogue |
| Knowledge entries the business writes for replies | The business | Answering customers (by a person now, by AI only if it is ever switched on) |
| Invoices, credit notes, orders, bookings, reminders and the merchant's UPI payee ID and name | The business | Billing and payment requests |
| Subscription and usage records | Created as the business uses Aleph | Plan limits, billing records, support |
| Owner-supplied extras (off or hidden features): a customer review's reviewer name, phone and text; a referred business's phone number; the Google account email if Google is connected; credit purchase records; a payment QR image; daily owner summary messages | The business | Only when those features are switched on; this policy will be updated first |
| Audit records: who did what, when | Created by Aleph | Security and accountability |
| Support signals, survey answers, a health score for the account | The business, and Aleph | Helping the business, and improving Aleph |
| Owner assistant chat history | The owner | Not live. Kept 90 days if it is ever switched on. |
Optional research (off). A business can choose to share, in three separate scopes: its sourcing needs (category, region and locality, catalogue categories, buying and selling interests); counts and summaries such as demand, stockouts, orders, bookings, cancellations, fulfilment timing and repeat activity; and structured transaction outcomes for designing a future trust feature. The purpose is designing future business-to-business sourcing and trust features. Customer conversations and customer identifiers are excluded. Copies are proposed to be kept at most 12 months. A business can withdraw at any time.
We do not hold the business's customer payments. Aleph sends the customer a UPI payment request that points to the business's own UPI details. The money goes to the business. We are not a payment provider and we hold no funds.
6. What we hold about a business's customers
| What | Where it comes from | Why we use it |
|---|---|---|
| WhatsApp phone number. If Meta supplies it, a WhatsApp username or business-scoped ID | You, through WhatsApp and Meta | Receiving your message and replying |
| The text of messages, in both directions. Photos and documents you send, and who sent them | You and the business | Showing the conversation to the business, so it can answer |
| Delivery status of messages | Meta | Showing the business whether a message arrived |
| A raw copy of each WhatsApp event we receive from Meta (includes the number, message text and media IDs) | Meta | Delivery and troubleshooting |
| Your name, if you give it, or if the business records it | You or the business | Orders, invoices, customer record |
| Customer record kept by the business: tags, stage, notes written by staff, marketing consent status, loyalty points | The business | The business's own records |
| Orders, bookings, reminders, invoices (name, phone, GSTIN and address if the business enters them) | You and the business | Fulfilling what you asked for, billing |
| Payment requests and receipts the business records | The business | Tracking whether you paid |
If the optional location feature is ever switched on (it is off), exact customer location would be collected and this policy will say so first.
What we do not do with this data: we do not sell it, use it to advertise to you, or share it with other businesses. One business cannot see another business's customers.
Messages written by hand are sent by a person at the business. Fixed automated messages (section 7) are sent by Aleph on the business's behalf. The messages and files are seen by the business's authorised team, and by our systems that store them.
6A. Information we receive through Meta
WhatsApp messages, phone numbers, delivery status, templates and catalogue items reach Aleph through Meta's WhatsApp Business Platform. We use them only to give a business the Aleph features it has chosen: showing and answering chats, sending the messages it asks us to send, keeping its customer records, catalogue and invoices, keeping the service secure and fixing faults. We do not sell this information, use it for our own or anyone else's advertising, build profiles of people from it, share it between businesses, or pass it to data brokers. No customer message is sent to an AI service today (section 7). We do not use customer messages to train AI models. What Meta holds is governed by Meta's own terms. To have your information deleted from Aleph, use the data deletion page.
7. Automated messages and AI
Aleph can also send fixed, non-AI automated messages for a business, for example a "we are closed" note, a booking reminder, or an order or payment message. These do not use an AI service. Whether any of these is switched on for a business depends on its settings.
AI replies are off. When we checked the hosted test environment on 6 November 2026, no AI provider key was set (OpenAI, OpenRouter or Anthropic), and the setting that blocks AI in code was on. On 17 October 2026 no business had an AI account connected. Nothing in Aleph is sending customer messages to an AI service today.
This is what would happen if a business later turned AI replies on, after we have updated this policy and the business has agreed:
- The AI service would receive the customer's question, the business's name, language and tone, and extracts from the business's approved knowledge and catalogue. It would not be sent the customer's phone number.
- The first automated reply would say it comes from an automated assistant and link to the notice for people who message a business, which we will publish before any real customer messaging.
- A person at the business can take over any chat.
- If there is no approved information to answer from, the assistant hands over to staff instead of guessing.
The AI services the code can call are OpenAI and OpenRouter, which passes requests on to the model makers it routes to. We have accepted a plan to move to other providers. Before any business can turn AI replies on we will confirm the providers and their storage terms and update this policy. For customer replies, the code does not currently ask the provider to skip storing the request.
An owner assistant (for the business owner, answering questions about the business) works from counts and totals, with phone numbers, emails and card-like numbers masked before sending. It is not live.
There is also a website chat on the Aleph site. It is off (the setting was off on 6 November 2026).
8. Who else handles data
We use these providers to run Aleph. Most of these act for us. Meta acts under its own terms with the business that chose to use it.
| Provider | What it does | State | Data it handles |
|---|---|---|---|
| Meta Platforms (WhatsApp Business Platform, Graph API) | Carries WhatsApp messages. Holds the business's WhatsApp account and Meta catalogue. | Running | Customer and business phone numbers, message content and media, templates, delivery status, catalogue items. Meta handles this under its own terms and privacy information. |
| Vercel | Hosts the web dashboard. | Running | Web requests and sign-in cookies. Business, catalogue and WhatsApp message data passes through the dashboard's server code on its way between the browser and the Aleph servers. |
| Railway | Runs the Aleph servers and background jobs, a private job queue, and the backup storage bucket. | Running | All application data in transit. Queued jobs can include message data. Encrypted backups. |
| Supabase | Database and file storage. | Running | The Aleph database (all records above) and uploaded files: registration documents, catalogue images, message media |
| Cloudflare | DNS for the Aleph address (running). Sign-in gate for staff tools: designed in code, not yet exercised. | DNS running | Network addresses; staff sign-in once used |
| Sentry | Error reports. | No key set on 6 November 2026, in the API or the dashboard | Error details, set up to remove personal data and message text. |
| PostHog | Product analytics and optional masked screen replay. | Off unless the business opts in. No key set on 6 November 2026, in the API or the dashboard | Pseudonymous interaction events. 14-day replay, 90-day events, when on. |
| Email sender (Resend) | Sends the sign-up verification email. | Running (set as the email provider on 6 November 2026) | The registrant's email address and the code |
| Expo (mobile push) | Delivers push alerts to the mobile app. | Off in the pilot setup | Device push token; generic alert text, no message content |
| n8n (internal event webhook) | Receives internal operations events. | Off (event dispatch switched off on 6 November 2026) | Business IDs and event summaries; we do not intend to send message text. |
| Amazon Web Services (S3, SES, Secrets Manager, CloudWatch) | Alternative storage, email and diagnostics the code can use. | Not used by the hosted test on 6 November 2026 (storage is Supabase, email is Resend) | Would hold the same data as the provider it replaces |
| OpenAI, OpenRouter | AI replies to customers. | Off | See section 7. Our team's own use of AI tools is in a separate row below. |
| Google Workspace (company email) | Receives and stores emails sent to legal@vandorio.com, including privacy and deletion requests | Running | The sender's email address and anything they write or attach |
| AI tools used by our team (OpenAI and Anthropic) | Help our team build, test and diagnose Aleph. This is operator assistance, not part of how Aleph handles customer messages | Running | Test business and message IDs and redacted evidence. No real customer messages while Aleph is in testing. We will update this policy before real customer messages are used in this way. |
| Google (Calendar, Gmail send, Drive), Zoho | Optional connections a business could add. | Off | Access Google grants us is broader than what we use: the code asks for calendar events, sending Gmail, Drive files we create and read access to Drive. Only used for what the business connects. |
Further points:
- Our own staff. A small number of Vandorio staff can reach the systems that hold data, to run, support and secure Aleph. Cross-business views of conversations are disabled in the pilot setup.
- Our email. Privacy requests that reach legal@vandorio.com are handled on our company email system (Google Workspace). Only the people named in our request procedure can read them.
- Payments. No payment provider handles customer payments through Aleph. Our own billing to businesses is not live; checkout is held.
- Legal requests. We give information to authorities only on a valid written request, limited to the records named. We review each request first.
- We do not sell personal information.
9. Where data is stored
The hosted environment is in Singapore (Railway, Supabase, backup storage; Supabase's region was read as Singapore on 6 November 2026). Vercel runs server code in Singapore. PostHog, if on, is hosted in the United States. Meta processes WhatsApp data under its own arrangements. Resend, Google Workspace and our team's AI tools may also process data outside India, and outside Singapore. Information therefore leaves India. Before any provider is switched on we check where it processes data and how it is protected. We do not promise that all data stays in India.
10. How long we keep it
What happens today. Aleph keeps business and customer records while the business uses it. Records go when the business deletes them, when the business closes its account, or when a verified deletion request is completed (section 11). A few things expire sooner:
| Item | Period |
|---|---|
| Stored copies of customer photos and documents | If media is switched on, the stored file is deleted 30 days after it is saved, unless a legal hold applies. Media is not switched on for the hosted test environment today (checked 6 November 2026). Message text and the raw event copy stay. |
| Sign-in session and one-time-code records | Cleaned up about 7 days after they expire |
| Registration documents (identity, address proof, GST, PAN, licence) | Deleted 30 days after the approval, rejection or withdrawal decision (abandoned applications after 30 days idle plus 30), unless a hold applies (a rule in our code; we have not yet confirmed it runs on the hosted test environment) |
| Raw WhatsApp event copies | Kept while the business account exists. We have not set a shorter period. |
| Data export prepared for the owner | Available 7 days |
| Encrypted backups | Daily. We keep the 7 most recent daily copies. If a daily run fails, older copies stay until a later run succeeds, so a copy can be older than 7 days. We have not yet checked the backup storage's own retention setting. |
| Screen replay (only if the business opts in) | 14 days |
| Product analytics events (only if the business opts in) | 90 days (this rule is not yet in use) |
| Owner assistant chats (not live) | 90 days |
| Research copies (only if the business opts in) | Proposed maximum 12 months |
| Hosting and email provider logs | Vercel about 30 days, Railway about 7 days, Supabase about 1 day, Resend about 30 days. These are the providers' published periods for our plans, read on 17 October 2026, not periods we control |
Rules built but switched off. We have written automatic retention rules and built the tools for them. They are switched off until a lawyer and an accountant have confirmed the periods. When on, the plan is:
- Orders and bookings of a workflow a business switches away from: hidden at once, deleted after one year.
- Invoices and payment records: kept read-only for 8 financial years, because tax and company law can require the business to keep them.
- When a business closes: 30 days to export its data. Sign-up and registration data is then kept restricted for 180 days, then deleted. Other records are deleted after the export window.
- System logs: rolling 180 days. A record that a workflow was switched: 3 years.
- Backups roll off within 30 days at most.
Our process for pausing deletion for a legal hold (for example a dispute or a written order) is not yet operating: the tool that places a hold is blocked today. Existing holds in the system are honoured.
If the law sets a minimum period for keeping some records or logs once it applies to us, we will follow it.
11. Deleting and exporting data
Business account. The owner can ask for an export of the business's data (available for 7 days) or deletion of the business. Today, deletion of a business account that has invoices, payment records or pilot membership cannot complete until the legal retention review is finished (section 10). We will tell you this when you ask. We can still export your data and handle smaller deletion requests by hand. Deletion needs a second step: a Vandorio administrator approves it before it runs. When it can run we switch off access and bots, delete the stored files (registration documents, catalogue images, payment QR images and message media), delete the raw copies of WhatsApp events and any onboarding chat messages, archive the AI project if one existed (the AI provider may keep it under its own terms), and delete the business's records. We keep only a thin record of registration, payment and security events with personal fields removed, and a receipt that holds no content.
Customers. Ask the business first. It controls your records. You can also write to us at legal@vandorio.com and we will work with the business. Today we handle this by hand, on the business's instruction, following a written internal procedure of six steps: we check who is asking, find the records, delete what can be deleted and keep only what the business must keep, deal with backups, record the case, and reply to you. Records the business must keep, such as a tax invoice, stay with only the fields that invoice requires.
Backups. Erased data can sit in a backup until that backup rolls off. It is not served. If we ever restore a backup, our procedure is to re-apply earlier deletions before the service comes back. We have not yet tested this on the hosted system.
Step-by-step instructions are on our data deletion page.
12. Security
What we do:
- Each business's data is separated from every other business's data in the database.
- Sign-in uses one-time codes sent over WhatsApp, passkeys and one-use recovery codes. Codes and session tokens are stored as hashes.
- Connection tokens for optional integrations are stored encrypted.
- Backups are encrypted before they leave our servers.
- Error reports are set up to strip personal data and message text before they leave our servers, when error reporting is switched on.
- Staff tools are designed to sit behind a separate sign-in gate (not yet exercised).
No system is perfectly secure. We have not been certified or audited by any outside body, and we do not claim to meet any standard.
13. Your choices and rights
- Businesses: change or delete records in the dashboard. Opt in or out of product analytics, replay and research in settings. Disconnect your WhatsApp number in Meta. Disconnecting does not erase our copy. Ask for export or deletion.
- Customers: ask the business, or write to us. You can ask what we hold, ask us to correct it, ask for it to be deleted, or complain.
- Anyone: complain to us first at legal@vandorio.com. We aim to acknowledge within 24 hours and resolve grievances within 7 days. We aim to complete a verified deletion within 30 days (business accounts with invoices, payment records or pilot membership: see section 11).
India's Digital Personal Data Protection Act, 2023 is the main law we look to. Its main duties are not yet in force. We have not assessed ourselves as compliant and do not claim to be.
Aleph is built for businesses and is not meant for children.
14. Changes
When what we do with data changes, we change this page and its version. Where the change matters (for example switching on AI replies), we tell businesses in the dashboard first.
15. Contact
VANDORIO GLOBAL TECH PRIVATE LIMITED
legal@vandorio.com
Registered office as in section 2.
Company and privacy contact
VANDORIO GLOBAL TECH PRIVATE LIMITEDCIN: U62010AP2026PTC127544
Registered office: Prime hill crest flat 403, near DGP office, Mangalagiri, Guntur- 522503, Andhra Pradesh
Contact: Darren Joy Vipparty
legal@vandorio.com