This policy explains what personal data Gatiwo collects, why, where it is kept and the choices you have. We have tried to write it in plain English. If anything is unclear, write to us at privacy@gatiwo.com.
The short version
- We collect only what we need to run your account and the features you use.
- The business data you put into Gatiwo belongs to your business. We store and process it for you; we do not use it for our own purposes.
- We never sell personal data and never use it for advertising.
- The app uses one sign in cookie. Our website gatiwo.com also uses Google Analytics to count visits. We use no advertising cookies.
- The business owner can export the business data from Settings at any time. You can delete your own account from My profile.
1. Who we are
Gatiwo (the website at gatiwo.com and the app at app.gatiwo.com) is a product of Artimora Private Limited, a company incorporated in India (CIN: U32909UW2026PTC259103), with its registered office at Office 1604, Tower A, ATS Bouquet, Block B, Sector 132, Noida, Uttar Pradesh 201304. In this policy, “Gatiwo”, “we” and “us” mean Artimora Private Limited.
Gatiwo is a CRM for small businesses. It helps a business keep track of leads, customers, quotes, invoices, payment reminders, jobs and tasks, and it includes an optional WhatsApp assistant.
2. Two kinds of data, two roles
India’s Digital Personal Data Protection Act, 2023 (the “DPDP Act”) uses two key terms: a Data Principal is the person the data is about, and a Data Fiduciary is whoever decides why and how that data is used. Gatiwo handles two kinds of personal data, and our role is different for each.
Your account data
Your name, email address, phone number, sign in details and settings. For this data, you are the Data Principal and Artimora Private Limited is the Data Fiduciary. This policy describes how we handle it.
Your business’s customer data
The details your business enters about its own customers and contacts: names, phone numbers, addresses, quotes, invoices, notes, job records and uploaded photos. For this data, the business using Gatiwo is the Data Fiduciary, and we act as its processor (a “Data Processor” under the DPDP Act). We process it only to provide Gatiwo to that business and on its instructions. See section 10.
3. What we collect
| Account details | Your name, email address, phone number (if you add one), profile picture (if you sign in with Google), the business you create or join and your role in it. |
|---|---|
| Sign in details | If you use email and password, we store only a one way scrypt hash of your password, never the password itself. If you use a phone login code (available for older accounts), we store your phone number and a short lived code. If you use Google, see section 4. |
| Business data | Everything you and your team enter: leads, customers and their contact details, quotes, invoices, payments and reminders, jobs, tasks, notes and uploaded photos. |
| WhatsApp data | Only if you connect WhatsApp: your WhatsApp number and the messages sent to and from it through Gatiwo. See section 6. |
| Technical data | Basic information our servers need to work and stay secure, such as IP address, browser type, the time of a request and error logs. |
| Messages to us | What you send when you write to support or give feedback. |
We do not collect payment card details, and we do not ask for sensitive data such as health or financial account details. Please do not store such data in Gatiwo unless your business genuinely needs it and has a lawful basis for it.
4. Sign in with Google
If you choose “Sign in with Google”, we ask Google only for the basic openid, email and profile scopes. From Google we receive:
- your name,
- your email address,
- the web address (URL) of your Google profile picture, and
- your Google account ID, so we can recognise you the next time you sign in.
We do not get your Google password, and we do not get access to your Gmail, Contacts, Drive, Calendar or any other Google data.
How we use it. We use this Google user data only to sign you in to Gatiwo and to show your name (and picture) inside the app, for example in your profile and next to the work you do. We do not use it for anything else.
- We never sell Google user data.
- We never use it for advertising, including targeted or personalised ads.
- We do not transfer it to anyone, except as needed to run Gatiwo (our hosting and database providers), to comply with the law, or as part of a merger or sale of the business with the same protections in place.
- We do not use it to train artificial intelligence or machine learning models.
- People at Gatiwo do not read it, except with your permission, to investigate security issues or abuse, or where the law requires.
Google API Services User Data Policy. Gatiwo’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
You can remove Gatiwo’s access at any time from the security settings of your Google Account, where Google lists the apps connected to it. Deleting your Gatiwo account also deletes the Google details we hold (see section 9).
5. How we use data
- To create your account, sign you in and keep you signed in.
- To provide Gatiwo’s features to your business: storing records, making quotes and invoices, sending the reminders and messages you ask it to send, and letting your team work together according to their roles.
- To keep Gatiwo secure, prevent fraud and abuse, and fix problems.
- To send you service messages, such as sign in codes, security notices and important changes to Gatiwo or these policies.
- To answer you when you contact us.
- To meet our legal obligations.
We process your account data on the basis of your consent, which you give when you create an account, and for the legitimate uses the DPDP Act allows, such as complying with the law. You can withdraw consent by deleting your account; this does not affect processing that already happened.
6. WhatsApp
The WhatsApp assistant is optional. If you connect a WhatsApp number to Gatiwo, messages are sent and received through Meta’s WhatsApp Business Platform. That means Meta also processes those messages, under its own terms and privacy policy. We store the messages that pass through Gatiwo so the assistant can do its job (for example, creating a task you asked for or answering a question about money due) and so you can see the history.
If your business uses Gatiwo to message its customers on WhatsApp, the business is responsible for having their permission to do so and for following WhatsApp’s rules.
7. Who we share data with
We do not sell personal data. We share it only in these cases:
- Service providers who run Gatiwo for us, under contracts that require them to protect the data and use it only for us:
- Vercel, which hosts the website and app;
- Neon, which hosts our Postgres database in the USA;
- Google, if you choose to sign in with Google;
- Meta, if you connect WhatsApp;
- Google Analytics, which counts visits to our website gatiwo.com.
- Inside your business. Other members of a business you belong to can see the business data and your name, according to their role.
- When the law requires it, for example a valid order from a court or government authority, or to protect the rights, safety or property of our users, the public or Artimora Private Limited.
- If our business changes hands, for example in a merger or acquisition, in which case the new owner must keep honouring this policy.
8. Where your data is stored
Your data is stored in a Postgres database run by Neon in the United States (US East region), and the app runs on Vercel’s servers. This means your data is transferred outside India. The DPDP Act allows this except to countries the Government of India restricts; we will review this if those rules change. Wherever your data is, we protect it as this policy describes.
9. How long we keep data, and deleting your account
We keep your account data for as long as your account is open. Business data is kept for as long as the business is active in Gatiwo.
The business owner can export the business data from Settings. You can delete your account yourself from My profile in the app. When you delete your account:
- Your name, email address and phone number are wiped from your account.
- If you belong to a business that still has other members, the business records stay with that business (they belong to it), and your past work shows as “Deleted account”.
- If you ran a business on your own, that business is closed.
Copies may remain in our providers’ backups for a short time until they are overwritten. We may also keep limited records where the law requires it, for example for tax or to deal with a legal claim.
10. Data about your customers
When your business stores its customers’ details in Gatiwo, your business is the Data Fiduciary for that data. That means your business decides what to collect and why, and is responsible for:
- having a lawful reason, such as the customer’s consent, to collect their data and to contact them (including on WhatsApp);
- telling customers how their data is used;
- answering their requests to see, correct or delete their data.
As your processor, we store and process that data only to provide Gatiwo to you, keep it secure, and help you respond to such requests. If one of your customers contacts us directly, we will pass the request to you.
11. Your rights
Under the DPDP Act, as a Data Principal you have the right to:
- get a summary of the personal data we hold about you and how we use it;
- correct, complete or update it;
- have it erased;
- withdraw your consent;
- nominate someone to exercise these rights for you if you die or become unable to; and
- have your grievances addressed.
You can do most of this yourself in the app. Edit your profile or delete your account from My profile. The business owner can export the business data from Settings. For anything else, email privacy@gatiwo.com. We may need to confirm your identity first. We will respond within the time the law requires. If you are not satisfied with our response, you can complain to the Data Protection Board of India.
12. Cookies
We use a single essential cookie to keep you signed in to the app. It is httpOnly (scripts on the page cannot read it) and it lasts 90 days, or until you log out. Gatiwo does not use advertising cookies.
Our website gatiwo.com (not the app) uses Google Analytics to understand how many people visit, which pages they read and how they found us. It sets cookies such as _ga that last up to 2 years and sends Google your browser details and an approximate location. Google Analytics does not store full IP addresses. We do not use it for advertising and we do not combine it with your account data. You can block it with your browser settings or with Google's opt out add on. Read how Google uses this data in Google's explanation.
13. How we protect data
- All traffic to Gatiwo is encrypted with HTTPS.
- Passwords are stored only as scrypt hashes.
- Each business can see only its own data, and team members see what their role allows.
- Access to production systems is limited to the people who need it to run Gatiwo.
No system is perfectly secure. If a data breach affects your personal data, we will tell you and the authorities as the law requires.
14. Children
Gatiwo is a tool for businesses and is not meant for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has created an account, contact us and we will delete it.
15. Changes to this policy
Gatiwo is in early access and will grow, including to Japan, where Japan’s privacy law will also apply to users there. When we change this policy we will update the date at the top, and if a change is significant we will tell you by email or in the app before it takes effect.
16. Contact us
For privacy questions, requests or complaints (our grievance contact under the DPDP Act):
- Email: privacy@gatiwo.com
- General support: support@gatiwo.com
- Phone: +91 81303 50860
- Post: Artimora Private Limited, Office 1604, Tower A, ATS Bouquet, Block B, Sector 132, Noida, Uttar Pradesh 201304