1. Who we are
Glifz (“Glifz”, “we”, “us”) provides a WhatsApp agentic commerce platform: an AI assistant that helps a brand’s customers discover products, buy, and get support on WhatsApp, together with a workspace for the brand’s team.
This policy explains what personal data we handle, why, and the choices you have. It applies to:
- Visitors to our website and people who contact us or request a demo;
- Merchants — the businesses that use Glifz — and their team members;
- End customers who message a merchant on WhatsApp through Glifz.
2. Our role: controller and processor
For website visitors, demo requests and merchant account data, Glifz is the data controller (a “data fiduciary” under India’s Digital Personal Data Protection Act, 2023).
For conversations and commerce data about a merchant’s end customers, the merchant is the controller and Glifz acts as a processor, handling that data only on the merchant’s documented instructions. If you are an end customer, please contact the brand you were messaging about your data; we will support them in responding.
3. Information we collect
Information you give us
- Demo and contact forms: name, work email, WhatsApp number, company, order volume, interests and any message you write.
- Newsletter: your email address.
- Merchant accounts: team member names, emails, roles and settings.
Information processed on behalf of merchants
- WhatsApp profile name and phone number, and the content of messages exchanged with the merchant.
- Commerce data from the merchant’s store: catalog, carts, orders, delivery status.
- CRM data: tags, segments, consent and opt-in/opt-out status, notes from the merchant’s team.
Information collected automatically
- Basic technical data such as browser type, device, pages visited and approximate location derived from IP address.
4. How we use information
- To respond to demo and contact requests and arrange walkthroughs.
- To provide, secure and improve the Glifz platform for merchants.
- To run the AI assistant, inbox, automations and campaigns as configured by each merchant.
- To send product updates you have subscribed to (you can unsubscribe at any time).
- To meet legal obligations, prevent abuse and enforce our terms.
5. Legal bases
Where the GDPR or similar laws apply, we rely on:
- Contract — to provide the service to merchants;
- Legitimate interests — to answer enquiries, secure and improve the platform;
- Consent — for newsletters and, where required, marketing messages;
- Legal obligation — where the law requires us to keep or disclose information.
Under India’s DPDP Act, we process personal data for lawful purposes with consent or for legitimate uses permitted by the Act.
6. WhatsApp and Meta
Glifz uses the WhatsApp Business Platform provided by Meta. Messages are transmitted through Meta’s infrastructure and are also subject to WhatsApp’s Business and Commerce Policies and Meta’s own privacy terms.
Merchants are responsible for obtaining the opt-in required to message customers. Glifz enforces opt-out suppression, approved templates and sending limits for campaigns.
7. AI processing
The AI assistant generates replies from the merchant’s approved catalog, policies and conversation context. We do not sell personal data, and we do not use a merchant’s customer conversations to train models for other customers. Conversations can be escalated to and reviewed by the merchant’s human team.
8. Sharing and service providers
We share personal data only with service providers that help us run Glifz, under contracts that protect it, including:
- Meta (WhatsApp Business Platform) for message delivery;
- cloud hosting, database and email providers;
- AI model providers used to generate assistant replies;
- form-delivery services used for website enquiries.
We may also disclose information where required by law or to protect rights and safety. We never sell personal data.
9. Retention
We keep enquiry data for as long as needed to respond and follow up, and merchant data for the life of the account plus any period required by law. Merchants control how long their customer conversations are kept and can request deletion at any time.
10. Security
We use encryption in transit, access controls, role-based permissions and audit logs to protect data. No system is perfectly secure, but we work to protect information and will notify affected parties of a breach as required by law.
11. International transfers
Our service providers may process data outside your country. Where required, we use appropriate safeguards such as standard contractual clauses and only transfer data to countries permitted under applicable law.
12. Your rights
Depending on where you live, you may have the right to:
- access, correct or update your personal data;
- request erasure or restriction of processing;
- withdraw consent at any time;
- object to processing or request portability;
- nominate another person to exercise your rights (DPDP Act);
- complain to a data protection authority, including the Data Protection Board of India.
To exercise these rights, email hello@glifz.com. End customers of a merchant should contact that merchant first.
13. Children
Glifz is a business service and is not directed at children. We do not knowingly collect personal data from children.
14. Changes to this policy
We may update this policy from time to time. We will post the new version here with a new “last updated” date and, for material changes, notify merchants.
15. Contact us
Questions about privacy or this policy? Email hello@glifz.com and we’ll respond as soon as we can.