Privacy Policy

BizOS is used by businesses in India (“Business Clients”) to run their day-to-day operations — customer follow-ups, leads, quotations, jobs, invoices, payment reminders and just-enough inventory — and to communicate with their own customers, including over WhatsApp. This policy applies to personal data we handle as part of providing the Service.

If you interact with a business that uses BizOS (for example, you receive a quotation, invoice or WhatsApp message from that business), that business — not Three Roses Innovations — decides why and how your data is used. Please also review that business’s own privacy notice, and contact them directly with requests about their records.

We handle personal data in two distinct capacities, and your rights differ accordingly:

• As a processor / data fiduciary’s processor. When a Business Client uses BizOSto store their customer records and to send messages (including WhatsApp messages) to their customers, the Business Client is the controller (data fiduciary) of that customer data. We process it on the Business Client’s behalf and under their instructions, solely to provide the Service.
• As a controller. For the account and billing data of the Business Client and its users (for example the owner’s name, email, phone number, login credentials, subscription and usage information), and for operating and securing our own Service, we act as the controller.

Depending on how the Service is used, we collect:

• Account & profile data: business name, owner and staff names, email addresses, mobile numbers (stored in +91 format), roles and passwords (hashed).
• Business-operations data entered by Business Clients: customer and lead contact details, quotations, jobs/work orders, invoices, payments, cash records and inventory items.
• Messaging data: the content and metadata of messages sent or received through the Service, including WhatsApp messages, template messages, delivery and read status, and opt-in/opt-out records.
• Payment-facilitation data: UPI IDs, payment-link references and transaction status. We do not store full card numbers; card and UPI collection is handled by our payment partners.
• Technical & usage data: device and browser information, IP address, log data, and actions taken within the Service, used for security, troubleshooting and improving the product.

We do not intentionally collect special-category or sensitive personal data and ask that Business Clients not store it in free-text fields.

We use personal data to:

• provide, maintain and secure the Service and its features;
• send operational communications on behalf of Business Clients — quotations, invoices, job updates, payment reminders and follow-ups — including via WhatsApp, SMS and email;
• run the workflow-automation and reminder engine that Business Clients configure;
• authenticate users, prevent fraud and abuse, and enforce our Terms of Service;
• provide customer support and respond to requests;
• process subscription billing; and
• comply with legal obligations and produce aggregated, de-identified analytics to improve the Service.

We rely on the lawful bases of contract performance, our and our Business Clients’ legitimate interests, consent (where required, such as for WhatsApp opt-ins and marketing), and compliance with law.

BizOS is a Meta Tech Provider. We use the WhatsApp Business Platform (Cloud API) to let Business Clients message their customers. Our use of the WhatsApp Business Platform is governed by, and we comply with, the WhatsApp Business Platform Cloud API Terms, the WhatsApp Business Messaging Policy and the Meta Platform Terms. You are responsible for complying with these policies when you use WhatsApp features.

In connection with WhatsApp messaging:

• Data shared with Meta. To deliver messages, the recipient’s phone number, message content and template information are transmitted to and processed by Meta through the WhatsApp Business Platform. Meta processes this data under its own terms and privacy policy, and may share data with us (such as delivery metrics, quality ratings and billing information) related to use of the Platform.
• Opt-in required. Business Clients must obtain a valid opt-in from each recipient before sending WhatsApp messages, and must honor opt-out (“STOP”) requests. BizOS records opt-in and opt-out status to support this.
• Purpose limitation. Data obtained through the WhatsApp Business Platform is used only to provide the Service and to send the messages the Business Client has configured. We do not sell WhatsApp or other user data, and we do not use it for advertising or for any purpose inconsistent with Meta’s policies.
• On behalf of Business Clients. Where BizOS manages a WhatsApp Business Account or sender on behalf of a Business Client, that Business Client remains the controller of the resulting message data, and we act as their processor.

We share personal data only as needed to run the Service:

• Meta / WhatsApp — to send and receive WhatsApp messages, as described above.
• Service providers (sub-processors) — cloud hosting, database, messaging (SMS/email), payment gateways and UPI providers, and analytics/error-monitoring vendors, each under contractual confidentiality and data-protection obligations, acting only on our instructions.
• Business Clients — customer data is made available to the Business Client that owns it.
• Legal & safety — where required by law, court order or to protect rights, safety and the integrity of the Service.
• Business transfers — in connection with a merger, acquisition or sale of assets, subject to this policy.

We do not sell personal data, and we do not share it for cross-context behavioral advertising.

We retain personal data for as long as a Business Client’s account is active and as needed to provide the Service, then delete or de-identify it within a reasonable period unless a longer retention is required by law (for example, tax and invoicing records). Message identifiers and content processed through the WhatsApp Business Platform are retained only as long as needed to deliver messages and report status; Meta separately deletes message content it hosts on the Cloud API within its own retention windows (generally up to 90 days after your use ends, with message identifiers removed within 30 days of the final delivery status). On account closure, Business-Client data is deleted or returned within 90 days of the request, subject to legal retention obligations.

We maintain organizational, technical and physical safeguards designed to protect personal data, including encryption in transit, access controls, tenant isolation (every record is scoped to a single business), hashed credentials and audit logging. No method of transmission or storage is completely secure, but we work to protect data and to notify affected parties and regulators of incidents as required by law.

Subject to applicable law, you may have the right to:

• access the personal data we hold about you and request a copy;
• correct inaccurate or incomplete data;
• request deletion of your data;
• withdraw consent (including opting out of WhatsApp or marketing messages) at any time;
• object to or restrict certain processing; and
• lodge a complaint with a data-protection authority.

If your data is held by Three Roses Innovations as a Business Client’s customer, we will refer your request to that Business Client (the controller) and assist them in responding. To exercise rights over data for which we are the controller, contact us using the details below.

You can request deletion of your personal data at any time by emailing support@3roses.tech with the subject line “Data Deletion Request.” We will verify your request, action it within the timelines required by applicable law, and confirm once complete, except where we are legally required to retain certain records. Where the data is controlled by a Business Client, we will forward your request to them and support its fulfilment.

We process personal data in accordance with India’s Digital Personal Data Protection Act, 2023 and applicable rules under the Information Technology Act, 2000. As a Data Fiduciary for account data (and as a Data Processor for Business-Client customer data), we honour the rights of Data Principals, including access, correction, erasure and grievance redressal.

Grievance Officer. If you have a concern about how your data is handled, contact our Grievance Officer at support@3roses.tech. We aim to acknowledge grievances promptly and resolve them within the timelines prescribed by law.

The Service is intended for businesses and is not directed to children. We do not knowingly collect personal data from anyone under the age of 18. If you believe a child has provided us data, contact us and we will delete it.

We are based in India and primarily process data there. Some sub-processors (including Meta) may process data outside India. Where data is transferred across borders, we take steps required by applicable law to protect it.

We use essential cookies and similar technologies to keep you signed in, remember preferences and secure the Service, and limited analytics to understand usage. You can control cookies through your browser settings; disabling essential cookies may affect how the Service works.

We may update this policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify you through the Service. Continued use of the Service after an update constitutes acceptance of the revised policy.

Three Roses Innovations — BizOS
Email: support@3roses.tech
Web: www.3roses.tech
Governing law: laws of India.