Legal

Privacy Policy

Last updated: 9 October 2026

1. Introduction & scope

This Privacy Policy explains how BNM for Business ("BNM", "we", "us", or "our") collects, uses, shares, retains, and protects personal data in connection with our services. It applies to our web application available at in.studio.bnmapp.com, our companion "BNM Admin" desktop and mobile applications, and any related websites, APIs, and features (together, the "Service").

BNM for Business is a multi-tenant software-as-a-service (SaaS) platform that enables businesses to run their operations over WhatsApp and Telegram. The Service includes a no-code automation and workflow builder, a shared messaging inbox, e-commerce and order management, appointments, clinical and healthcare records (for clinic businesses), delivery dispatch, subscriptions, a wallet and payments, company back-office tools, and an AI assistant.

This policy is governed by, and should be read together with, our Terms of Service and, where applicable, the data processing agreement that governs our handling of end-customer data on behalf of business customers. Please read it carefully so that you understand our practices regarding your personal data and how we treat it.

Who this policy is for

This policy addresses two distinct categories of people whose data we handle:

Account holders (our business customers) — the businesses that sign up for and use the Service, together with the individuals who administer those accounts.
End-customers — the individual customers of our business customers, whose personal data is processed through the Service by, and on behalf of, those businesses.

The distinction matters because it determines our legal role and responsibilities, which we explain in Section 2. Under India's Digital Personal Data Protection Act, 2023 (the "DPDP Act"), an identifiable individual is a "Data Principal"; under the EU/UK GDPR, a "data subject". We use the plain term "you" for both throughout this policy.

2. Who we are and our role (controller vs processor)

The entity responsible for the Service is:

Vayuras Systems (OPC) Private Limited, registered office: Flydesk, Suit No. 1, 6th Floor, Desk No. 74B, Kasi Arcade, 116, Sir Theagaraya Road, T Nagar, Chennai, Tamil Nadu 600017

Our role under data protection law depends on whose data is being processed and why. The same data protection laws can apply to us in two different capacities, so we set out both clearly below. The terms "controller" and "processor" are used as defined under the GDPR; under the DPDP Act, the equivalent roles are "Data Fiduciary" and "Data Processor" respectively.

2.1 Where we act as a data controller (Data Fiduciary)

For personal data relating to our account holders — for example, the business's account and contact details, the identifiers used by administrators to sign in, billing and transaction metadata, and the device, log, and usage data generated when a business administrator uses the Service — BNM is the data controller (Data Fiduciary). This means we determine the purposes and means of processing that data, and we are directly responsible to those individuals for how it is handled.

2.2 Where we act as a data processor

For personal data relating to end-customers — for example, an end-customer's name, phone number, delivery address, shared location, the WhatsApp/Telegram messages and media they exchange with the business, and their order, appointment, or clinical records — BNM acts as a data processor. In this capacity:

The business customer is the data controller (Data Fiduciary). It decides what end-customer data to collect, why, and on what lawful basis.
BNM processes that data only on the documented instructions of the business customer, in order to provide the Service, and does not use it for our own independent purposes.
Our processing of end-customer data is governed by our agreement with the business customer, including a data processing agreement (or equivalent terms) that sets out our respective obligations.

If you are an end-customer and you wish to exercise your rights over your data, or you have questions about how your data is used, you should in the first instance contact the business you interacted with, as it is the controller of that data. We will support that business in responding to your request, and you may also contact us using the details in Section 18.

3. Information we collect

We collect and process the categories of information described below. Not all categories apply to every person or every business; what we hold depends on which features of the Service are used.

3.1 Account information

When a business signs up for and configures the Service, we collect business account and contact details. This typically includes the business name, the names and contact details of the administrators who manage the account, business address and operating details, and configuration and preference settings.

3.2 Authentication identifiers

When administrators sign in, we process authentication identifiers, including identifiers associated with Google sign-in and Apple sign-in. We use these to verify identity, create and secure sessions, and protect accounts. We do not receive or store the passwords held by those identity providers.

3.3 Messaging content

The Service handles WhatsApp and Telegram messages and media that pass through the shared inbox and automations. This can include text, images, documents, audio, and other media exchanged between a business and its end-customers, together with related metadata such as timestamps, sender and recipient identifiers, and delivery status.

3.4 End-customer contact data

We process end-customer contact data on behalf of the business, which may include the end-customer's name, phone number, delivery address, and any location they choose to share. This data is provided by the end-customer to the business through the messaging channels or other features of the Service.

3.5 Commerce, appointment, and clinical data (including sensitive health data)

Depending on the features a business uses, we process records relating to orders and e-commerce transactions, appointments and bookings, deliveries, subscriptions, and the business's back-office operations.

For clinic and healthcare businesses, the Service can store clinical and healthcare records. Such records may include health information about end-customers — for example, symptoms, diagnoses, prescriptions, visit notes, and voice recordings of consultations where the business uses that feature. Health data is treated as sensitive personal data and is given enhanced protection. Where BNM stores or processes such data, it does so as a processor acting on the instructions of the clinic, which remains the controller and is responsible for having a lawful basis to collect and use it, including any consent required by law.

3.6 Payment and transaction metadata

We process payment and transaction metadata to support orders, the wallet, subscriptions, and billing — for example, transaction amounts, status, references, timestamps, and the identifier returned by the payment provider. Full card numbers and other complete card details are handled directly by the payment provider (such as Razorpay or Google Play) and are not stored by BNM. See Section 7 for more on payments.

3.7 Device and usage data

When the Service is used, we automatically collect device, log, and usage data. This can include IP address, browser and device type, operating system, app version, identifiers for diagnostics and push notifications, pages and features accessed, actions taken, error and performance logs, and approximate location inferred from network information. We use this data to operate, secure, and improve the Service.

3.8 Cookies and local storage

We use cookies and similar technologies, including browser local storage, to keep administrators signed in, maintain sessions, remember preferences, and support analytics. See Section 8 for details.

4. How we use information and legal bases

We use personal data for the purposes set out below. Where we act as a controller, we rely on the legal bases indicated. Where we act as a processor for end-customer data, the legal basis for the underlying processing is determined by the business customer (the controller); we process only on its instructions.

4.1 Purposes

Providing and operating the Service — creating and managing accounts, delivering the messaging inbox, automations, e-commerce, appointments, clinical records, dispatch, subscriptions, wallet, back-office, and AI features.
Authentication and account security — verifying identity, managing sessions, preventing fraud and abuse, and protecting accounts.
Communications — sending transactional and service messages, push notifications, and responding to support requests.
Payments and billing — processing transactions, managing the wallet and subscriptions, and maintaining financial records.
Improving and securing the Service — diagnostics, analytics, debugging, monitoring, and developing new features.
Legal and compliance — complying with applicable laws, responding to lawful requests, and enforcing our terms.

4.2 Legal bases

Under the DPDP Act, personal data is generally processed on the basis of consent or for certain legitimate uses permitted by that Act. Under the GDPR, we rely on the following bases:

Consent — where required, including for certain analytics, certain communications, and the processing of sensitive personal data such as health data. Before relying on consent, we (or, for end-customer data, the business customer) provide a clear notice of the personal data to be processed and the purpose. Where consent is the basis, it may be withdrawn at any time, as easily as it was given, without affecting processing already carried out.
Performance of a contract — to provide the Service requested by a business customer and to administer the account.
Legitimate interests / legitimate uses — to secure, maintain, and improve the Service, prevent fraud and abuse, and run our business, provided these interests are not overridden by the individual's rights and freedoms.
Legal obligation — to comply with applicable laws, tax and accounting requirements, and lawful requests from authorities.

We process personal data only for the purposes described in this policy and will seek a fresh basis or consent if we need to use it for a materially different purpose. For end-customer data processed on behalf of a business, the relevant lawful basis (such as consent or contract) must be established and maintained by that business as the controller.

5. WhatsApp, Telegram & Meta

The Service connects businesses to their end-customers through the WhatsApp Business Platform (Cloud API), operated by Meta Platforms, and through Telegram.

5.1 How messages flow

When an end-customer sends a message to a business, or a business sends a message to an end-customer, that message and any media pass through the relevant platform's infrastructure (Meta for WhatsApp, Telegram for Telegram) and are received and stored within the Service so the business can view, reply, automate, and manage the conversation. The content of these messages, and related metadata, is therefore processed by both the platform provider and by BNM as a processor for the business.

5.2 Platform policies apply

Use of WhatsApp and Telegram is also subject to those providers' own terms and privacy policies. Business customers are responsible for using the channels in compliance with:

Meta's WhatsApp Business Messaging Policy and Commerce Policy; and
Telegram's terms of service and related policies.

This includes obtaining any required opt-in or consent from end-customers before messaging them, honouring opt-outs, and using approved message templates and categories where the platform requires them. BNM is not responsible for the data practices of Meta or Telegram, which act under their own terms.

6. AI features & automated processing

The Service includes AI-powered features, such as the AI assistant, the clinical voice-to-record assistant, and automation capabilities. To provide these features, relevant content — which may include messages, records, and other inputs you submit — may be sent to and processed by third-party AI model providers, namely Anthropic (Claude), OpenAI, and Google (Gemini), in order to generate responses, suggestions, extractions, or automations.

We process this content only to power the features you use. We do not permit your content to be used to train third-party publicly available AI models without consent. Our use of AI providers is governed by our agreements with them, which restrict the use of submitted content to providing the service to us.

Automated processing. Some AI features process inputs automatically to draft replies, suggest prescriptions, extract information, or route workflows. These features are assistive only: they support, but do not replace, human decision-making. We do not use them to make decisions producing legal or similarly significant effects about you without human involvement. AI-generated output may be inaccurate or incomplete and should not be relied upon as a substitute for professional judgement, including in clinical or healthcare contexts. Businesses remain responsible for reviewing AI output before acting on it.

7. Payments

Online payments that the Service takes through a payment gateway — such as order payments, booking prepayments, and payment links — are processed by the third-party payment gateway Razorpay. They are made either to the business's own Razorpay account or to BNM's Razorpay account, which is held by Vayuras Systems (OPC) Private Limited. When you make such a payment, your card or payment details are collected and processed directly by Razorpay under its own privacy policy and security standards.

Payments that a business collects directly — for example in cash, on its own card machine, or to its own UPI ID or QR code — are made to the business and do not go through the payment gateway described above. The business may record them in the Service. Where a business connects or forwards the payment-received emails from its own Paytm account, the Service reads those emails, which include the amount, the time, and the payer's masked UPI ID, to match each payment to a bill and record it automatically. Wallet top-ups are usually paid to the business in one of these ways and then recorded by the business as a wallet credit, rather than paid through a payment gateway.

If you buy a BNM plan or extra users through Google Play in the BNM Business app (formerly BNM Admin) on Android, the payment is handled by Google Play under Google's own terms and privacy policy. We receive information about the purchase from Google Play — such as its status, the items bought, renewal dates, and order identifiers — but not your payment details.

BNM does not collect or store full card numbers or other complete card details. We retain only payment and transaction metadata — such as transaction amount, status, reference, timestamp, and the identifier returned by the payment provider — which we use to reconcile orders, manage the wallet and subscriptions, support refunds, and maintain financial records.

8. Cookies & similar technologies

We use cookies and similar technologies, including browser local storage, on our web application. These fall into the following broad categories:

Strictly necessary — required to sign in, maintain sessions, and operate core features securely. These cannot be switched off through the Service.
Preferences — remember settings and choices to improve your experience.
Analytics — help us understand how the Service is used so we can maintain and improve it.

You can control cookies through your browser settings, including by blocking or deleting them. Disabling certain cookies may affect the functionality of the Service. Where required by law, we obtain consent before setting non-essential cookies.

10. Data retention

We retain personal data for as long as it is needed for the purposes set out in this policy, and thereafter only where required to meet legal, accounting, tax, or regulatory obligations, resolve disputes, or enforce our agreements.

Account data is retained for the duration of the business customer's relationship with us and for a reasonable period afterwards.
End-customer data processed on behalf of a business is retained according to the instructions and configuration of that business, which controls the data. On termination of the business's account, or on its instruction, we delete or return such data, subject to any legal retention requirements.
Messaging content, commerce, appointment, and clinical records are retained for as long as the relevant business maintains them in the Service, subject to applicable law. Clinical voice recordings are subject to additional, shorter retention controls.
Payment and transaction metadata is retained as required for financial and tax record-keeping.
Device, log, and usage data is retained for security, diagnostics, and analytics for a limited period.

When personal data is no longer required, we delete it or anonymise it so that it can no longer be associated with an individual.

11. Information security & breach notification

We implement technical and organisational measures designed to protect personal data against unauthorised access, disclosure, alteration, and loss. These measures include encryption in transit, access controls and authentication, tenant isolation in our multi-tenant architecture, least-privilege access to data, private storage for sensitive content such as clinical recordings, logging and monitoring, and restricting access to personal data to personnel and sub-processors who need it to provide the Service.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Business customers are responsible for maintaining the security of their own credentials and for configuring access within their accounts appropriately.

Breach notification. If a personal data breach occurs, we will act promptly to investigate and contain it. Where we act as a controller, we will notify the affected individuals and the relevant authorities — including the Data Protection Board of India under the DPDP Act, and supervisory authorities under the GDPR — within the timeframes and in the manner required by applicable law. Where we act as a processor, we will notify the relevant business customer without undue delay so that it can meet its own notification obligations.

12. International data transfers

We are based in India, and the Service is operated with an India-focused infrastructure. However, some of our sub-processors operate or store data outside India, including in other jurisdictions. As a result, personal data may be transferred to, stored in, or accessed from countries other than the one in which it was collected.

Where personal data is transferred internationally, we take steps to ensure that an appropriate level of protection applies, consistent with applicable law. For transfers subject to the EU/UK GDPR, we rely on lawful transfer mechanisms such as standard contractual clauses or transfers to jurisdictions recognised as providing adequate protection. For transfers from India, we transfer personal data only in a manner permitted under the DPDP Act and any restrictions issued by the Central Government under it.

13. Your rights

Depending on your location and the applicable law, you have rights over your personal data. We honour the rights granted under India's Digital Personal Data Protection Act, 2023 (DPDP Act) and, where it applies to individuals in those regions, the EU/UK GDPR.

13.1 Rights available to you

Access — to obtain confirmation of, and access to, the personal data we hold about you, and a summary of how it is processed.
Correction and updating — to have inaccurate, misleading, or incomplete data corrected, completed, or updated.
Erasure — to request deletion of your data in certain circumstances.
Portability — to receive certain data in a structured, commonly used, machine-readable format, where applicable.
Withdraw consent — where we rely on consent, to withdraw it at any time, as easily as it was given, without affecting processing already carried out.
Object and restrict — under the GDPR, to object to certain processing and to request its restriction.
Nominate — under the DPDP Act, to nominate another person to exercise your rights in the event of your death or incapacity.
Grievance redressal — to have a readily available means of raising a grievance with us about how your data is processed, and to escalate to a regulator.

13.2 How to exercise your rights

If we are the controller of your data, you can exercise your rights by contacting us using the details in Section 18. If your data is processed by us as a processor on behalf of a business (for example, you are an end-customer of a business), please contact that business as the controller; we will assist the business in responding to your request. We may need to verify your identity before acting on a request, and some rights are subject to legal conditions and exceptions. We will respond within the timeframes required by applicable law and, ordinarily, without undue delay.

13.3 Complaints to a regulator

If you are in India, you have the right to lodge a complaint with the Data Protection Board of India after first raising your grievance with us (or with the relevant business, where it is the controller). If you are in the EU/UK, you have the right to lodge a complaint with your local data protection supervisory authority. We encourage you to contact us first so we can try to resolve your concern.

14. Children's data

The Service is intended for use by businesses and is not directed at children. We do not knowingly offer the Service to, or knowingly collect personal data directly from, individuals under the age of 18 as account holders. If you believe that a child's personal data has been provided to us in a way that requires attention, please contact us so we can take appropriate action. Where a business processes data relating to children through the Service, that business is responsible, as controller, for obtaining any consents required by applicable law — including verifiable consent of a parent or lawful guardian where the DPDP Act requires it — and for not undertaking processing likely to cause a detrimental effect on a child or any tracking, behavioural monitoring, or targeted advertising directed at children.

15. Responsibilities of our business customers

When a business uses the Service to process the personal data of its own end-customers, that business is the data controller (Data Fiduciary) of that data, and BNM acts as its processor. Each business customer is responsible for:

having a valid lawful basis (such as consent or contract) to collect and use end-customer personal data, including any sensitive data such as health information, and giving any consent notice required by the DPDP Act;
providing its own privacy notice to its end-customers and obtaining any required consents, including opt-in for messaging where applicable;
complying with applicable law and with the policies of Meta (WhatsApp Business Messaging Policy and Commerce Policy) and Telegram;
responding to its end-customers' rights requests and grievances, with our reasonable assistance; and
configuring access, retention, and security settings within its account appropriately.

Our processing of end-customer data on behalf of a business is governed by a data processing agreement (or equivalent terms) between us and that business. In the event of any conflict between this policy and that agreement in respect of end-customer data, the data processing agreement governs.

16. Third-party links

The Service may contain links to, or integrate with, third-party websites, applications, and services that are not operated by us, including the providers named in this policy. This Privacy Policy does not apply to those third parties, and we are not responsible for their content or privacy practices. We encourage you to review the privacy policies of any third-party services you use.

17. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or service providers. When we make changes, we will update the "Last updated" date at the top of this policy and, where the changes are material, we will take reasonable steps to notify you, such as through the Service or by email. Your continued use of the Service after an updated policy takes effect constitutes acceptance of the changes, to the extent permitted by law.

18. Contact us & Grievance Officer

If you have any questions, requests, or concerns about this Privacy Policy or our handling of personal data, you can contact us at:

Privacy enquiries: [email protected]
Legal: [email protected]
Support: [email protected]

Our legal entity is Vayuras Systems (OPC) Private Limited, registered office: Flydesk, Suit No. 1, 6th Floor, Desk No. 74B, Kasi Arcade, 116, Sir Theagaraya Road, T Nagar, Chennai, Tamil Nadu 600017

Grievance Officer / Data Protection contact (India DPDP Act, 2023)

In accordance with the DPDP Act, you may contact our Grievance Officer / Data Protection contact to raise any grievance regarding the processing of your personal data:

Grievance Officer / Data Protection contact
Email: [email protected]
Address: Vayuras Systems (OPC) Private Limited, Flydesk, Suit No. 1, 6th Floor, Desk No. 74B, Kasi Arcade, 116, Sir Theagaraya Road, T Nagar, Chennai, Tamil Nadu 600017

We will acknowledge and address grievances within the timeframes required by applicable law. If you are not satisfied with our response, you may escalate your complaint to the Data Protection Board of India or, where the GDPR applies, to your local supervisory authority, as described in Section 13.

This Privacy Policy is governed by the laws of India, and the courts of India have jurisdiction over any dispute relating to it, without prejudice to any mandatory rights you may have under the data protection laws of your own jurisdiction.

Last updated: 9 October 2026

Looking for our terms of use? Read the Terms & Conditions. Questions about your data or to exercise your rights, email [email protected].