Privacy Policy

Ondravan Private Limited (CIN U62011TN2026PTC195416) is a company registered in India, at 19/35 Mount Road, Little Mount, Saidapet, Chennai 600015, Tamil Nadu.

We are the data controller for the personal data described here, except where we process data on behalf of a business customer — for example the documents in their workspace or the conversations their customers have with them. In those cases the customer is the controller and we act as their processor.

For any privacy question or request, write to admin@ondravan.com.

• ondravan.com — this website.
• Ondravan Suite — the multi-tenant workspace platform and its single sign-on, together with Ondravan Plans (projects and tasks), Ondravan PDF (documents and e-signature) and Ondravan Meetify (meetings and room booking).
• Ondravan AI — the assistant layer behind the suite.
• Slot Reply — our WhatsApp assistant for small businesses.
• Fondays — our consumer app.

Where a product handles data differently, that is set out in By product below.

Across our products we may collect:

• Account data — name, email address, phone number, workspace or business name, role, and the plan you are subscribed to.
• Authentication data — password hashes, session and device records, multi-factor settings, and an audit log of sign-ins and permission changes.
• Content you create or upload — projects, tasks, whiteboards, documents, meeting details and messages, depending on the product.
• Payment records — order identifiers, amount and payment status. We never receive or store your card details.
• Technical logs — IP address, device and browser information, timestamps and error diagnostics, retained for security and debugging.

Ondravan Plans stores the projects, tasks, comments, whiteboards and team memberships you create in a workspace, and sends notifications about them.

Ondravan PDFstores the documents you upload and their contents. Where a document is signed electronically we also record an audit trail for that signature — the signer’s name and email address, the time of signing and the IP address used — because that trail is what makes the signature evidentially useful. Signed documents and their audit trails are retained for as long as the workspace exists, since deleting them would undermine the record.

Ondravan Meetify stores meeting titles, times, attendees and room bookings. Where you enable recaps, it also processes the meeting transcript to produce a summary and suggested tasks.

Slot Replyconnects a business’s WhatsApp Business Account so an assistant can answer messages sent to it. We receive messages that customers send to that business, the customer’s WhatsApp phone number and profile name, and delivery receipts; we store them so the business can read and reply in its dashboard; and we send replies from the business’s own number using the access token it authorised. We also receive account-level notifications from Meta about the health of the connected number. For these conversations the business is the controller and Ondravan is its processor. Businesses using Slot Reply are responsible for obtaining any consent required to message their customers and for complying with the WhatsApp Business Messaging Policy. If you are a customer messaging such a business and want your data removed, contact that business, or write to us and we will route the request to them.

Fondays collects the account details and content needed to run the app. Where it is distributed through an app store, that store also processes your purchase and device data under its own policy.

Several features generate text using large language models — drafting a WhatsApp reply, summarising a meeting, or flagging risks in a contract. To do that we send the relevant content, and the configuration you supplied, to our model providers.

We do not use your content to train our own models, and our providers are engaged on terms that prevent them retaining it to train theirs. Model output can be wrong; it is a draft for you to check, not advice.

• To provide the product — storing your content, running your workspace, and delivering messages.
• To generate assistant output where you use an AI feature.
• To authenticate you and keep an audit record of access.
• To take payment and issue receipts.
• To secure the service — detecting abuse, debugging faults and investigating incidents.
• To contact you about your account, billing or a service incident.

We do not sell personal data, and we do not use your content for advertising.

We share data only with the processors needed to run the service:

• Meta Platforms — the WhatsApp Business Platform, which carries messages to and from Slot Reply customers.
• Language model providers — third-party AI providers that receive content in order to generate assistant output, engaged under terms that prevent them retaining it to train their own models. We may change providers as the technology develops; a current list is available on request from admin@ondravan.com.
• Razorpay — our payment processor, which handles card details directly so that we never see them.
• Hosting, storage and email providers that run our servers, databases and transactional mail.

We may also disclose data where the law requires it, or to establish or defend a legal claim. If we are ever party to a merger or acquisition, we will tell you before your data becomes subject to a different policy.

• Separate database per tenant.Each workspace or account is provisioned its own database rather than sharing rows behind a tenant column, so one customer’s data cannot be read from another’s connection.
• One identity, auditable. Sign-in runs through our own OAuth2 / OIDC server with multi-factor authentication, session management and an audit log of every grant, revoke and elevation.
• Encrypted credentials. Third-party access tokens, including WhatsApp access tokens, are encrypted at rest with AES-256-GCM. They are never exposed to the browser and never returned by our API.
• Authenticated transport.All traffic runs over HTTPS, and inbound webhooks are verified against the sender’s request signature before being processed.
• Least access. Access to production data is restricted to staff who need it, and is logged.

We keep your account and content for as long as your account is active. If you close it, we delete your data within 30 days, except where we must keep records longer — payment records for Indian tax and accounting obligations, and signed documents together with their signature audit trails, which we retain for as long as the workspace exists. Technical logs are kept for up to 90 days.

Disconnecting a WhatsApp number deletes the stored access token immediately.

You may ask us to give you a copy of your personal data, correct it, delete it, or restrict how we use it. You may also withdraw consent or object to processing where that applies. Write to admin@ondravan.com and we will respond within 30 days.

If your data sits in a workspace controlled by an employer or a business you messaged, we will pass your request to them, since it is their record rather than ours.

To have your data deleted, email admin@ondravan.com from the address on your account with the subject line “Delete my data”, or delete your account from Settings in the product you use.

We will confirm your identity, delete your account, content and any connected third-party credentials within 30 days, and confirm in writing when it is done. Removing an Ondravan integration from your Meta Business settings also revokes our access to your WhatsApp account immediately.

We are based in India, and some of our processors operate outside India. Where personal data is transferred abroad, we rely on the processor’s contractual commitments to protect it to a standard comparable to this policy.

Our business products are for organisations and are not directed at children. We do not knowingly collect data from anyone under 18. If you believe a child has given us personal data, write to us and we will delete it.

If we change this policy we will update the date above, and for material changes we will tell you by email or in the product before the change takes effect.