SocioBurp1. Introduction and Data Fiduciary identification
This Privacy Policy is issued in accordance with, and is intended to comply with, India's Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 ("DPDP Act"), as well as applicable requirements of Meta Platforms, Inc. relating to Platform Data.
For the purposes of the DPDP Act, the Data Fiduciary responsible for determining the purpose and means of processing your personal data is:
SocioBurp
Registered Office: Asset-5A, Aerocity, Pride Plaza Hotels, near IGI Airport, New Delhi – 110037
Contact: Ajinu.A@socioburp.co.in | 98715 83289
SocioBurp operates Sakshi, an AI-powered marketing assistant that helps small and medium businesses in India create and manage social media content via WhatsApp. Under the DPDP Act, you (as a business owner using Sakshi, or an individual whose information appears in content you provide) are a Data Principal.
By connecting your business to Sakshi via WhatsApp, or by authorizing Sakshi to access your Instagram account, you agree to the practices described in this policy and consent to the processing described herein.
2. Personal data we collect (item-wise disclosure)
In accordance with the DPDP Act's requirement for specific, item-wise disclosure, we identify each category of personal data collected below, rather than using broad or generic descriptions.
2.1 Provided directly by you
| Category | Examples |
|---|---|
| Contact information | WhatsApp phone number |
| Business information | Business name, business type/category, physical or operating address if shared |
| Brand preferences | Colour palette, tone, positioning, stated likes/dislikes for content style |
| Message content | The text of your conversations with Sakshi |
| Uploaded images | Product photographs or other images you upload |
2.2 Collected via Instagram, with your explicit authorization (Meta Platform Data)
| Category | Examples | Permission used |
|---|---|---|
| Account identifiers | Instagram Business Account ID, username, profile picture | instagram_basic |
| Performance metrics | Reach, impressions, saves, likes, comments, shares on your own posts | instagram_manage_insights |
| Publishing access | Authorization token used solely to publish content you approve | instagram_content_publish |
We refer to this Instagram-sourced information collectively as Platform Data, consistent with Meta's terminology.
2.3 Generated or derived through your use of the service
| Category | Examples |
|---|---|
| Generated content | Images, carousels, and captions created on your behalf |
| Conversation history | Full record of your interactions with Sakshi |
| Usage records | Credits consumed, generation history, feature usage patterns |
3. Purpose of processing (purpose limitation)
Consistent with the DPDP Act's purpose limitation requirement, we process your personal data only for the specific purposes disclosed at the time of collection, namely to:
- Operate the Sakshi service, including generating content and responding to your requests.
- Analyze your Instagram Insights data to identify top-performing content and provide recommendations.
- Maintain a brand profile for your business so content remains consistent over time.
- Process payments and manage your credit balance.
- Diagnose and fix technical errors.
- Comply with our legal obligations, including under the DPDP Act and Meta's Platform Terms.
We do not process your personal data or Platform Data for any purpose beyond those listed above without obtaining your fresh consent. We do not sell your personal data or Platform Data to any third party, and we do not use Platform Data for advertising unrelated to your own business.
4. Your rights as a Data Principal
Under the DPDP Act, you have the following rights, which you may exercise at any time by contacting us at Ajinu.A@socioburp.co.in or by messaging Sakshi directly:
- Right to access a summary of the personal data we hold about you and the processing activities undertaken.
- Right to correction and completion of inaccurate or incomplete personal data.
- Right to erasure of your personal data once it is no longer necessary for the purpose it was collected for, or upon withdrawal of consent (see our separate Data Deletion Instructions).
- Right to withdraw consent at any time, with the same ease with which it was given. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
- Right to grievance redressal — you may raise a complaint with us at the contact details above. If unresolved to your satisfaction, you may escalate to the Data Protection Board of India, established under the DPDP Act.
- Right to nominate another individual to exercise your rights under the DPDP Act on your behalf in the event of your death or incapacity. To register a nominee, contact us using the details above.
We will acknowledge and respond to rights requests within a reasonable time, and in any event within 30 days.
5. Consent
Where we rely on your consent to process personal data, we will obtain it through a clear affirmative action (for example, proceeding through the WhatsApp onboarding conversation, or completing Meta's OAuth consent screen for Instagram permissions). You may withdraw consent at any time; doing so may limit or end our ability to provide some or all of the Sakshi service to you.
6. Sharing and processors
We share personal data and Platform Data only as necessary to operate the service, and only with processors who are contractually bound to handle it in accordance with this Policy and the DPDP Act:
- Meta/Instagram — to authenticate your account and publish content or retrieve Insights, as directed by you.
- Anthropic (AI processing) — business and content-related information is sent to Anthropic's Claude models to generate text and image content, under Anthropic's own data handling terms.
- Render and Neon (infrastructure/database hosting) — act solely as data processors on our behalf, under contractual obligations consistent with this Policy.
- Legal or regulatory authorities — where required by law, including the Data Protection Board of India or a court of competent jurisdiction.
We do not permit any processor to use your personal data for its own independent purposes.
7. Cross-border data transfer
Some of our processors (including Anthropic) may process data on servers located outside India. We take reasonable steps to ensure such transfers are consistent with the DPDP Act and any applicable government notifications restricting transfer of personal data to specific countries. If the Government of India issues a notification restricting transfer to a particular jurisdiction, we will comply with that restriction.
8. Data security and breach notification
We apply reasonable technical and organizational security safeguards to protect your personal data against unauthorized access, alteration, disclosure, loss, or destruction, consistent with the DPDP Act's security requirements. In the event of a personal data breach, we will notify the Data Protection Board of India and affected Data Principals as required under the DPDP Act and Rules.
9. Data retention and erasure
We retain personal data only for as long as necessary to fulfil the purposes described in Section 3, or as required by law. Specifically:
- Platform Data: retained only as long as necessary to provide Insights and posting functionality, or until you revoke access or request deletion, whichever is earlier.
- Conversation and generation history: retained to maintain your brand profile and service continuity, unless you request erasure.
Upon a valid erasure request, we will delete your personal data and Platform Data within 30 days, except where retention is required by law (for example, financial records required for tax compliance), and only for as long as legally necessary. Full instructions are available in our separate Data Deletion Instructions.
10. Children's data
Sakshi is intended for use by business owners acting in a business capacity and is not directed at, or intended for use by, individuals under the age of 18. We do not knowingly collect personal data from children. The DPDP Act imposes additional obligations regarding children's data and verifiable parental consent; as our service is not directed at children, these provisions are not expected to apply, but we will comply fully should the situation arise.
11. Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements, including future phases of DPDP Rules implementation. Material changes will be communicated to active users via WhatsApp or another reasonable method, and where required, we will seek fresh consent.
12. Grievance and contact
For any questions, rights requests, or complaints regarding this Privacy Policy or our data practices:
Grievance Contact: Ajinu Achankunju
Email: Ajinu.A@socioburp.co.in
Phone: 98715 83289 / 83688 75586
Address: Asset-5A, Aerocity, Pride Plaza Hotels, near IGI Airport, New Delhi – 110037
If your complaint is not resolved to your satisfaction, you may approach the Data Protection Board of India.