Privacy Policy

1. About OptimReach

OptimReach is a WhatsApp Business Automation Platform and Google RCS messaging platform operated by MetaGrad Labs Private Limited, a company incorporated in India. OptimReach enables businesses to automate customer conversations, send broadcast campaigns, manage sales workflows, and integrate messaging channels into their business operations.

This Privacy Policy applies to all users of the OptimReach platform at cloud.optimreach.in, the marketing website at optimreach.in, and all associated APIs, integrations, mobile apps, and services.

2. Information We Collect

2.1 Account information

When you register for OptimReach, we collect your name, business email address, phone number, business name, and account password (stored in hashed form). This information is used to create and manage your workspace.

2.2 Business and workspace data

We collect information you add to your OptimReach workspace, including customer contact details, conversation records, product catalogues, order data, workflow configurations, automation rules, and WhatsApp message templates.

2.3 Usage and technical data

We automatically collect information about how you use the platform, including pages visited, features used, session durations, browser type, operating system, IP address, device identifiers, and error logs. This data is used to improve the platform and ensure its security.

2.4 Payment information

If you subscribe to a paid plan, payment is processed by a third-party PCI-DSS compliant payment processor. OptimReach does not store your full payment card details on our servers.

2.5 Communication data

If you contact OptimReach support, we collect the content of your communications and any information you provide, which we use to respond to your requests and improve our service.

3. Google Account & API Data Accessed

When you connect your Google Account to OptimReach, OptimReach may access information and data from Google services that you explicitly authorize through Google's OAuth consent screen. We only request access to the Google data that is strictly necessary for the specific features you choose to enable. You will always be shown a consent screen before any access is granted.

The following table describes exactly what Google user data our application accesses:

4. OAuth Scopes We Request

OptimReach requests only the minimum OAuth scopes necessary to provide the features you enable. The following Google OAuth scopes may be requested depending on which integrations you enable:

OptimReach does not request scopes beyond those listed above. If additional scopes are needed for new features in the future, this policy will be updated and you will be notified before authorization is requested.

5. How We Use Google Data

We use Google data solely to provide the specific product features you have enabled. The following describes exactly how each type of Google data is used within OptimReach:

5.1 Google Account (email and profile)

Your Google email and profile are used exclusively to authenticate your identity when signing in with Google, to associate your OptimReach workspace with your Google Account, and to display your name and profile picture within the OptimReach platform interface. This data is not used for any marketing, profiling, or advertising purposes.

5.2 Google Sheets

OptimReach uses your authorized Google Sheets data to allow you to import and synchronize business or customer information — such as contact lists, product catalogues, pricing data, or order records — into your OptimReach workspace. Sheets data is read or written only when you initiate an import, configure a sync automation, or trigger a workflow that you have set up. We do not access sheets beyond those you explicitly authorize.

5.3 Google Calendar

OptimReach uses your authorized Google Calendar data to provide appointment scheduling and booking functionality within your WhatsApp workflows. This includes checking your availability to avoid double-booking, creating calendar events when a customer books an appointment through your WhatsApp bot, and sending calendar confirmations. Calendar data is accessed only when these features are actively in use.

5.4 Google Contacts

OptimReach uses your authorized Google Contacts data to allow you to synchronize your contact list into your OptimReach workspace, enabling you to initiate WhatsApp conversations and automation workflows with your existing contacts. Contact data is imported only with your authorization and is stored within your workspace.

5.5 Gmail

If you explicitly enable the Gmail integration, OptimReach accesses Gmail data solely to support email-triggered automation workflows or email-to-WhatsApp bridging features that you configure. For example, when a customer emails you, OptimReach can trigger a WhatsApp follow-up message based on rules you define. Gmail message content is read only to execute these user-configured workflows and is not stored beyond what is necessary for the feature to function.

6. Google API Limited Use Policy

OptimReach's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, OptimReach:

• Only uses Google user data to provide or improve user-facing features that are visible and prominent in the OptimReach interface and directly requested by the user.
• Does not transfer Google user data to third parties except as necessary to provide or improve user-facing features within OptimReach, subject to explicit user consent, or as required by applicable law.
• Does not use Google user data for serving targeted advertisements, personalized advertisements, interest-based advertisements, or retargeted advertisements.
• Does not allow humans to read Google user data unless the user has explicitly given permission to do so, it is necessary for security or legal compliance purposes, or data is aggregated and anonymized such that no individual can be identified.
• Does not use Google Workspace API data to develop, improve, or train generalized or non-personalized artificial intelligence or machine learning models.
• Does not sell Google user data or provide Google user data to information resellers, data brokers, or any parties for commercial data purposes.

7. Prohibited Uses of Google Data

OptimReach explicitly prohibits the following uses of Google user data. These restrictions apply to all data received via Google APIs, including Google Sheets, Calendar, Contacts, Gmail, and Google Account data:

These prohibitions are permanent and apply regardless of any future changes to OptimReach's business model. If OptimReach ever needs to use Google data in a new way, we will request explicit user consent and update this policy before doing so.

8. WhatsApp & Messaging Data

OptimReach is a WhatsApp Business Platform solution. When you use OptimReach to send and receive WhatsApp messages:

• Message content, timestamps, delivery status, read receipts, and sender/recipient phone numbers are stored in your OptimReach workspace.
• Media files shared via WhatsApp (images, documents, audio, video) may be stored on OptimReach infrastructure to enable conversation history, automation triggers, and media management features.
• WhatsApp message templates must be approved by Meta (WhatsApp's parent company) before use. OptimReach facilitates the template submission and approval process on your behalf.
• Customer phone numbers and conversation data are associated with your business workspace and are governed by this policy.

9. Google RCS Data

In addition to WhatsApp, OptimReach provides Google RCS (Rich Communication Services) messaging. The following data handling applies to this channel:

9.1 Google RCS messaging

When you use OptimReach's Google RCS channel, message content, delivery status, timestamps, sender and recipient identifiers, and rich media content (images, cards, suggested actions) are processed and stored within your OptimReach workspace. RCS messaging is governed by Google's RCS Business Messaging policies in addition to this privacy policy.

9.2 Cross-channel data

OptimReach may link conversation data across WhatsApp and RCS channels to provide a unified customer view within your workspace. This linking is performed using identifiers such as phone numbers that you provide or that customers use when contacting your business.

10. Data Sharing & Disclosure

OptimReach does not sell your personal data or Google user data. We do not share your data with advertisers, data brokers, or information resellers.

We may share data only in the following strictly limited circumstances:

10.1 Service providers (sub-processors)

Google user data and other personal data may be processed by service providers that are strictly necessary to operate OptimReach — such as cloud infrastructure providers, database hosting providers, security monitoring services, and analytics providers. All sub-processors are bound by contractual data processing agreements that restrict them from using your data for any purpose other than providing services to OptimReach. A current list of sub-processors is available at optimreach.in/sub-processors.

10.2 Legal requirements

We may disclose data if required to do so by applicable law, court order, or lawful government authority, or where necessary to protect the rights, property, or safety of OptimReach, our users, or the public.

10.3 Business transfers

In the event of a merger, acquisition, restructuring, or sale of assets, user data may be transferred to the acquiring or successor entity, subject to the same or stronger privacy protections described in this policy. We will notify affected users before any such transfer takes place.

10.4 With your explicit consent

We may share data with third parties only when you have given explicit, specific, and informed consent for us to do so for a clearly described purpose.

11. Data Storage & Security

Security procedures are in place to protect the confidentiality and integrity of your data. OptimReach stores data on secure cloud infrastructure and implements the following data protection mechanisms:

• Encryption in transit: All data transmitted between your browser, mobile app, and OptimReach servers is encrypted using HTTPS with TLS 1.2 or higher. We use encryption to protect your information during transmission.
• Encryption at rest: Sensitive data stored on OptimReach servers, including OAuth tokens, credentials, and personal data, is encrypted at rest using industry-standard encryption algorithms.
• OAuth token security: Google OAuth refresh tokens are stored in encrypted form in our database. Short-lived access tokens are held only in memory during active API sessions and are never written to logs or persistent storage.
• Access controls: Access to production systems and customer data is restricted to authorized OptimReach personnel on a need-to-know basis, subject to authentication, authorization, and audit logging controls.
• Workspace isolation: Each business workspace is logically isolated. Data belonging to one workspace is never accessible to users of another workspace.
• Security monitoring: We monitor our systems for unauthorized access, anomalous behavior, and potential security incidents using automated tools and periodic manual review.
• Vulnerability management: We conduct periodic security assessments and apply security patches to our infrastructure on a timely basis.

While we implement industry-standard security practices, no system can guarantee absolute security. We encourage you to use strong, unique passwords, enable two-factor authentication where available, and report any suspected security issues to privacy_optimreach@metagrad.in with the subject "URGENT — Security Issue."

12. Data Retention

We store your personal information for a period of time that is consistent with our business purposes and legal obligations. We will retain your personal information for the length of time needed to fulfill the purposes outlined in this privacy policy unless a longer retention period is required or permitted by law. When the data retention period expires for a given type of data, we will delete or destroy it securely.

You may request for your data to be deleted by contacting us at privacy_optimreach@metagrad.in with the subject line "Data Deletion Request." See Section 13 for full details. Our full data retention schedule is available at optimreach.in/data-retention.

13. Data Deletion

You have the right to request deletion of your personal data and workspace data at any time.

13.1 Deleting your account

You may delete your OptimReach account at any time from your workspace settings under Settings → Account → Delete Account. Upon deletion, your account data and workspace data will be permanently and irreversibly deleted within 30 days.

13.2 Requesting data deletion

You may request deletion of specific data by contacting us at privacy_optimreach@metagrad.in with the subject line "Data Deletion Request." Please include your registered email address and a description of the data you wish to have deleted. We will confirm receipt within 5 business days and complete the deletion within 30 days.

13.3 Exceptions

We may retain certain data after a deletion request where required by applicable law, for legitimate security or fraud-prevention purposes, to resolve outstanding disputes, or to enforce our terms. Billing records are retained for up to 7 years as required by Indian financial regulations. Anonymized and aggregated data from which you cannot be individually identified may be retained indefinitely.

13.4 Backup deletion

System backup copies of deleted data will be permanently purged within 30 days of the deletion date. We do not restore deleted data from backups except in the event of a catastrophic system failure.

14. Disconnecting Google

You can disconnect your Google Account from OptimReach at any time using either of these methods:

• From OptimReach: Go to Settings → Integrations → Google and click "Disconnect."
• From Google: Visit myaccount.google.com/permissions, find OptimReach, and click "Remove Access."

When you disconnect your Google Account, the following occurs:

• OptimReach immediately stops making any API requests using your Google authorization.
• Your stored Google OAuth refresh tokens are deleted from OptimReach systems within 30 days.
• Data previously synchronized from Google services (contacts, calendar events, spreadsheet data) that was imported into your OptimReach workspace will remain in your workspace as part of your business records, unless you explicitly delete it separately.
• You will lose access to all Google-connected features in OptimReach until you reconnect your Google Account.

15. AI & Automation

OptimReach uses artificial intelligence and automation features to help businesses manage conversations, qualify leads, suggest responses, and automate workflows.

• Personalized AI only: AI features in OptimReach operate on your specific workspace data (your conversations, your customers, your configured workflows). This is workspace-level personalization and is entirely distinct from training generalized AI models.
• No Google data for any AI training: OptimReach does not use Google Workspace API data — from Google Sheets, Calendar, Contacts, Gmail, or any other Google API — to train, develop, or improve any AI or machine learning model, whether personalized, generalized, or otherwise.
• Human oversight: OptimReach's AI provides suggestions, drafts, and automated responses. Your team remains in control and can review, edit, approve, or override any AI-generated content before or after it is sent.

16. Third-Party Services & Sub-processors

OptimReach integrates with and relies on the following categories of third-party services:

• Meta (WhatsApp Business Platform): Message delivery, WhatsApp API services, and template management. Subject to Meta's Privacy Policy.
• Google: Google Sheets, Calendar, Contacts, Gmail integrations, and Google RCS messaging. Subject to Google's Privacy Policy.
• Payment processors: For subscription billing. These processors are PCI-DSS compliant and handle payment card data directly; OptimReach does not receive or store raw card data.
• Cloud infrastructure: For hosting, database storage, and computing infrastructure.
• Security and monitoring services: For fraud detection, security monitoring, and error tracking.

A current and complete list of sub-processors, including their names, locations, and data processing roles, is available at optimreach.in/sub-processors. We will notify you of any changes to our sub-processors with reasonable advance notice.

OptimReach is not responsible for the privacy or security practices of third-party services. We encourage you to review the privacy policies of any third-party services you connect to OptimReach.

17. Cookies

OptimReach uses cookies and similar technologies (such as local storage and session storage) to operate the platform, maintain your login session, remember your preferences, and analyze usage patterns to improve the service.

• Essential cookies: Required for the platform to function correctly, including maintaining your authenticated session.
• Analytics cookies: Used to understand how users navigate OptimReach so we can improve the product. Analytics data is aggregated and anonymized where possible.
• Preference cookies: Used to remember your settings, language, and preferences across sessions.

You can manage or disable cookies through your browser settings. Disabling essential cookies will prevent you from using the OptimReach platform. Our full Cookie Policy is available at optimreach.in/cookie-policy.

18. Your Rights

Depending on your location, you may have the following rights regarding your personal data. To exercise any of these rights, contact us at privacy_optimreach@metagrad.in. We will respond within 30 days.

We may need to verify your identity before processing certain requests. If you are in the European Economic Area, you also have the right to lodge a complaint with your local data protection authority. If you are in India, you may contact the Data Protection Board under the Digital Personal Data Protection Act 2023 once operational.

19. Children's Privacy

OptimReach is a business-to-business platform intended for use by businesses and business professionals. OptimReach is not directed at or intended for use by children under the age of 18. We do not knowingly collect personal data from children under 18. If we become aware that we have inadvertently collected personal data from a child under 18, we will delete that data promptly. If you believe we have collected data from a minor, please contact us at privacy_optimreach@metagrad.in.

20. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. This policy is current and notifies you if we change how our app uses Google user data.

When we make material changes, we will:

• Update the "Last updated" date at the top of this page.
• Notify registered users by email at the address associated with your account at least 14 days before material changes take effect.
• Display a prominent notice within the OptimReach platform for at least 30 days.

Your continued use of OptimReach after the effective date of an updated policy constitutes your acceptance of the updated terms. If you disagree with material changes, you may close your account before the changes take effect.

For changes that affect how we access, use, store, or share Google user data, we will always seek re-authorization through Google's OAuth consent screen where required.

21. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or how OptimReach handles your data — including Google user data — please contact us. We aim to respond to all privacy-related enquiries within 30 business days.