Privacy policy
Last updated: 19 October 2026
NewScaler ("we", "us") runs Proofloop. This notice says, item by item, what personal data we collect, why, who else handles it, how long we keep it, and how you can see, correct or delete it, withdraw your consent, or complain. It is written for India's Digital Personal Data Protection Act, 2023 ("DPDP Act") and its Rules, and the Information Technology Act, 2000 and its rules.
- Two roles
- What we collect, and why
- Who else handles it
- Processing outside India
- Google data
- How long we keep it
- Cookies and browser storage
- Security and breaches
- Your rights
- Children
- Grievance Officer
- Changes
1. Two roles
Your account data (you, the person or business using Proofloop): we decide how it is used, as a Data Fiduciary.
Your customers' data (the people who message you, fill in your lead page, send a brand enquiry, or appear in your sales): you, the business or creator, decide why it is collected; we process it only on your instructions to run Proofloop for you, as your Data Processor. You are responsible for telling them and for having their consent where the law needs it; our data processing terms set out what we do for you. If you are one of those customers, see "If a business uses Proofloop to talk to you" below.
2. What we collect, and why
| What | Why | On what basis |
|---|---|---|
| Your WhatsApp number and name | To sign you in (you send us a WhatsApp message or a code), send the alerts and morning summary you choose, and one-tap sign-in links in those alerts | Your consent, given when you sign up |
| Workspace and business details (name, website, fact sheet, products, team numbers) | To run the features you use | Consent |
| Access tokens for the accounts you connect (WhatsApp, Instagram, Meta ads, Razorpay, Cashfree, WordPress, Google, Cloudflare) | To act on those accounts only as you ask. Stored encrypted (AES-256-GCM) | Consent; you can disconnect any time |
| Billing details (name, address, GSTIN if you give one, email) and your subscription and payments | To charge you through Razorpay and issue tax invoices or receipts. We never see card or bank details | Consent, and our legal duty to keep tax records |
| Messages, names and phone numbers of people who write to you; lead-page and enquiry details; sales records and payment screenshots customers send you | To reply to them, qualify leads, follow up, and show which campaigns sold. Screenshots are read by AI for the amount, date and reference; the image is not kept | Processed for you, on your instructions |
| Clicks on tracked links: time, country, device type, referring site | To count real visitors and remove bots and self-clicks. We never store IP addresses: only a keyed one-way hash, erased after 30 days | Legitimate use for the service you asked for |
| Agency client logins: client names, WhatsApp numbers, the businesses they may see, last sign-in | To let an agency's clients see their reports | The agency's instructions |
| Promotion and search data: tracked searches and rankings, pages of your site we read, fixes, speed results, AI-assistant answers, posts and their results, press releases and the outlets you pitch, AI crawler visit counts | To run Grow features | Consent |
| Prospects you look for: public Google Maps listings of businesses (name, address, public phone, website, rating), what their own website says, and public posts where people asked for what you sell (their public name, the post's address, a short quote, never private contact details) | To find and approach possible customers; you send every message yourself | Processed for you. A person's post is data they made public themselves, which the DPDP Act does not cover (s.3(c)(ii)); we still remove anyone who asks |
| Free audit details: the website, questions, any contact you leave, a keyed hash of your IP and the date | To run the audit and limit abuse | Consent |
| Support messages and abuse reports | To answer you and keep Proofloop safe | Consent; legal duties |
| Security and activity logs (sign-ins, changes, errors) | To keep accounts secure, investigate misuse and meet CERT-In rules | Legal duty |
We do not sell personal data, use it for advertising, or use your or your customers' data to train AI models.
3. Who else handles it
These providers process data for us, only for the purpose listed:
| Who | What for | What they receive | Where |
|---|---|---|---|
| Cloudflare | Hosting, database, delivery of every page and API call | Everything stored in Proofloop | Global network (including India) |
| Meta Platforms (WhatsApp, Instagram, Facebook) | Sending and receiving WhatsApp and Instagram messages; ads you create in your own ad account | Messages, phone numbers, names, ad text and budget | Outside India |
| Anthropic | AI drafts and replies, video scripts, reading typed answers and payment screenshots, reports | The text needed for the task (for example a chat, a review, a screenshot a customer chose to send) | United States |
| Razorpay | Proofloop subscriptions; sales tracking for businesses that connect their own account | Payment status and amounts (never card or bank details) | India |
| Cashfree | Sales tracking for businesses that connect it | Payment status and amounts | India |
| Google (PageSpeed Insights, Search Console, Business Profile, Safe Browsing, Gemini) | Speed checks, search data and reviews you connect, link safety, AI-visibility checks | Your page addresses, your search data and reviews, link addresses, buyer questions you track | Outside India |
| OpenAI, Perplexity | AI-visibility checks | Only the buyer questions you track | United States |
| DataForSEO | Google results, search volumes, backlinks, Google Maps business listings | Searches you track, website addresses, and for prospects the kinds of business and the area you choose (no customer data) | Outside India |
| Our video server, with Pexels (stock footage) and Microsoft speech (voice-overs) | Making short videos you ask for | The video's voice-over text and footage searches (no customer data) | Outside India |
| Upload-Post | Automatic posting to social accounts you connect | Post text, its link and your business name | Outside India |
| GitHub | Blog publishing, if you connect it | The blog posts you publish | United States |
| IndexNow (Bing and other participating search engines) | Telling search engines which of your pages changed | Your page addresses | Outside India |
| Your own WordPress site and Cloudflare account, if you connect them | The fixes and posts you approve; crawler visit counts and speed settings | Page content you approve; read-only analytics | Where you host them |
We also share data when the law requires it (for example a valid order from a court or government agency), and only as much as required.
4. Processing outside India
Some providers above process data outside India. The DPDP Act allows this except to countries the Government of India restricts; we will stop using any provider in a restricted country.
5. Google data
Proofloop's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Search Console and Business Profile data are used only to show you your own search performance and reviews, suggest fixes for your own site, and reply to your own reviews. It is never sold, used for advertising, or used to train AI models, and no person reads it unless you ask us to for support or the law requires it. You can disconnect Google at any time, and Proofloop then gives the access back.
6. How long we keep it
- Sign-in codes: 10 minutes. One-tap sign-in links: 1 hour. Sign-in sessions: 30 days.
- Prospects never contacted: people 60 days, businesses 180 days. Anyone who asks not to be contacted again is removed at once and kept only as a one-way code so they are never suggested again.
- Videos: while your account is open; you can delete any video at any time. Files on the video server are removed once copied to our storage.
- Click IP hashes: 30 days. AI answer cache: 7 days. Content briefs: 30 days. Search Console numbers: 120 days. AI crawler visit counts: 400 days.
- Security and activity logs: 180 days.
- Tax invoices, credit notes and payment records: as long as GST law requires (currently 72 months after the due date of the annual return for that year), even after you close your account.
- Everything else: while your account is open. When you delete a product or your account, its data is erased from our database at once and from backups within 30 days.
7. Cookies and browser storage
We use no advertising or tracking cookies and no third-party analytics. The dashboard keeps your sign-in key in your browser's storage (signing out removes it). When you connect Google, one short cookie (pl_oauth, 10 minutes) ties the sign-in to your browser. If you install the dashboard as an app, your phone keeps a small offline page and icons.
8. Security and breaches
Tokens are encrypted, IP addresses are only stored as keyed hashes, access to production is limited, and every connection uses HTTPS. If a personal data breach happens, we will tell the people affected and the Data Protection Board of India as the DPDP Act and Rules require (what happened, when, the likely impact, what we are doing and what you can do), and report cyber incidents to CERT-In within its time limits.
9. Your rights
Under the DPDP Act you can:
- Get a summary of the personal data we hold about you and who we shared it with: download an export from the dashboard, or write to us.
- Correct, complete or update it: in the dashboard, or write to us.
- Erase it: delete a product or your account in the dashboard (see Delete your data).
- Withdraw consent as easily as you gave it: switch off what you no longer want (for example the morning summary, or send STOP to Proofloop's WhatsApp number), disconnect an account, or close your account. Withdrawing does not affect what was done before.
- Nominate someone to use these rights for you if you die or cannot act: write to us with their name and contact.
- Complain to our Grievance Officer (below). If you are not satisfied, you can complain to the Data Protection Board of India.
We acknowledge every request within 24 hours and resolve it within 15 days. We may ask you to confirm it is your number or account before acting.
If a business found you as a prospect
Businesses using Proofloop can be shown public business listings and public posts that match what they sell. To be removed and never suggested again, tell the business, or write to our Grievance Officer with the business's name and your listing or post address.
If a business uses Proofloop to talk to you
The business decides why your details are used and is responsible for them. On WhatsApp, reply STOP to stop their messages. To see, correct or delete your data, ask that business; you can also write to our Grievance Officer with your number and the business's name, and we will pass it on and help.
10. Children
Proofloop is for people aged 18 and over, using it for their work or business. We do not knowingly collect children's data. Businesses must not use Proofloop to message or collect data from children.
11. Grievance Officer
- Grievance Officer
- Shashank Shekhar Singh
- grievance@proofloop.in
- Address
- House No 22, Ward No 5, Munnuganj, Gola Gokarannath Kheri, Block Kumbhi, Lakhimpur Kheri, Uttar Pradesh 262802
- Phone
- +919415509509
12. Changes
We post changes here with a new date. For important changes we tell account holders in the dashboard and ask them to agree before the change applies to them.