Nagrik Apps

Privacy policy

Last updated 26 October 2026

1. Who we are and what this policy covers

OneSeam is an inbox app for Wix sites, made by Nagrik Apps, a sole proprietorship at B604 Bageshree Towers, ISKCON Crossroad, Ahmedabad 380015, India ("Nagrik Apps", "we", "us"). This policy explains how personal data is handled when businesses use the OneSeam app and when anyone visits this website. It should be read with our terms of service and data deletion page.

2. Our role

The businesses that install OneSeam on their Wix site are our customers. The people who message those businesses ("end users") are the businesses' customers.

3. Data we handle

On behalf of businesses (as processor):

For ourselves (as controller):

We do not ask for, and businesses should not send through OneSeam, sensitive data that Meta's policies forbid, such as payment card numbers or government identifiers.

4. Where data is stored

Conversations, media and contacts are stored only in the business's own Wix site, not in databases of ours. Message content passes through our service while being delivered and is not stored by us. To connect a business's WhatsApp number to its site, we keep only the identifiers and the encrypted Meta access credential needed for each site. Technical logs are kept without message content.

5. Why we use data and on what basis

6. What we never do

We do not sell personal data, share it for advertising, show ads, build profiles of end users, or use anyone's data to train artificial intelligence. We use data only to provide OneSeam to the business that installed it and for the purposes above.

7. Who data is shared with

Our subprocessor. We use one provider to run OneSeam:

We will post any new subprocessor here at least 15 days before we start using it, except in an emergency affecting security or availability.

Platforms the business uses directly. Data also goes to these platforms, because the business connects them and instructs us to use them. They act under the business's own agreements with them and their own privacy policies; they are not our subprocessors.

Other disclosures. We give Meta the information about our business customers and their use of OneSeam that Meta's terms for technology providers require, and we delete or stop using data obtained from Meta when Meta or the person concerned asks, as Meta's terms require. We may also disclose data where the law, a court or a government authority lawfully requires it, or where reasonably necessary to protect the rights, safety or property of anyone. If our business is transferred, data may pass to the new owner, who must respect this policy.

8. International transfers

We are based in India, and our provider and the platforms above may process data outside India and outside the end user's country, including in the United States. Transfers from India are made as the DPDP Act permits. Where personal data from the European Economic Area, the United Kingdom or Switzerland comes to us, or goes onward to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (with the UK Addendum or Swiss amendments where needed), which our terms of service incorporate for business customers, and on our provider's own safeguards, such as the EU-US Data Privacy Framework and Standard Contractual Clauses. Businesses can ask us for a copy.

9. How long we keep data

Conversations, media and contacts are stored in the business's own Wix site, and the business decides how long they are kept. OneSeam offers a setting that deletes messages and media older than a period the business chooses (90 days, 180 days, 1 year, 2 years, or never). The business is responsible for choosing a period that meets the laws that apply to it: for example, from 13 May 2027 India's Digital Personal Data Protection Rules, 2025 (rule 8(3)) require a business to keep personal data and the logs of its processing for at least one year, tax laws such as section 36 of the CGST Act, 2017 may require some records to be kept longer, and laws such as the GDPR require personal data not to be kept longer than needed. If the law, a court or a government authority requires information to be preserved, we may pause deletion for the site concerned. The Wix Inbox keeps its own text copy of each message, which this setting does not delete, and Wix's own retention applies to it. Message content is not stored by us at all. The connection details we hold for a site are kept while OneSeam is installed. When the business uninstalls it, we delete the Meta access credential promptly and the other details within 30 days, except a basic record of the account (the Wix site and WhatsApp number it connected), which Indian intermediary rules require us to keep for 180 days after an account ends. Technical logs, which never contain message content, are kept for one year and then deleted. This covers the 180 days required by the CERT-In directions of 28 April 2022 and, from 13 May 2027, the one year required by rules 6(1)(e) and 8(3) of the Digital Personal Data Protection Rules, 2025, for our own processing and for processing we do for businesses. Support emails are kept for as long as needed to handle the request and any follow-up, and for longer only where the law requires it or to establish or defend legal claims. Meta keeps its own copies of messages under its own policies. Where a law requires us to keep particular records for longer than stated here, such as security logs or records of a takedown or deletion request, we keep only those records, only for the period required, and only for that legal purpose.

10. Security

Data is encrypted in transit. The Meta access credentials we keep are encrypted. Access to our systems is limited to the people who run the service, and we keep the data we hold to the minimum needed. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11. Personal data breaches

If we become aware of a breach affecting personal data we handle, we will act to contain it and notify the affected businesses without undue delay. For data we hold for ourselves, we will notify the Data Protection Board of India, other data protection authorities and affected people where and when the law requires; from 13 May 2027, the DPDP Act and its rules require us to tell affected people without delay, and to tell the Board without delay and give it a detailed report within 72 hours. We also report cyber security incidents to CERT-In, Meta and Wix where the law or their terms require. For conversation data, the business as data fiduciary or controller decides and makes any notifications it is required to make, and we will help it.

12. Your rights

Depending on where you live, you may have the right to:

How to exercise them. Email support@nagrikapps.com with your request and the phone number or email address it concerns. We may ask you to confirm the request is yours before acting on it. If you messaged a business that uses OneSeam, that business controls your conversation: we will pass your request to it and help it respond, and we will act directly on any data we hold ourselves. To delete your data, see data deletion. We confirm receipt promptly and respond in full within one month. If a request is complex we may extend this where the law allows, and we will tell you why within that first month.

13. Grievance Officer and Compliance Officer

Grievance Officer (Digital Personal Data Protection Act 2023, and the Information Technology Act 2000 and its rules): Sarthak Pandya, Nagrik Apps, B604 Bageshree Towers, ISKCON Crossroad, Ahmedabad 380015, India · support@nagrikapps.com · +91 7303 707147

The Grievance Officer answers questions about how we process personal data and handles complaints about personal data and about content. We acknowledge grievances within 24 hours and resolve them within 7 days of receipt, or sooner where the law requires a shorter time for a particular kind of complaint. If you are not satisfied with our response, you may complain to the Data Protection Board of India or to your local data protection authority.

Compliance Officer (compliance with the law, and orders, notices and requests from courts, government agencies and regulators): Sarthak Pandya, Nagrik Apps, at the address above · support@nagrikapps.com

14. Children

OneSeam is a tool for businesses and is not directed at children. We do not knowingly collect personal data from children for our own purposes. Businesses that message children are responsible for obtaining verifiable parental consent and meeting all other legal requirements for children's data, including those under the DPDP Act.

15. Cookies and this website

This website sets no cookies and uses no analytics, advertising or tracking tools. Our hosting provider, Cloudflare, Inc., processes your IP address and basic request data to deliver this website and protect it from attacks.

16. Changes to this policy

We will post any change here and update the date above. If a change is significant, we will tell businesses that use OneSeam at least 15 days before it takes effect, unless a change is needed sooner for legal, security or platform reasons. We will not use personal data for a new purpose without giving any notice, or asking for any consent, that the law requires.

17. Contact

Nagrik Apps, B604 Bageshree Towers, ISKCON Crossroad, Ahmedabad 380015, India · support@nagrikapps.com · +91 7303 707147