Privacy Policy

Last updated: 31 July 2026

Blacksharq Technologies Private Limited ("Blacksharq", "we", "us", or "our") operates CullQ (the "Service"), a WhatsApp Business automation platform available at app.cullq.com and related domains.

This Privacy Policy explains how we collect, use, share, store, and protect personal data when you use CullQ. It applies to:

1. Business users — individuals and organisations that create a CullQ account, connect a WhatsApp Business Account (WABA), and use the Service.
2. End customers — people who message a business on WhatsApp where that business uses CullQ. For end-customer data, the business is the data controller and CullQ acts as a data processor on the business's instructions.

If you do not agree with this policy, please do not use the Service.

Regulatory alignment. We do not claim that CullQ is certified or fully compliant with the GDPR, UK GDPR, CCPA, or CPRA. Where those laws may apply to you, we aim to handle personal data in line with their principles and guidelines, and to honour applicable individual rights as described below.

As an Indian company, we comply with India's Digital Personal Data Protection Act, 2023 (DPDP Act) in our processing of personal data, as described in Section 7.5.

Electronic record. This Privacy Policy is an electronic record under the Information Technology Act, 2000 (as amended) and the rules made thereunder, including Rule 3(1) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021. It is published in accordance with requirements for access to or use of the Service. This electronic record is generated by a computer system and does not require physical or digital signatures.

Definitions

In this Privacy Policy:

• Personal Data means information about an identifiable individual, including information that can identify you when combined with other data.
• Sensitive Personal Data means personal data as may be classified as sensitive under applicable Indian law from time to time.
• Non-personal Information means information that does not identify you personally, such as aggregated statistics, anonymised usage data, or technical diagnostics. If non-personal information is combined with personal data, we treat the combined information as personal data.
• Service means the CullQ platform, website, APIs, and related services operated by Blacksharq.
• Business User means an individual or organisation that registers for and uses a CullQ account.
• End Customer means a person who messages a business on WhatsApp where that business uses CullQ.
• Data Controller means the entity that decides why and how personal data is processed. For CullQ account data, Blacksharq is the controller. For WhatsApp end-customer data, the business customer is the controller.
• Data Processor means an entity that processes personal data on behalf of a controller. Blacksharq acts as a processor for WhatsApp end-customer data.

1. Who we are

CullQ is operated globally; we do not market specifically to any country, but anyone may register and use the Service subject to these terms and applicable law.

Registered office
PLOT NO 56/30, BLOCK-C, SECTOR-62, NOIDA, DISTT-GAUTAM BUDH NAGAR,
UTTAR PRADESH – 201301, India

2. What data we collect

2.1 From business users (CullQ account holders)

• Account information: name, email address, Cognito user identifier, workspace name, team membership, role, and permissions.
• WhatsApp Business connection: WhatsApp Business Account (WABA) ID, phone number ID, display name, connection status, and an encrypted Meta access token.
• Configuration data: message templates, automation flows, smart-reply rules, quick replies, labels, broadcast campaigns, and team invitations.
• Usage data: billing and usage meters related to your workspace.

2.2 From WhatsApp end customers (on behalf of businesses)

When a business uses CullQ to manage WhatsApp conversations, we process the following on the business's behalf:

• Contact information: phone number, display name or username, and opt-out (STOP) status.
• Message data: message content (text and media metadata), message type, direction (inbound/outbound), delivery and read status, reactions, and reply references.
• Conversation metadata: assignee, labels, last activity, and conversation previews.
• Import source: whether a contact was added from the inbox, a broadcast, or manually.

2.3 Automatically collected

• Technical logs: server and application logs (typically retained 7–14 days) for security and troubleshooting.
• Webhook idempotency records: short-lived records to prevent duplicate message processing (auto-expire).
• Temporary media: outbound media files stored in encrypted cloud storage for up to 2 days before automatic deletion.
• Cookies: see our Cookie Policy.

2.4 Non-personal, diagnostic, and usage data

We may collect non-personal or technical information to operate and improve the Service, including:

• Device and browser type, operating system, and language settings.
• IP address (which may be treated as personal data under some laws).
• Page views, navigation paths, feature usage, and session duration.
• Error reports, crash diagnostics, and performance metrics.
• Analytics: we use or plan to use tools such as Google Analytics to understand how the Service is used. Where possible, we use aggregated or anonymised data. See our Cookie Policy for details on analytics cookies.

We do not intentionally collect data from children under 16. The Service is intended for business use.

2.5 Accuracy of information you provide

You are responsible for ensuring that personal data you provide is accurate, current, and complete, and that you have the right and authority to provide it. If your information changes, please update your account or contact us. We may be unable to process certain requests (such as deletion or access) if we cannot verify your identity or if the information you provided is inaccurate or incomplete.

3. How we use data

We use personal data to:

• Provide and operate the Service (shared inbox, conversation management, contact lists).
• Send and receive WhatsApp messages through the Meta WhatsApp Cloud API.
• Run automations, flows, broadcasts, and smart agents configured by your business.
• AI-assisted features (when enabled): send relevant conversation context to our AI provider to help build automations, generate flow steps, or draft follow-up messages. AI features are optional and controlled by your workspace settings.
• Manage team access, permissions, and workspace onboarding.
• Maintain security, prevent abuse, and comply with legal obligations.
• Improve reliability and support customers.
• Measure product usage and improve features (including through analytics tools such as Google Analytics).

Marketing communications. We may send product updates, service announcements, or promotional messages about CullQ by email or in-app notification. You may opt out of marketing communications at any time by using the unsubscribe link in an email or by contacting privacy@cullq.com. Opting out of marketing does not affect transactional or service-related messages (e.g. security alerts, billing notices).

Lawful bases (where GDPR / UK GDPR applies): performance of a contract, legitimate interests (operating and securing the Service), and consent where required (e.g. optional cookies or marketing, if applicable).

4. How we share data

We do not sell personal data.

We share data only as needed to operate the Service:

We do not share personal data with affiliate or group companies for separate purposes. Data is processed by Blacksharq and the subprocessors listed above.

Business customers are responsible for their own compliance when messaging end customers via WhatsApp, including providing appropriate notices to their customers.

International transfers may occur where providers process data outside your country. We rely on appropriate safeguards such as standard contractual clauses, provider commitments, and contractual protections where applicable.

5. WhatsApp Cloud API and data residence

CullQ integrates with the Meta WhatsApp Cloud API to send and receive WhatsApp messages. Blacksharq is applying to participate in Meta's technology partner programmes.

When you use WhatsApp messaging through CullQ:

• Message content and related metadata are transmitted to and processed on Meta's infrastructure (WhatsApp Cloud API), which may store or process data in data centres located outside India, including in the United States and European Union.
• CullQ account data (e.g. workspace settings, team members) is stored in AWS Mumbai (ap-south-1) as described in Section 6.
• We do not offer India-only data localisation for WhatsApp messaging data. By connecting a WABA and using WhatsApp features, you acknowledge that WhatsApp-related data is subject to Meta's processing and data-residence practices, as described in our Terms of Service and Meta's terms.

For how Meta handles data, see Meta's Privacy Policy and WhatsApp's legal information.

6. How we store and secure data

• Data is stored in AWS DynamoDB with multi-tenant isolation (workspace-scoped keys).
• Meta access tokens are protected with AWS KMS envelope encryption.
• Data in transit is encrypted using TLS.
• Access to production systems is restricted by role-based AWS IAM policies.
• Retention: we keep data while your account or workspace is active. After account or workspace closure, we delete or anonymise personal data within 30 days, except where we must retain data for legal, security, or dispute-resolution purposes.
• Short-lived records (idempotency keys, temporary media, logs) are deleted automatically according to their configured lifetimes.

No method of transmission or storage is 100% secure. If you believe your account has been compromised, contact support@cullq.com immediately.

7. Your rights and choices

7.1 CullQ account holders

Depending on your location, you may have the right to:

• Access, correct, or delete your account data.
• Export your data.
• Object to or restrict certain processing.
• Withdraw consent where processing is consent-based.
• Lodge a complaint with a supervisory authority.

To exercise these rights, email privacy@cullq.com or submit a request at app.cullq.com/data-deletion. We respond within 30 days where required by law.

7.2 WhatsApp end customers

If you are a customer messaging a business on WhatsApp and that business uses CullQ:

• Contact the business first. The business is responsible for your data and your privacy requests.
• If the business cannot help, or you need CullQ's assistance as their processor, email privacy@cullq.com with the business name and your WhatsApp number. We will work with the business to fulfil valid requests.

7.3 European Economic Area and United Kingdom (GDPR / UK GDPR)

CullQ is available worldwide. We do not target advertising or sales to any particular region, but if you are in the EEA or UK, the GDPR and UK GDPR may apply to our processing of your personal data.

We do not claim GDPR or UK GDPR certification or full compliance. Where those laws apply, we aim to follow their principles and respond to valid requests as described in this policy.

You may have the right to:

• Access, correct, or delete your personal data
• Restrict or object to certain processing
• Data portability (where applicable)
• Withdraw consent where processing is based on consent
• Lodge a complaint with your local data protection supervisory authority

Legal bases for processing are described in Section 3. International transfers are described in Section 4.

Contact privacy@cullq.com to exercise these rights. We respond within 30 days where required by law.

7.4 California residents (CCPA / CPRA)

If you are a California resident, the CCPA and CPRA may apply. We do not claim CCPA or CPRA certification or full compliance. Where those laws apply, we aim to follow their principles and guidelines.

California residents may have the right to know what categories of personal information we collect, request deletion or correction, and not receive discriminatory treatment for exercising privacy rights. We do not sell or share personal information for cross-context behavioural advertising. Submit requests to privacy@cullq.com.

7.5 India (Digital Personal Data Protection Act, 2023)

Blacksharq Technologies Private Limited is established in India and complies with the DPDP Act in its capacity as a data fiduciary for CullQ account data, and as a data processor for WhatsApp end-customer data processed on behalf of business customers.

Under the DPDP Act, you may have the right to:

• Access information about personal data we process about you
• Correction and erasure of inaccurate or unnecessary personal data
• Grievance redressal in respect of our processing
• Nominate another individual to exercise your rights in the event of your death or incapacity (where applicable)

Grievance Officer: Archit Jain, Director
Email: privacy@cullq.com
Registered office: Section 1 above

We aim to respond to grievances within timelines required under the DPDP Act. For WhatsApp end-customer data, the business using CullQ remains responsible as the primary point of contact; we will assist them and you as required under our processor obligations.

8. Data deletion

You can request deletion of your CullQ account data or assistance with end-customer data deletion:

1. Read our data deletion guide: cullq.com/data-deletion
2. Submit a request: app.cullq.com/data-deletion

Disconnecting your WhatsApp Business Account in CullQ stops new data ingestion but does not automatically delete historical data until a deletion request is processed.

8.1 Limitations on deletion

We will honour valid deletion requests where possible, but we may retain or delay deletion of certain data when:

• Legal obligation: we must keep records for tax, accounting, regulatory, or law-enforcement purposes.
• Legal hold or dispute: data is needed for an active investigation, dispute, or legal proceeding.
• Security and fraud prevention: we need data to detect, prevent, or investigate abuse, fraud, or security incidents.
• Backups: encrypted backups may retain data for a limited period before automatic purge; we delete from active systems within the timelines described in Section 6.
• Verification: we may need to verify your identity before processing a request.
• Technical difficulty: deletion from some backup or archival systems may take additional time where immediate erasure is not technically feasible.
• Meta / WhatsApp: we cannot delete data held independently by Meta or WhatsApp on their systems; you may need to contact Meta or the business that messaged you directly.

Withdrawal of consent or deletion of certain data may limit or end your access to the Service.

9. Third-party services and links

Your use of WhatsApp and Meta services is also governed by Meta's terms and policies. CullQ is not responsible for Meta's independent processing activities.

Our websites and the Service may contain links to third-party websites, applications, or services (e.g. Meta embedded signup, documentation, payment providers). If you follow a link to a third-party site, that site's privacy policy and terms apply, not ours. We do not control and are not responsible for the content, privacy practices, or security of third-party sites. We encourage you to read the privacy policy of every site you visit.

10. Limitation of liability (privacy)

To the maximum extent permitted by applicable law, Blacksharq shall not be liable for any indirect, incidental, special, consequential, or exemplary damages arising from or related to your use of the Service or this Privacy Policy, including loss of data, profits, or goodwill, even if we have been advised of the possibility of such damages.

Our total liability for privacy-related claims is subject to the limitations described in our Terms of Service. Nothing in this section limits rights you may have under mandatory applicable data protection law.

11. Changes to this policy

We may update this Privacy Policy from time to time. We will post the revised version at cullq.com/privacy and update the "Last updated" date. Material changes may be notified by email or in-app notice where appropriate. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy, except where applicable law requires your consent.

12. Contact us

Blacksharq Technologies Private Limited
PLOT NO 56/30, BLOCK-C, SECTOR-62, NOIDA, DISTT-GAUTAM BUDH NAGAR,
UTTAR PRADESH – 201301, India

CIN: U62013UP2025PTC235257 · GSTIN: 09AAOCB0583C1ZP · PAN: AAOCB0583C

Privacy: privacy@cullq.com
Grievance Officer: Archit Jain, Director — privacy@cullq.com
Support: support@cullq.com
Website: cullq.com

A Data Processing Agreement (DPA) is available on request for business customers who need contractual terms to support their own data-protection obligations.