Privacy Policy

1. Who we are

This Privacy Policy explains how Geddam Praveen Kumar (trading as One Stop) ("One Stop", "we", "us") handles personal data. One Stop is a sole proprietorship based in India.

• Registered address: Door No 1-2-14/BC/127, Budvel, Rajendranagar, K.V. Rangareddy, Telangana 500030, India
• Email (privacy, data deletion and grievances): support@onestop.in
• Grievance Officer: Geddam Praveen Kumar, support@onestop.in

For the personal data described in section 5, One Stop is the data controller under the EU and UK General Data Protection Regulation ("GDPR") and the data fiduciary under India's Digital Personal Data Protection Act, 2023 ("DPDP Act").

2. What this policy covers

This policy covers:

• the OneStop WhatsApp desktop application (the "App");
• our licensing, billing and support for the App; and
• our website at onestop.in (the "Website").

Our products are sold to businesses, not to individual consumers. In this policy, "you" means the business customer and the people who act for it, such as the contact person, and visitors to the Website.

3. How the App works, in short

• The App is a desktop program that runs on your own computer (Windows, macOS or Linux).
• It uses Meta's WhatsApp Business Platform. It can do so only after you have authorised it through Meta's Embedded Signup. The Embedded Signup process is handled by a separate One Stop onboarding tool, not by the App. To connect the App to your WhatsApp Business Account, the onboarding tool processes and may store your Meta access token and your WhatsApp phone number ID (see section 5).
• When you send a message, the App sends it from your computer directly to Meta's WhatsApp Business Platform. It does not pass through One Stop's servers.
• The App is for sending messages, message templates and attachments. It does not receive incoming messages.
• Message templates are managed within Meta's platform.
• To check your licence and look for updates, the App connects to a One Stop server (see section 5).

4. Information that stays on your computer

The following information is stored only on your computer, in the App's local data folder. One Stop does not receive it.

Information	What happens to it
Contacts you add to the App (for example names and WhatsApp numbers)	Stored locally on your computer.
Message content you send	Sent from your computer directly to Meta. One Stop does not store it.
Attachments you send	Deleted from the App's local folder as soon as the message is sent.
Technical logs	Record technical events only. They do not contain message content or contact details. Kept for 2 months, then deleted automatically.
Meta access token (the key that lets the App use your WhatsApp Business Account)	Stored locally on your computer in encrypted form.

You control this information. It is removed when you delete the App's local data folder (see our Data Deletion Instructions).

5. Information One Stop holds

We hold only the information we need to sell, license and support the App:

• Customer account details: your business name, contact person, email address and phone number.
• Licence details: your licence key and your plan (monthly or annual), with its start and end dates.
• Payment and invoice records: invoices and the bank transfer or UPI reference for each payment. We do not receive or store card details.
• Support correspondence: emails you send us and our replies.
• Licence and update checks: when the App checks your licence or looks for updates, it sends our server your licence key, app version, operating system and a device ID. Our server also sees your computer's IP address, as happens with any internet connection. The App does not send your messages, attachments, contacts or Meta access token to this server.
• Onboarding data: when you connect your WhatsApp Business number through Embedded Signup, our onboarding tool processes and may store your Meta access token and WhatsApp phone number ID, so that the App can be connected to your WhatsApp Business Account.

What we do not collect

• The content of your WhatsApp messages or attachments.
• Your contacts, or information about the people you message.
• Card details. We do not use an online payment gateway.

6. Why we use your information

We use personal data only for the following purposes, and on the following legal grounds:

Purpose	GDPR / UK GDPR legal basis	DPDP Act ground
Issuing and checking licences, and providing updates	Performance of our contract with you	Legitimate use: data you gave us voluntarily for this purpose (section 7(a))
Billing, invoicing and keeping accounts	Contract; compliance with legal obligations (tax and accounting laws)	Legitimate use (section 7(a)); compliance with law
Customer support	Contract; our legitimate interest in helping our customers	Legitimate use (section 7(a))
Keeping our systems and the App secure, and preventing misuse of licence keys	Our legitimate interest in protecting our service and customers	Legitimate use (section 7(a))
Meeting legal obligations and responding to lawful requests	Compliance with legal obligations	Compliance with law, or a judgment or order

Where we rely on consent, you may withdraw it at any time by emailing support@onestop.in. Withdrawal does not affect processing that already took place.

We do not sell personal data. We do not use it for advertising or profiling, and we do not share it for cross-context behavioural advertising.

7. Data from Meta's platform

The App accesses the WhatsApp Business Platform only with your authorisation through Meta's Embedded Signup. Data obtained from Meta's platform ("Platform Data") is used only to provide the App features you use, and only as permitted by Meta's Platform Terms and Developer Policies. We do not sell Platform Data, use it for advertising, or share it with data brokers. The App runs on your computer, so the Platform Data it uses stays on your computer, apart from the Meta access token and WhatsApp phone number ID that our onboarding tool may store (see section 5). You can remove the App's access at any time in your Meta Business settings.

8. Your responsibilities for your customers' data

When you use the App to message your own customers, you decide whom to message and what to send. For those contacts and messages, you are the controller (GDPR) or data fiduciary (DPDP Act), and you are responsible for:

• having a lawful basis, including opt-in consent where WhatsApp's policies or the law require it, before you message someone;
• honouring opt-out requests; and
• complying with the WhatsApp Business Messaging Policy and applicable data protection laws.

One Stop does not receive or process this data on its servers.

9. Who we share information with

We share personal data only with:

Recipient	Why
Meta Platforms (WhatsApp Business Platform)	When you use the App, your computer sends your messages, templates and attachments directly to Meta. Meta processes them under its own terms and privacy policy.
Netlify	Hosts the Website. Netlify processes technical data, such as IP addresses, to deliver and protect it.
BigRock (email hosting)	Hosts our email, including support@onestop.in.
Our bank and UPI service provider	Processes the licence payments you make to us.
Professional advisers and authorities	Accountants, auditors and legal advisers, and tax or other authorities where the law requires it.

We do not share personal data with anyone else unless you ask us to, or the law requires it.

10. International transfers

One Stop is based in India, and some of our service providers operate in other countries, such as the United States. So your personal data may be processed outside the country where you are located. Where the law requires it (for example for transfers out of the EU or UK), we use appropriate safeguards, such as standard contractual clauses where our service providers offer them.

11. How long we keep information

• Customer account, licence and support records: for as long as you are a customer, and afterwards only as long as reasonably needed to deal with questions or claims.
• Payment and invoice records: for as long as required by applicable tax and accounting laws.
• Licence and update check records on our server: 2 months, then deleted.
• Onboarding data (Meta access token and WhatsApp phone number ID): until your subscription ends, and then deleted.
• Technical logs on your computer: 2 months, then deleted automatically by the App.
• Attachments: deleted from the App's local folder as soon as the message is sent.

When records are no longer needed, we delete them or make them anonymous.

12. How we protect information

• On your computer, the App stores the Meta access token encrypted.
• Our licence/update server is operated by One Stop in India.
• Messages go directly from your computer to Meta over encrypted connections. They do not pass through One Stop's servers.
• The Website is served only over HTTPS, with security headers, and does not load third-party scripts.
• We limit access to our customer records to people who need it to do their job.

No method of transmission or storage is completely secure. You are responsible for securing the computer the App runs on, and for keeping your licence key and Meta account credentials confidential.

13. Your rights

Depending on where you are, you have some or all of the following rights. To use them, email support@onestop.in from the email address we have on record, and tell us what you are asking for. We may need to verify your identity before we act. We reply within the time the law requires, and normally within 30 days.

India (DPDP Act, 2023)

You have the right to:

• get a summary of the personal data we process about you;
• have it corrected, completed, updated or erased;
• have your grievances addressed by our Grievance Officer; and
• nominate another person to exercise your rights if you die or become incapable.

If you are not satisfied with how we handle your grievance, you may complain to the Data Protection Board of India.

EU and UK (GDPR and UK GDPR)

You have the right to:

• access, correct or erase your personal data;
• restrict or object to its processing;
• data portability; and
• withdraw consent at any time.

You may also complain to the data protection authority in your country. In the UK this is the Information Commissioner's Office.

United States (including California, CCPA/CPRA)

Where these laws apply to us, you have the right to:

• know what personal data we collect and how we use it;
• have it deleted or corrected; and
• not be discriminated against for exercising your rights.

We do not sell or share personal information as those terms are defined in the CCPA/CPRA, so there is nothing to opt out of. You may use an authorised agent to make a request on your behalf, and we may ask for proof of that authorisation.

14. Grievance Officer

Under the DPDP Act, our Grievance Officer is:

Geddam Praveen Kumar, support@onestop.in Geddam Praveen Kumar (trading as One Stop), Door No 1-2-14/BC/127, Budvel, Rajendranagar, K.V. Rangareddy, Telangana 500030, India

15. Cookies and tracking on the Website

The Website does not use cookies for analytics, advertising or tracking, and does not set non-essential cookies. It does not use analytics tools or third-party tracking scripts.

16. Children

Our products are for businesses. They are not directed at children (under 18 in India), and we do not knowingly collect children's personal data.

17. Changes to this policy

We may update this policy, for example when the App changes. The version number, effective date and "Last updated" date at the top of this page show the current version. If a change materially affects how we handle your personal data, we will tell customers by email before it takes effect.

18. Contact

Questions about this policy, or requests about your personal data:

• Email: support@onestop.in
• Post: Geddam Praveen Kumar (trading as One Stop), Door No 1-2-14/BC/127, Budvel, Rajendranagar, K.V. Rangareddy, Telangana 500030, India