MS Reach Privacy Policy

1. Who we are

This Privacy Policy explains how Malleable Software Private Limited, CIN U93000PN2021PTC198819, with its registered and operating office at Flat No. 302, Korgaonkar Park, Saraswati Nagar, Gadhinglaj, Maharashtra 416502, India. ("Malleable Software", "we", "us" or "our") handles personal data relating to the MS Reach website, orders, licences, desktop application, support and associated communications.

Privacy requests: privacy@msreach.in. Grievances: Omkar Vinayak Mujumdar, Grievance Officer / Privacy Contact, grievance@msreach.in, +91 97665 50068, at the address above.

2. Scope and roles

This Policy applies to website visitors, prospective customers, purchasers, authorised users and people who contact us. Business customers determine the recipients, content and purpose of communications sent with MS Reach and are responsible for the legality of those activities.

MS Reach is intended for lawful use by businesses, agencies and authorised professionals communicating with recipients who have provided valid consent. It is not intended for spam, unlawful scraping, ban circumvention or unauthorised platform access.

3. Personal data we collect

• Identity and contact information, including name, business name, email, telephone number and billing address.
• Account, order and licence information, including product term, order status, licence key, activation status and support history.
• Transaction information, including amounts, currency, invoice and refund records, and payment status. Payment credentials are handled by the payment provider selected at checkout and are not stored by Malleable Software.
• Technical information may include IP address, device or licence identifier, operating-system and application version, activation timestamps, security events and diagnostics. Technical collection is limited to information reasonably necessary for licensing, security, support and product operation.
• Website information, including browser, device, pages viewed, referring URL, approximate location and cookie identifiers where enabled.
• Support and communication content, including issue descriptions, attachments and correspondence voluntarily provided.

4. Product data and AI chatbot

Contacts, numbers, messages, images, groups, labels, chats and CSV files remain on the customer’s device, except data the customer deliberately sends to an enabled third-party service. Malleable Software does not intentionally collect customer message content through the desktop application unless the customer sends it to support.

When the customer enables the AI chatbot, prompts and necessary conversation context are sent from the desktop application to OpenAI using the customer-supplied API key. Conversation logs are stored on the customer’s device, and Malleable Software does not store them. Customers are responsible for protecting their API keys and device access.

5. How we use personal data

• Process purchases, create accounts, issue and administer licences and provide downloads.
• Provide updates, troubleshooting, support and service communications.
• Authenticate devices and licences; prevent fraud, security incidents, licence abuse and unlawful use.
• Operate, secure and improve the website and software using appropriately limited information.
• Maintain accounting, tax, legal and dispute records and comply with applicable law.
• Send marketing communications only where permitted and honour unsubscribe requests.

6. Legal basis and consent

We process personal data where necessary to perform or prepare a contract, comply with legal obligations, protect rights and security, conduct permitted business operations, or on the basis of valid consent or another lawful ground. Where consent applies, it may be withdrawn by contacting privacy@msreach.in; withdrawal does not affect earlier lawful processing.

7. Sharing and service providers

We may share limited data with providers supporting website hosting, content delivery, WooCommerce, payments, email, licensing, security, analytics, customer support, accounting and professional advice. Service providers receive only the information reasonably required to perform their functions.

We may also disclose information where required by law, court order or regulatory process; to investigate fraud or abuse; to protect rights and safety; or in connection with a genuine business reorganisation. We do not sell contact lists or personal data.

8. Cookies

The website may use necessary WooCommerce, session, security, hosting and consent cookies. Analytics, advertising pixels, chat widgets, embedded media and other non-essential technologies must be identified through a production-site scan and, where required, used only after valid consent. See the separate Cookie Policy.

9. Retention

• Customer accounts: while active and for 24 months after closure, unless longer retention is required.
• Orders, invoices and payment records: eight financial years or a longer period required by applicable tax and accounting law.
• Support tickets: 24 months after closure, or longer for an active dispute or legal duty.
• Security/server logs: normally 90 days; analytics information is normally retained for up to 14 months, subject to provider settings and legal requirements.
• Licence/device records: licence term plus 24 months.
• Marketing consent and suppression records: relationship duration plus three years after opt-out.
• Backups: encrypted website backups may be maintained by the hosting provider and accessed only by authorised Malleable Software personnel for recovery and security purposes.

10. Security and incidents

We use reasonable safeguards include HTTPS, restricted administrative access, patched WordPress components, protected secrets, malware/firewall monitoring, encrypted backups, logging and incident response. Safeguards are reviewed and adjusted as risks and services change.

Report suspected incidents to security@msreach.in. We aim to begin assessment within 24 hours and will notify affected persons and authorities within periods required by applicable law.

11. Your rights

Depending on applicable law, you may request access, correction, updating or deletion, withdraw consent, opt out of marketing, and seek grievance redressal. Portability or objection requests will be handled where applicable law provides the right.

Send requests to privacy@msreach.in. We may verify identity using the registered email and relevant order/licence details. We will never ask for passwords, OTPs or full card details.

12. Children, platforms and international processing

MS Reach is for users aged 18 or older who can enter a binding business contract. It is not directed to children.

WhatsApp, Meta, OpenAI and other services are independent third parties governed by their own terms and privacy practices. MS Reach is not affiliated with, sponsored by or endorsed by WhatsApp or Meta.

Providers may process data outside the user’s state or country. Appropriate safeguards and applicable transfer requirements will be followed.

13. Changes and contact

We may update this Policy prospectively for legal, product, security or vendor changes. The effective date will be updated and additional notice or consent provided where required.

Contact: privacy@msreach.in or Malleable Software Private Limited, Flat No. 302, Korgaonkar Park, Saraswati Nagar, Gadhinglaj, Maharashtra 416502, India. Grievance complaints will be acknowledged within 48 hours and substantively answered within 30 days, subject to applicable law.