Privacy Policy

WebContact is a Form Backend as a Service (FBaaS) platform operated in India. Under the Digital Personal Data Protection Act, 2023, WebContact acts as a Data Fiduciary when processing personal data of users who sign up or use our services, and as a Data Processor when processing form submission data on behalf of our customers (developers and agencies).

Registered correspondence address: WebContact, India | Email: webcontactsupport@vrtex.in

We collect the following categories of personal data:

We process your personal data for the following purposes:

• To create and maintain your WebContact account
• To authenticate you securely via Google OAuth
• To provide the dashboard and API services
• To generate API tokens and manage project configurations
• To process and store form submissions on your behalf
• To detect spam, abuse, and security threats
• To send service-related notifications and support responses
• To comply with legal obligations under Indian law
• To improve the platform through aggregated, anonymized analytics

We process your data based on the following legal grounds:

• Consent: By creating an account, you consent to the processing described in this policy.
• Contractual Necessity: To provide the services you have requested.
• Legitimate Interests: For security monitoring, fraud prevention, and platform improvement.
• Legal Obligation: Where required by Indian law or regulatory authority.

You may withdraw consent at any time by deleting your account. Withdrawal of consent does not affect the lawfulness of processing prior to withdrawal.

Under the Digital Personal Data Protection Act, 2023, you have the following rights:

To exercise any of these rights, contact us at: webcontactsupport@vrtex.in

We retain personal data only for as long as necessary for the stated purposes:

• Account data: Retained for the duration of account activity and up to 90 days after deletion.
• Form submission data: Retained for the duration of the customer's active subscription.
• Usage logs and API logs: Retained for 90 days for security and debugging.
• Billing records: Retained for 7 years as required by Indian tax law.

After the retention period, data is securely deleted or anonymized.

WebContact implements the following security measures:

• All data is encrypted in transit using TLS 1.3
• API tokens are stored as cryptographic hashes (never in plaintext)
• Access to production databases is restricted to authorized personnel only
• Row-Level Security (RLS) is enforced at the database level — each user can only access their own data
• Google OAuth 2.0 is used — WebContact never stores your Google password
• Regular security audits and dependency vulnerability scanning

In the event of a personal data breach that is likely to result in high risk to you, we will notify the Data Protection Board of India within 72 hours and inform you without undue delay, as required under the DPDP Act, 2023.

WebContact uses minimal, essential cookies only:

• Authentication cookies: Set by our authentication provider to maintain your login session. These are strictly necessary and cannot be disabled.
• We do not use advertising, tracking, or behavioral analytics cookies.
• We do not share data with advertising networks.

We use the following sub-processors to operate the platform:

Some of our sub-processors may store or process data outside India. We ensure that any cross-border transfer of personal data complies with the DPDP Act, 2023 and is only made to countries or entities that provide adequate protection for personal data, or under appropriate contractual safeguards.

WebContact is not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If we become aware that we have inadvertently collected personal data from a child, we will delete it promptly. If you believe a child has provided us personal data, contact us at webcontactsupport@vrtex.in.

WebContact is designed to comply with the Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023), India. Specifically:

• We collect only minimum necessary personal data (data minimization principle).
• We obtain clear and informed consent before processing personal data.
• We provide a mechanism for Data Principals to exercise their rights (access, correction, erasure, grievance).
• We have appointed a Grievance Officer accessible at webcontactsupport@vrtex.in.
• We maintain a record of processing activities.
• We implement technical and organizational security measures appropriate to the risk.
• We notify the Data Protection Board of India and affected Data Principals in the event of a breach as required by Section 8(6) of the DPDP Act.
• We do not process personal data for purposes other than those for which consent was obtained.
• We erase personal data when the purpose of processing is fulfilled or consent is withdrawn.

We may update this Privacy Policy from time to time. When we make material changes, we will notify you via email or by displaying a prominent notice in the dashboard. The updated policy will always be available at webcontact.vrtex.in/privacy. Your continued use of the platform after such changes constitutes acceptance of the updated policy.

For any questions, concerns, or requests related to this Privacy Policy or your personal data, please contact us: