Privacy Policy

TUSGLOBAL TECHNOLOGIES (OPC) PRIVATE LIMITED, registered in Kerala, India, with its registered office at 1st Floor, No.30/584/F, Chalakudi, Behind PWD Rest House, Thrissur, Kerala 680307, India, operates the Service.

We collect the following categories of information:

• Account information: name, email address, hashed password, and role (Admin/Owner/Staff) for Authorized Users; Agency name and business type.
• WhatsApp Business Account (WABA) connection details: the WABA ID, phone number ID, and access token associated with each Agency’s connected WhatsApp Business Account. Access tokens are encrypted at rest and are never displayed in the app or shared with anyone other than Meta, as needed to send and receive messages on the Agency’s behalf.
• Contact information submitted by Agencies: names, phone numbers, and consent status/timestamp for the parents/guardians an Agency chooses to message through the Service.
• Message content: the text of WhatsApp messages sent and received through the Service, kept as a shared inbox and audit trail for the Agency.
• Usage and technical information: log-in timestamps and basic technical/error logs needed to operate and secure the Service.
• Cookies: we use a single essential session cookie to keep you signed in. We do not currently use advertising or third-party analytics cookies.

We use the information described above to:

• provide, maintain, and secure the Service;
• authenticate Authorized Users and manage accounts (including sending account activation and password-reset emails);
• send and receive WhatsApp messages on behalf of Agencies via the WhatsApp Business Platform;
• track message delivery status and consent status as part of the Service’s functionality;
• respond to support requests;
• comply with legal obligations and enforce our Terms of Service.

We do not sell personal data, and we do not use Contact data for our own marketing purposes.

For Authorized User account information (see 2(a) above), TUS Global acts as the data controller/fiduciary.

For Contact information and message content submitted by an Agency, the Agency is the data controller/fiduciary, and TUS Global processes that data as a service provider/processor, strictly on the Agency’s instructions and solely to provide the Service (for example, sending the messages the Agency composes, and tracking delivery and consent status). Agencies are responsible for ensuring they have a lawful basis, including valid consent, before submitting Contact information to the Service.

We share information only as necessary to operate the Service:

• Meta Platforms, Inc. (WhatsApp Business Platform): message content and Contact phone numbers are transmitted to Meta’s WhatsApp Business Platform in order to send and receive messages, since each Agency’s WhatsApp Business Account operates on Meta’s infrastructure.
• Email delivery provider (Resend): used to send account activation and password-reset emails.
• Hosting and infrastructure providers: used to host the Service and its database.
• Legal and safety: we may disclose information if required by law, legal process, or to protect the rights, property, or safety of TUS Global, our Agencies, or others.

We do not otherwise sell, rent, or share personal data with third parties for their own marketing purposes.

We use technical and organizational measures designed to protect personal data, including encrypting WhatsApp access tokens at rest (AES-256-GCM), transmitting data over HTTPS/TLS, hashing passwords, and restricting database access. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

We retain personal data for as long as an Agency’s account remains active and as needed to provide the Service, and for a reasonable period afterward to comply with legal, accounting, or dispute-resolution needs. Agencies may request deletion of their account and associated data by contacting support@tusglobal.tech, subject to any retention we are legally required to maintain.

The Service itself is intended for use by adult Authorized Users on behalf of travel/tourism Agencies. The Contacts an Agency messages through the Service (for example, parents or guardians of student travelers) are themselves adults; the Service is not designed to collect information directly from children. Agencies are responsible for ensuring their use of the Service in connection with trips involving minors complies with applicable law.

Our infrastructure and some of our service providers (including Meta) may process data outside India. Where we transfer personal data internationally, we take reasonable steps to ensure it continues to be protected consistently with this Policy and applicable law.

Depending on applicable law (including India’s Digital Personal Data Protection Act, 2023, and, where relevant, other data protection laws), you may have rights to access, correct, or request erasure of your personal data, to withdraw consent, or to raise a grievance about how we handle your data. To exercise these rights or raise a concern, contact us at support@tusglobal.tech, which also serves as our grievance contact.

We may update this Privacy Policy from time to time. If we make material changes, we will provide reasonable notice (such as by email or an in-app notice) before the changes take effect.

If you have questions about this Privacy Policy or our data practices, contact us at support@tusglobal.tech. See also our Terms of Service.

TUSGLOBAL TECHNOLOGIES (OPC) PRIVATE LIMITED
1st Floor, No.30/584/F, Chalakudi, Behind PWD Rest House, Thrissur, Kerala 680307, India