Privacy Policy

Octrackit is a server-side conversion tracking platform (a "Conversions API" or CAPI layer) with a built-in AI filter that identifies and removes junk, spam, and fraudulent leads before conversion events reach advertising platforms. Our business customers ("Customers") connect their websites, forms, and ad accounts to Octrackit so that genuine conversion events are sent server-side to platforms such as Meta, Google Ads, LinkedIn, X (Twitter), and others.

Octrackit also offers an optional WhatsApp Business messaging module. A Customer can connect its own WhatsApp Business number to Octrackit through Meta's WhatsApp Business Platform, so that an AI agent (part of Cortex) can reply to the Customer's end customers, qualify enquiries, and pass qualified leads to the Customer's CRM and connected advertising platforms. Customers can also create message templates and send opt-in messages from Octrackit.

Because Octrackit processes both business account data and end-user lead/event data on behalf of Customers, this policy is written to be clear about which data protection role we play in each situation, and what rights are available to individuals under GDPR and DPDPA.

Octrackit is owned and operated by Octmark Technologies India Private Limited, a company incorporated in India (the "Company," "we," "us," or "our"), which acts as the Data Controller (under GDPR) and Data Fiduciary (under DPDPA) for the personal data described in Section 3.

Our core infrastructure runs on Amazon Web Services (AWS), hosted primarily in AWS's India (Mumbai) region, so personal data is primarily stored and processed in India. Data may also be processed outside India where we share it with sub-processors located elsewhere, as described in Section 9 (International Data Transfers).

We act in two distinct capacities, and different rules apply to each:

• As a Data Processor / Service Provider: when a Customer sends us lead, form, or conversion event data (for example, a website visitor's name, email, or phone number captured through a Customer's ad or landing page) so that we can filter and forward it to advertising platforms, we process that data on the Customer's instructions. The Customer is the Data Controller/Fiduciary for that data and is responsible for having a lawful basis (such as consent) to collect it from their own end users before it ever reaches Octrackit.
• For the WhatsApp module: when a Customer connects its WhatsApp Business number, the Customer is the Data Controller/Fiduciary for the conversations with its end customers, and Octrackit processes those messages as a Data Processor on the Customer's instructions — to receive, store, display, and reply to them, and to create leads from them.
• As a Data Controller / Fiduciary: for data we collect directly — such as Customer account, billing, and dashboard-user information, and data collected through this website (octrackit.com) — we determine the purposes and means of processing and are directly responsible under GDPR and DPDPA.

If you are an end user whose data was submitted to Octrackit through a form, ad, or landing page operated by one of our Customers, your primary point of contact for exercising privacy rights is that Customer (the business you interacted with). We will support and forward verified requests to the relevant Customer, and will also action requests directly where required by law.

We collect and process the following categories of data:

• Customer account data: name, work email, company name, role, phone number, billing and payment details, and login credentials for users who create an Octrackit account.
• Lead and conversion event data (processed on behalf of Customers): names, email addresses, phone numbers, IP addresses, device and browser identifiers, form field values, page/UTM and campaign data, event timestamps, and conversion values submitted through a Customer's connected forms, websites, or ad platforms. Our standard integrations (pixel and native CRM connections) are built to receive identity fields such as name, email, and phone already hashed (SHA-256) by the sender before they reach us, rather than in raw, readable form. Where a Customer integrates using their own custom code, that Customer is responsible for applying the same hashing before sending data to Octrackit.
• WhatsApp messaging data (processed on behalf of Customers): where a Customer uses the WhatsApp module, we process the phone numbers and WhatsApp profile names of the Customer's end customers, the content of messages exchanged with them (text and any media such as images, documents, or voice notes), message timestamps, delivery and read statuses, message template content, and, where a conversation starts from a Click-to-WhatsApp ad, the ad referral data that Meta provides (such as the ad, campaign, and click identifiers). We also store the Customer's WhatsApp Business Account and phone number identifiers and the access tokens needed to operate the integration.
• AI lead-quality signals: derived metadata our AI filter generates about a lead (for example, a spam/quality score, duplicate-detection flags, or pattern-based fraud indicators). These are generated from the lead data above and are not separately collected from individuals.
• Website visitor data: data collected when you browse octrackit.com or contact us directly, such as your email address (if you email us), IP address, and basic browser/device information collected via essential cookies (see Section 15).

We do not intentionally collect special category data (such as health, biometric, or religious information) and ask Customers not to submit such data through Octrackit.

Octrackit's AI filter (internally called "Cortex") reviews incoming lead and conversion event data to flag likely spam, duplicate, bot-generated, or fraudulent submissions before genuine events are forwarded to advertising platforms. It works by scoring signals already present in the submitted data (for example, identity-consistency patterns, submission velocity, and known abuse patterns) — it does not scrape additional personal data from outside sources to make this determination.

This lead-quality scoring runs on our own infrastructure using a proprietary machine learning model that we host ourselves. Lead and conversion data is not sent to third-party AI or large-language-model providers for this scoring.

WhatsApp AI agent. Where a Customer enables the WhatsApp module, Cortex also includes a conversational AI agent that drafts and sends replies to the Customer's end customers. To generate those replies, the relevant message history, the Customer's business information, and the Customer's knowledge base are sent to the large-language-model (AI) provider that the Customer selects in Octrackit, acting as our sub-processor. Customers choose one of the following providers:

• Anthropic, PBC (Claude API), United States;
• OpenAI, L.L.C. (OpenAI API), United States;
• Google LLC (Gemini API), United States.

Data is sent only to the provider the Customer has selected. We use each provider's business API terms, under which the data is used only to generate the response and is not used to train the provider's models. We will update this list before we make any other provider available. Customers can switch the AI agent off, pause it for any conversation, or take over a conversation manually at any time, and conversations are not used to train any model other than with the Customer's agreement.

This filtering can affect whether a lead is forwarded as a "genuine" conversion event to an advertising platform. Where this qualifies as automated decision-making with a legal or similarly significant effect under GDPR Article 22, our Customers (as Controllers) remain responsible for offering end users a way to contest a filtering outcome or request human review through their own channels; Octrackit provides the underlying tooling (including manual override options) that lets Customers do so. You may also contact us directly at admin@octrackit.com to request information about a filtering decision that involved your data.

Under GDPR, we (or our Customers, where they are the Controller) rely on:

• Contract — to provide the Octrackit service to Customers and manage their accounts.
• Legitimate interests — to filter spam and fraudulent leads, secure our platform, and improve service quality, balanced against individual rights.
• Consent — where a Customer's own website or ad collects lead data based on end-user consent (for example, a marketing opt-in), that consent is obtained and managed by the Customer.
• Legal obligation — where processing is required to comply with applicable law, such as tax or accounting rules.

Under DPDPA, we process personal data on the basis of consent obtained by our Customers from their end users (for lead/event data), and on the basis of certain legitimate uses recognized under the Act (such as for the specified purpose for which a data principal has voluntarily provided their data) for our own direct account and website interactions.

• Filtering, scoring, and forwarding conversion events to advertising platforms connected by a Customer.
• Receiving, storing, and displaying WhatsApp messages for a Customer, generating AI-assisted replies, sending template messages the Customer chooses to send, and creating leads from conversations.
• Operating, maintaining, and securing the Octrackit platform and Customer dashboards.
• Providing customer support and responding to inquiries.
• Billing, invoicing, and fraud/abuse prevention on our own platform.
• Improving the accuracy of our AI lead-filtering models, using aggregated or de-identified data wherever feasible.
• Complying with legal obligations, and establishing, exercising, or defending legal claims.

We do not sell personal data, and we do not use lead data processed on behalf of Customers for our own independent marketing purposes.

We share data with a limited set of third parties strictly to operate the service. As of the effective date above, these include:

• Advertising platforms to which a Customer connects Octrackit, for server-side conversion event delivery — currently live for Meta (Facebook) Conversions API and Google Ads/GA4. LinkedIn Ads, X (Twitter) Ads, Snapchat Ads, and additional advertising platforms are planned but not yet available. Data is only sent to the specific platform(s) a Customer chooses to connect.
• CRM integrations a Customer chooses to connect to Octrackit — currently live for Trello, HubSpot, and Zoho CRM, with additional CRM integrations planned. Data will only flow to a CRM a Customer has explicitly authorized.
• Meta Platforms (WhatsApp Business Platform) — for Customers that connect a WhatsApp Business number, messages and related metadata are sent and received through Meta's WhatsApp Business Platform (Cloud API). Meta's own terms and privacy policy apply to its processing.
• AI providers — Anthropic, PBC (Claude API), OpenAI, L.L.C. (OpenAI API) and Google LLC (Gemini API), used to generate AI replies for the WhatsApp module. Only the provider a Customer selects receives that Customer's data, and these providers do not use it to train their models (see Section 5).
• Cloud infrastructure providers — currently Amazon Web Services (AWS), which hosts our servers and databases under contractual data protection terms.
• Professional advisors and authorities where necessary to comply with law, enforce our terms, or protect our rights, safety, or property.

This list will change as we add new integrations ahead of and after launch. We will keep this section updated, and Customers may request our current sub-processor list at any time by emailing admin@octrackit.com. Every sub-processor is bound by contractual obligations to protect data at a level consistent with this policy.

Our primary infrastructure is based in India (AWS's Mumbai region), so personal data is primarily stored there. However, because we forward conversion events to advertising platforms and CRMs a Customer connects (Section 8), and those platforms are operated by companies based outside India, personal data may be transferred to and processed in other countries, including the United States, as part of that forwarding. Where a Customer uses the WhatsApp module, messages pass through Meta's WhatsApp Business Platform, and the content needed to generate AI replies is processed in the United States by the AI provider the Customer selects (Anthropic, OpenAI or Google).

For transfers of personal data originating in the EEA/UK, we rely on appropriate safeguards recognized under GDPR, such as the European Commission's Standard Contractual Clauses (SCCs) or an equivalent lawful transfer mechanism, entered into with our sub-processors.

Under DPDPA, cross-border transfer of personal data is permitted except to countries or territories restricted by the Central Government of India by notification. We do not currently transfer data to any jurisdiction so restricted, and will update this section if that changes.

We retain personal data only for as long as necessary for the purposes described in this policy:

• Lead and conversion event data is retained for the period needed to deliver, verify, and reconcile conversion events (typically a rolling window of recent activity), after which it is deleted or anonymized, unless a Customer's contract or applicable law requires a longer period.
• WhatsApp messages and related metadata are retained for 12 months by default, or for a shorter period set by the Customer, after which they are deleted. They are also deleted when a Customer deletes a conversation or closes its account (see Section 14).
• Customer account data is retained for as long as the account is active, and for a limited period afterward to comply with legal, tax, or accounting obligations.
• Website visitor/contact data is retained only as long as needed to respond to and document the relevant inquiry.

Where we no longer need personal data, we securely delete or irreversibly anonymize it.

We apply technical and organizational measures appropriate to the sensitivity of the data we process, including:

• Encryption of data in transit (TLS) and at rest.
• Role-based access controls, so only authorized personnel can access personal data, on a need-to-know basis.
• Isolation of Customer data and logging/monitoring of access to production systems.
• Regular review of our security practices as the platform evolves.

No method of transmission or storage is 100% secure. If you believe your data has been exposed, please contact us immediately at admin@octrackit.com.

If GDPR applies to you, you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erase your data ("right to be forgotten"), subject to legal exceptions.
• Restrict or object to certain processing, including processing based on legitimate interests.
• Data portability, where processing is based on consent or contract and carried out by automated means.
• Withdraw consent at any time, where processing is based on consent.
• Lodge a complaint with your local supervisory authority.

Where your data was submitted through one of our Customers, please contact that Customer first, as they are typically the Controller. You may also contact us directly and we will route your request appropriately.

If you are a Data Principal under India's DPDPA, you have the right to:

• Obtain a summary of the personal data we process about you and the processing activities carried out.
• Request correction, completion, or updating of your personal data.
• Request erasure of your personal data, unless retention is required for a specified purpose or by law.
• Nominate another individual to exercise your rights on your behalf in the event of death or incapacity.
• Withdraw consent at any time, with the same ease with which it was given.
• Register a grievance with us (see Section 19) and, if unresolved, approach the Data Protection Board of India.

You can ask us to delete your personal data at any time:

• End users and end customers (for example, someone who messaged a business on WhatsApp through Octrackit, or whose lead was submitted through a Customer's form): email admin@octrackit.com with the subject "Data deletion request", and include the phone number or email address concerned and the business you interacted with. We will verify the request, notify the relevant Customer, and delete the data from our systems within 30 days, unless we are legally required to keep it.
• Customers can delete individual conversations and leads from within Octrackit, disconnect WhatsApp or any other integration at any time (which immediately stops further processing through it), or request deletion of their entire account and data by emailing admin@octrackit.com.
• Data received from Meta (including WhatsApp and Facebook Login data) is deleted when the Customer removes the integration or deletes its account, and in any case on verified request.

Deletion from backups follows our standard backup rotation and completes within a further 30 days. We will confirm by email once a deletion request has been completed.

octrackit.com currently uses only essential cookies/local storage needed for the site to function (for example, to remember basic display preferences). We do not currently run third-party advertising or analytics cookies on this website. If that changes, we will update this section and, where required, request your consent through a cookie banner before non-essential cookies are set.

Octrackit is a business-to-business platform and is not directed at children. We do not knowingly collect personal data from individuals under the age of 18. If you believe a child's data has been provided to us, please contact us at admin@octrackit.com so we can delete it.

If we become aware of a personal data breach that poses a risk to individuals, we will assess the incident promptly and, where required by GDPR or DPDPA, notify the relevant supervisory authority and affected individuals or Customers without undue delay, together with information about the nature of the breach and steps being taken in response.

If you are an Octrackit Customer, you are responsible for ensuring you have a valid legal basis (such as consent) to collect and share end-user lead and conversion data with us, and for providing your own end users with appropriate privacy notices. On request, we will enter into a Data Processing Agreement (DPA) reflecting the terms of this policy and applicable law. Please contact admin@octrackit.com to request a DPA.

In accordance with the DPDPA, we have designated a Grievance Officer to address questions or complaints regarding this policy or our data practices:

We aim to acknowledge grievances within 7 business days and resolve them within 30 days wherever possible.

We may update this policy as Octrackit's product, integrations, and legal obligations evolve — particularly as we finalize additional advertising platform and CRM integrations ahead of launch. We will revise the effective date above whenever we make changes, and will provide more prominent notice (such as an email or in-product notice) for material changes affecting Customers.

For any question about this policy, to exercise a privacy right, or to report a concern, contact us at: