Last updated: 6 September 2026
Opsetu ("Opsetu", "we", "us", "our") is a multi-tenant software-as-a-service platform operated by [Registered Legal Entity Name — to be inserted], registered in India under GSTIN [GSTIN — to be inserted], with its registered office at [Registered Address — to be inserted].
Opsetu gives Indian retail and D2C businesses ("Tenants," "you," if you're a business using Opsetu) a set of operating tools — marketplace order management, returns handling, AI-assisted product design, and (as a Tenant adds them) warehouse, accounts, advertising, WhatsApp messaging, and related modules — delivered as one platform accessible via web, mobile app, and API.
This policy covers:
It describes two different kinds of personal data: data about Tenants (the business owners and staff who sign up for and run Opsetu), and data about a Tenant's own customers (shoppers who buy from a Tenant's storefront, or message a Tenant's WhatsApp number). Section 5 explains why that distinction matters.
| Category | What it includes | Why we collect it |
|---|---|---|
| Account & identity | Phone number (verified via Firebase Phone Auth SMS OTP at registration), name, an optional TOTP secret if you enable two-factor authentication | Registration is mandatory before any trial or paid access; TOTP is an optional secondary factor you can turn on for extra account security |
| Business & operational data | Orders, inventory, invoices, marketplace listings, returns/RTO records, design assets you generate, advertising campaign data, competitive/trend data you track | This is the substance of the service — Opsetu exists to help you manage it |
| Billing data | Subscription plan, invoice history, payment status. Card and UPI details themselves are handled directly by Razorpay, our payment processor — Opsetu does not store your card number | To run your trial, bill your subscription, and issue GST-compliant invoices |
| Connected third-party accounts | OAuth access tokens for marketplace, advertising, or messaging accounts you choose to connect (e.g. Amazon Ads, Facebook/Instagram Ads, WhatsApp Business) — stored encrypted, scoped to your account only | So Opsetu can act on your behalf on platforms you've explicitly authorized, and only those |
| Your storefront's own shoppers | If you run a storefront on Opsetu: your customers' accounts, carts, orders, and reviews | To power the storefront you're operating — this data belongs to you as the Tenant; see Section 5 |
| WhatsApp conversations | Messages sent and received through an Opsetu-connected WhatsApp Business number, including any automated replies from the built-in assistant | To deliver the WhatsApp messaging feature and support your conversations with your customers |
| Usage & metering data | Orders synced, assets generated, API calls made, seats used | To enforce your plan's limits and prompt an upgrade when you're close to them |
| Technical data | IP address, device and browser information, access logs | Security, fraud prevention, debugging, and keeping the service reliable |
For your own account and billing data (phone number, name, subscription, invoices), Opsetu is the data controller — we decide why and how it's processed, and this policy governs it directly.
For the business data you put into Opsetu — your orders, your customers' storefront accounts, your WhatsApp conversations, your connected marketplace data — you are the data controller and Opsetu is the data processor. We process it only to provide the service to you, under your instructions (the features you turn on and the accounts you connect). If one of your own customers wants their storefront data deleted, that request should generally go to you as the business they bought from; we'll support you in fulfilling it. See Section 9 for how deletion actually works on our side.
Opsetu is built on a three-tier data isolation model, specifically so that platform-level data, your business operations, and your own customers' storefront data don't sit in the same place:
Third-party developer credentials (the app-level keys Opsetu uses to talk to Meta, Google, Amazon, and similar platforms — not your personal login to those platforms) are held in an encrypted credential vault, separate from the OAuth tokens tied to your specific account.
Data is hosted on infrastructure located in India.
You can request to access, correct, export, or delete your personal data, and withdraw consent for optional features like TOTP or promotional messages. See our Data Deletion page for how to submit a deletion request, including for data connected via a third-party platform login. Some data (like tax invoices) may need to be retained even after a deletion request, as described in Section 8.
No system is perfectly secure. If we become aware of a data breach affecting your account, we'll notify you in line with applicable Indian law.
Opsetu is a business tool intended for adults operating a business. It is not directed at children, and we don't knowingly collect personal data from anyone under 18. If you believe a child's data has been submitted to us, contact us using Section 14 and we'll remove it.
Opsetu's own infrastructure is hosted in India. Some service providers we rely on for specific features — for example, Google/Firebase for phone verification, or Meta for WhatsApp messaging — may process data outside India as part of delivering that feature. We only use providers with their own data protection commitments in place.
We may update this policy as the platform evolves. We'll update the "Last updated" date above, and for material changes, we'll make a reasonable effort to notify active Tenants directly (email, WhatsApp, or an in-app notice).
Questions about this policy, or a data request: privacy@opsetu.com
Opsetu · opsetu.com · Terms of Service · Data Deletion