MessagePilot
Privacy Policy
This policy explains what personal data MessagePilot handles, why, who else is involved, how long it is kept and how to exercise your rights. Cashmint Solution Private Limited (“MessagePilot”, “we”) is responsible for it. Privacy contact: support@cashmint.in.
1. Two kinds of people, two roles
Customers and their team members sign up and use MessagePilot. For their account data we decide how it is used (we are the controller or data fiduciary).
Recipients are the people our customers email or message. They do not have a MessagePilot account. A customer business decides whom it contacts and why, and we process recipient data on that business’s instructions (we act as its processor). If you received a message sent through MessagePilot, the business named in it is the right first contact for questions about your data. We will help it respond, and you can also write to us.
2. Business account data
| What | Why |
|---|---|
| Name, email address, password (stored only as a salted hash), workspace and company name, team memberships, roles and invitations | To create and secure accounts and let a business manage its team |
| Plan, usage counts and billing records (order and payment references from our payment processor; we do not receive full card numbers) | To provide paid plans, enforce allowances and keep accounting records |
| Credentials for email providers you connect (encrypted with a key held in AWS Key Management Service) | To send email from your own account on your behalf |
| Sending domains you add, the DNS verification record we ask you to publish, and when it was checked | To confirm which business controls a domain, so no other business can send from it |
| Password-reset requests (a one-time token stored only as a hash, valid for 30 minutes, and the IP address of the request) | To let you recover your account securely |
| Audit records of significant actions (who changed what, when), and technical logs | Security, troubleshooting and investigating abuse |
We use account email addresses to send service messages such as password-reset emails. We do not sell personal data or use customer or recipient data for our own advertising.
3. Recipient data we process for our customers
Customers upload or collect contacts. Depending on what a customer chooses to store, this can include email address, name, phone number, custom fields, list and segment membership, subscription status, WhatsApp consent status with its time and source, and submissions to sign-up forms the customer publishes.
Consent records. For each person a customer adds, we record how they agreed to receive marketing email from that business: the customer’s statement for contacts added by hand or imported, who made it and when; and for our sign-up forms, the form’s wording, the time, the IP address and browser user agent of the submission, and whether the person confirmed by email. When someone unsubscribes we record that too. These records belong to the business they concern. We use it only to provide the Service to that customer: storing it, sending the customer’s messages, recording outcomes and honouring opt-outs. Each customer’s contacts are kept in its own workspace and are not used for any other customer.
4. Message content, delivery events and engagement
- Content: the subjects, bodies, templates and files a customer creates or sends.
- Sending records: per-recipient send status, timestamps, and error responses from the sending provider.
- Engagement: when a customer’s email includes our tracking, opening the email (an image load) or clicking a link records the recipient’s address, the time, the IP address and browser user agent, and for clicks the link. Image blocking and privacy features in mail apps can prevent or distort this, and some security systems open messages automatically.
- WhatsApp: for each WhatsApp message, the recipient number, template, delivery status reported by WhatsApp, and timestamps. Values filled into templates are stored with the message. One-time codes are not.
- Our own emails: for emails MessagePilot sends to account holders (such as password resets), delivery, bounce and complaint notifications from Amazon SES.
5. Unsubscribes and suppression records
When someone unsubscribes, hard-bounces or complains, we keep the address and the reason so we can stop further sending. The unsubscribe link in each email names the business that sent it, so the opt-out applies to that business. An opt-out through an older link that does not name a business is applied to all businesses on MessagePilot, so that the person’s choice is respected. For MessagePilot’s own emails, addresses that hard-bounce or complain are not emailed again.
6. Providers we use
| Provider | Purpose |
|---|---|
| Amazon Web Services | Hosting, database, background sending infrastructure, encryption keys, and Amazon SES for MessagePilot’s own account emails |
| Razorpay | Payment processing for paid plans |
| ChatServe, and Meta (WhatsApp Business Platform) | Delivering WhatsApp messages and their status updates |
| Email providers chosen by a customer (for example Google Workspace, Microsoft 365 or another SMTP service) | Sending that customer’s email from its own account. These providers process messages under their own terms with the customer |
| Google Fonts, cdnjs and unpkg | Fonts and page scripts loaded by your browser on some of our pages, which receive your IP address when they do |
Planned, not yet in use: we are building a route that would send customers’ email through Amazon SES operated by MessagePilot, instead of through a provider the customer connects. It is switched off, and no customer email is sent through it. Before it is switched on we will update this policy.
7. Where data is stored
Our application and database run on Amazon Web Services in the Asia Pacific (Mumbai) region. Some providers above, including email providers a customer chooses, Meta and our browser-side services, may process data in other countries under their own safeguards.
8. How long we keep data
| Data | Kept |
|---|---|
| Account and workspace data | While the account is open. When an account is closed at the customer’s request, we delete or anonymise its data on that request |
| Contacts, consent records, campaigns, message content, sending records and engagement events | Until the customer deletes them or asks us to close its account |
| Unsubscribe and suppression records | For as long as needed to keep honouring the opt-out |
| Billing records | As long as tax and accounting law requires |
| Database backups | Automated backups are kept for 7 days, then replaced |
We do not currently delete any of this data automatically on a schedule. Customers can delete individual contacts in the Service. To have a whole workspace or account deleted, write to support@cashmint.in. We will delete or anonymise its data, except what we must keep by law or to keep honouring opt-outs. Deleted data leaves backups as they expire.
9. Security
- The site is served over HTTPS. Plain HTTP is redirected. Session cookies are sent only over HTTPS and are not readable by page scripts.
- Passwords and password-reset tokens are stored only as hashes. Credentials for connected email providers are encrypted with a key held in AWS Key Management Service.
- The database is not reachable from the public internet. Within a workspace, access depends on each member’s role, and significant changes are recorded in an audit log.
- Links that let someone reset a password expire after 30 minutes and work once.
No system is perfectly secure. If we become aware of a breach affecting your personal data, we will notify you and the relevant authorities as the law requires.
10. Your rights and how to contact us
Depending on where you live, you may have the right to access, correct, delete or obtain a copy of your personal data, to withdraw consent, to object to or restrict certain processing, to nominate someone to act for you, and to complain to a data protection authority. Account holders can make most changes in the Service. For anything else, write to support@cashmint.in. We will confirm your identity before acting and reply within the time the law requires. If you are a recipient, we may pass your request to the business that sent you the message, because it decides how your data is used.
Grievance officer: Abhijeet Chitransh, Cashmint Solution Private Limited, G-14, Flat 2206, Nirala Greenshire, Greater Noida West, Uttar Pradesh 201318, India. Email support@cashmint.in, phone +91 99531 83864.
11. Cookies
We use a session cookie to keep you logged in, and it is necessary for the Service to work. We do not use advertising or analytics cookies. Our payment processor’s checkout, loaded only when you pay, may set its own cookies.
12. Changes
We will post changes here and update the effective date. If a change materially affects how we use your data, we will tell account holders in the Service or by email before it takes effect.