Privacy Policy
What we collect, why, and how to make a request.
Kulli & Co. runs marketing and payments for the site itself and for merchants on Kulli Stores. Six services process data on our behalf. This page is a full, plain-English inventory — no dark patterns, no accordions hiding items, no “essential cookies only” euphemisms.
Last updated: 2026-09-29 · Effective: 2026-09-29
Services that process your data
Meta Pixel
- Why
- Attribute ads on Facebook and Instagram to actual site visits. Powers the Click-to-WhatsApp campaign kill/scale decisions.
- What
- Pixel ID 1998161097540727 fires PageView on every route and a Lead event on WhatsApp CTA clicks. Meta may add its own cookies (`_fbp`, `_fbc`) alongside these events.
- Retention
- Meta stores event data for up to 2 years per its ads-signals policy. Kulli & Co. only reads aggregate counts through the Ads API.
- Their policy
- Meta Privacy Policy
Google Analytics 4
- Why
- Understand which pages get traffic and which channels bring it (organic, direct, referral).
- What
- GA4 property `G-...` receives page views, session start, and CTA clicks. IP is anonymised at collection (`anonymize_ip: true`). No Google Signals, no ad personalisation.
- Retention
- GA4's default 14-month event retention. We do not extend beyond that.
- Their policy
- Google Privacy Policy
Chatwoot (self-hosted)
- Why
- Store inbound WhatsApp messages and site-chat threads on our own droplet so we can reply within one business day.
- What
- Runs at chatwoot.kulli.co on a DigitalOcean Bangalore droplet. Stores the message body, sender number or email, timestamps, and any labels our team applies.
- Retention
- Kept for the duration of the merchant relationship plus 12 months, then hard-deleted from the droplet. No third-party sub-processor sees this data — the droplet is the only host.
WhatsApp Business Cloud API (Meta)
- Why
- Deliver conversations initiated by Click-to-WhatsApp ads and by merchants who tap the WhatsApp button on the site.
- What
- Business number +91 74835 08769. Meta stores message content on its servers as part of delivering the API; Chatwoot pulls it into our droplet within seconds. Media (images, PDFs) are stored on Meta and mirrored to the droplet on receipt.
- Retention
- Meta retains delivered messages for up to 90 days (per its Business Messaging policy). Our droplet copy follows the Chatwoot retention above.
- Their policy
- WhatsApp Business Messaging Policy
Razorpay
- Why
- Process merchant setup fees and monthly subscriptions. Payment card details never touch our servers.
- What
- Payer name, email, phone, and amount are passed to Razorpay via a hosted Payment Link or Payment Page. Card, UPI, or wallet details are captured only on Razorpay's own PCI-DSS-compliant surfaces.
- Retention
- Razorpay stores transaction records for the seven years RBI requires. We hold the confirmation reference and receipt in our own records for the same period.
- Their policy
- Razorpay Privacy Policy
Zoho CRM
- Why
- Track leads through the audit → build → live funnel, and log which onboarding artefacts each merchant has received.
- What
- Name, email, phone, business name, notes captured during discovery calls. No payment info. Contacts converted from leads carry the same fields plus their linked deal stage.
- Retention
- Records retained for the duration of the merchant relationship plus 24 months. Data-subject deletion requests processed within 7 days per India DPDP.
- Their policy
- Zoho Privacy Policy
First-party cookies we set
Third-party cookies (Meta’s _fbp, Google’s _ga*) are set by the services listed above and follow their own retention. The list below is what Kulli & Co. itself sets.
| Name | Purpose | Retention |
|---|---|---|
| kulli_admin_token | Holds the operator's admin bearer token for the /admin/* pages after they sign in. Only present for the internal team; a merchant browsing the site never sees this cookie. | Local storage — cleared when the operator signs out. |
| kulli_utm_last | Remembers the last utm_source / utm_campaign a visitor arrived with so the WhatsApp CTA can carry that attribution into the message. | 30 days. |
Your rights under India DPDP 2023
- Access. You can ask for a copy of what we hold about you.
- Correction. If a record is wrong, we’ll fix it.
- Deletion. You can ask us to hard-delete your data. We keep transaction records the length RBI requires (seven years for payments); everything else goes.
- Portability. We’ll export what you hold as JSON if you’d rather move it to another provider.
- Withdraw consent. Unsubscribe from marketing at any time and we’ll stop.
SLA: We reply to every data request within 7 days. Requests go to nikshep@kulli.co. Please write “Data request” in the subject so it routes correctly.
Grievance officer
Nikshep Kulli · nikshep@kulli.co · other ways to reach us
Per India DPDP 2023 §32 · office based in Bengaluru, Karnataka.