Privacy Policy

This Privacy Policy explains how Shijoy Sreedhar M K, trading as GO Kodex ("GO Kodex", "we", "us" or "our"), collects, uses, shares and protects personal data when you visit our website, contact us, or engage us for services.

We follow the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 ("DPDP law"), and the Information Technology Act, 2000 with the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

1. Who we are

For personal data we collect for our own purposes, GO Kodex is the "Data Fiduciary" under DPDP law. You can reach us at:

2. Personal data we collect

We do not ask for sensitive personal data such as passwords, bank account or card details, health information or biometric data through our website. Please do not send such information in an enquiry.

3. Why we use your personal data

• To respond to your enquiry and discuss your requirements.
• To prepare proposals, deliver services, provide support and communicate about a project.
• To raise invoices, maintain accounts and meet tax, legal and regulatory obligations.
• To keep our website and systems secure and to prevent misuse.

We process personal data on the basis of your consent, or for legitimate uses permitted under DPDP law — for example, where you have voluntarily provided the data for a specific purpose, or where processing is needed to comply with law. We do not sell your personal data and we do not use it for unrelated marketing without your consent.

4. Consent and withdrawal

When you submit our contact form you consent to us using your details to respond to your enquiry. You may withdraw your consent at any time by emailing info@gokodex.com. Withdrawal does not affect processing already carried out, or data we must keep by law.

5. Who we share personal data with

We share personal data only where needed, with:

• WhatsApp and Instagram (Meta Platforms) — if you choose to send your enquiry through WhatsApp or Instagram, it is subject to Meta's own privacy policies. GO CRM and Comment to DM also send and receive data through Meta's platforms, as described in sections 7 and 8.
• Service providers who help us operate, such as email, form delivery, call scheduling, website hosting, cloud storage and accounting providers, under appropriate confidentiality obligations.
• Professional advisers such as chartered accountants and lawyers, where required.
• Government or law enforcement authorities where we are required to by law, court order or a lawful request.

6. Data we handle on behalf of our clients

When we implement ERP, CRM, integrations or custom software, we may access or process personal data held in our clients' systems (for example, their customers' or employees' details). In that role we act as a "Data Processor" on behalf of our client, who remains the Data Fiduciary. We process that data only to deliver the agreed services, on our client's instructions and under our contract with them. If your data is held by one of our clients, please contact that business directly to exercise your rights.

7. GO CRM and the WhatsApp Business Platform

GO CRM is our customer messaging product. A client connects its own WhatsApp Business Account to GO CRM so that its team can send, receive and manage WhatsApp conversations with its customers. GO CRM uses the WhatsApp Business Platform provided by Meta Platforms.

When a client connects its account, GO CRM receives and stores:

How we handle this data:

• We act as a Data Processor for the client. The client remains the Data Fiduciary for its customers' data and decides how it is used.
• We use the data only to provide GO CRM to that client. We do not sell it, use it for advertising, or use it to build profiles of the client's customers.
• We do not share one client's data with another client. We share it only with the service providers that host and operate GO CRM, under confidentiality obligations, or where the law requires.
• Access tokens are stored securely and access is limited to what is needed to run the service.
• A client can disconnect GO CRM at any time from its own Meta Business settings, and can ask us to delete its data. See our Data Deletion page.

Messages sent through WhatsApp are also handled by Meta under its own terms and privacy policy. If you are a customer of a business that uses GO CRM, please contact that business to exercise your rights over your data.

8. GO Kodex Comment to DM and the Instagram API

GO Kodex Comment to DM is our Instagram automation product. A client connects its own Instagram professional account so that, when someone comments on one of its posts or reels with a keyword the client has chosen, Comment to DM can reply to the comment and send that person a direct message. Comment to DM uses the Instagram API provided by Meta Platforms.

When a client connects its account, Comment to DM receives and stores:

How we handle this data:

• We act as a Data Processor for the client. The client remains the Data Fiduciary for data about the people who comment on or message its account, and decides how it is used.
• Logs of comments, replies and messages are kept for 90 days and then deleted automatically.
• We use the data only to provide Comment to DM to that client. We do not sell it, use it for advertising, use it to train artificial intelligence models, or use it to build profiles of the people who comment.
• We do not share one client's data with another client. We share it only with the service providers that host and operate Comment to DM, under confidentiality obligations, or where the law requires.
• Access tokens are stored securely and access is limited to what is needed to run the service.
• A client can disconnect Comment to DM at any time by removing it from its Instagram or Meta Business settings, and can ask us to delete its data. See our Data Deletion page.

Comments and messages on Instagram are also handled by Meta under its own terms and privacy policy. If you commented on or messaged a business that uses Comment to DM, please contact that business to exercise your rights over your data.

9. Transfers outside India

Some of our service providers may store or process data on servers located outside India. Any such transfer is made only as permitted under DPDP law, and not to any country or territory restricted by the Government of India.

10. How long we keep personal data

• Enquiries that do not lead to an engagement: up to 12 months after our last contact.
• Client and billing records: for the duration of the engagement and afterwards for as long as required under applicable tax, accounting and other laws.

When data is no longer needed, we delete it or make it anonymous.

11. How we protect personal data

We use reasonable security practices and procedures appropriate to the nature of the data, including access controls, secure credentials, encryption where available, and limiting access to people who need it for their work. If a personal data breach occurs, we will notify affected individuals and the Data Protection Board of India as required by DPDP law.

12. Your rights

Under DPDP law you have the right to:

• obtain a summary of the personal data we hold about you and how we process it;
• have inaccurate or incomplete personal data corrected, completed or updated;
• have your personal data erased where it is no longer needed or you withdraw consent, subject to legal requirements;
• have your grievances addressed; and
• nominate another person to exercise your rights in the event of your death or incapacity.

To exercise any of these rights, email info@gokodex.com. We may need to verify your identity before acting on a request.

13. Cookies and analytics

Our website currently does not use cookies, analytics or advertising trackers, and our fonts are hosted on our own server. If this changes, we will update this policy and, where required, ask for your consent first.

14. Children

Our website and services are intended for businesses and are not directed at children. We do not knowingly collect personal data from anyone under 18 years of age.

15. Grievance Officer

If you have any concern or complaint about how we handle your personal data, please contact our Grievance Officer:

We will acknowledge your grievance promptly and aim to resolve it within one month. If you are not satisfied with our response, you may approach the Data Protection Board of India.

16. Changes to this policy

We may update this Privacy Policy from time to time. The latest version will always be available on this page with its "Last updated" date.