Privacy and Security Policy

CoExecutive by Shape My Idea is a cloud-based technology service designed to help founders and small business owners assign tasks, track team progress, receive automated follow-ups and escalations, and generate reports — delivered primarily through WhatsApp, alongside a web-based dashboard.

The purpose of CoExecutive by Shape My Idea is to act as an operational management layer for founders, allowing them to run and oversee their team without manual chasing or cognitive overload.

In this context, CoExecutive by Shape My Idea processes personal data with a high standard of diligence, applying appropriate technical and organizational safeguards in line with applicable data protection law, including India's Digital Personal Data Protection Act, 2023 ("DPDPA"), and other relevant regulations.

1. Identity of the Data Controller

The personal data processed through the website, WhatsApp integration, and dashboard associated with CoExecutive is processed by:

• Data Controller: Shape My Idea, operating the product CoExecutive
• Registered office: 3 - Mombasa Avenue, Sadguru Society, Raiya Telephone Exchange, 150 Feet Ring Road, Rajkot, Gujarat - 360007
• Email: hello@shapemyidea.com
• Privacy email: hello@shapemyidea.com
• Website: https://www.shapemyidea.com/

2. Our Commitment to Privacy and Trust

• We only access the data strictly necessary to provide the Service.
• We apply the principle of data minimization across all processing activities.
• Internal access to personal data is limited, controlled, and logged.
• Personnel with system access are bound by confidentiality obligations and follow secure authentication practices.
• We do not use personal data for purposes unrelated to providing the Service unless we have a valid legal basis to do so.

3. Categories of Data We Process

Depending on how you use the Service, we may process the following categories of data:

a) Data provided directly by you

• Founder name, email address, phone number, and account/business details.
• Employee names and WhatsApp phone numbers, added by the Founder.
• Task descriptions, project names, due dates, status updates, acknowledgments, and blocker details.
• Any direct messages exchanged between Founders and Employees through the Service.

Content entered by users is private and is processed automatically for the sole purpose of operating the Service. We do not routinely access or monitor this content. Access by authorized personnel is limited to cases strictly necessary for resolving technical issues, providing support, or complying with legal obligations, and is carried out under controlled and confidential conditions.

b) Data derived from use of the Service

• Interaction history (menu selections, task updates, response times).
• Preferences, settings, and configuration choices (e.g. reminder timings, working days).
• Technical logs, identifiers, and activity records used to power features like Employee Status and Reports.

c) Payment data

Billing information processed through our third-party payment gateway, CashFree. We do not store full card or bank details on our own systems.

4. Automated Processing

The Service uses automated logic to generate reminders, escalation alerts, and summary reports based on the task and interaction data described above. This processing is carried out automatically, without individualized human review, except where strictly necessary to resolve a technical issue, provide support, or meet a legal obligation. This automated processing is bind to operate based on data entered by founder and employees.

This processing does not involve automated decision-making that produces legal or similarly significant effects on any individual. We do not use your data, your Employees' data, or any task/business content to train any AI or machine learning models, and we do not sell your data to any third party.

5. Purposes of Processing

We process personal data for the following purposes:

• Managing account registration and providing the Service.
• Creating, storing, organizing, and executing tasks, reminders, and automated escalations.
• Generating daily, weekly, and monthly reports and analytics.
• Sending functional communications related to the Service via WhatsApp or email.
• Improving the quality, security, performance, and usability of the Service.
• Responding to support requests and resolving technical issues.
• Complying with applicable legal obligations.

6. Legal Basis for Processing

• Performance of the contract between you and us in providing the Service.
• Your consent, where required for specific features or integrations.
• Our legitimate interest in maintaining security, preventing misuse, and improving the Service.
• Compliance with applicable legal obligations.

7. Infrastructure & Security

We rely on established third-party infrastructure providers to host and run the Service, including Hostinger, Supabase, and Amazon Web Services (AWS). These providers store data strictly on our behalf and under confidentiality and security obligations — they do not use your data for their own purposes.

We apply technical and organizational measures appropriate to the risk, including:

• Encryption of data at rest and in transit.
• Secure credential and access management.
• Role-based, need-to-know access control.
• Monitoring and access logging.
• Regular backups and recovery measures.

Data stored for application logic purposes is encrypted and remains untouched — it is not manually reviewed, analyzed, or accessed beyond what is required to run core features you've enabled (such as generating your reports).

8. Payments and Compliance

If you subscribe to a paid plan, payment is handled by our certified third-party payment provider, CashFree. Your payment details are processed directly by that provider; we do not store full payment card data on our own systems.

9. Data Disclosure and Processors

We may share personal data with third parties only where necessary to provide the Service:

Service providers (data processors)

• Cloud hosting and infrastructure providers (Hostinger, Supabase, AWS).
• WhatsApp / Meta Platforms, Inc., as the messaging infrastructure through which the Service is delivered.
• Payment processing providers.
• Customer support and technical service providers.

These providers process data only in accordance with our instructions and are bound by appropriate data processing agreements.

Interaction with WhatsApp

Use of WhatsApp as a delivery channel is also subject to WhatsApp's own privacy policy and terms. We act as a technical intermediary and are not responsible for WhatsApp's own processing of message data on their platform.

Third-party data provided by you

Where you (as a Founder) input personal data of an Employee, you represent that you have a sufficient legal basis to do so, including informing that Employee as required by law. We process such data solely as instructed, on your behalf, to deliver the Service — not for any purpose of our own.

10. International Data Transfers

Where providing the Service involves transferring data outside India (for example, due to the location of our hosting providers), we take reasonable steps to ensure such transfers are subject to appropriate safeguards consistent with applicable law.

11. Data Retention

We retain personal data for as long as your account remains active, and thereafter for the period necessary to comply with legal obligations or resolve disputes. You may request deletion of your data at any time, subject to any legal or operational retention requirements, as described in Section 12.

12. Your Rights

You may exercise the following rights at any time, subject to applicable law:

• Right to access the personal data we hold about you.
• Right to correction of inaccurate data.
• Right to erasure/deletion of your account and associated data.
• Right to withdraw consent, without affecting the lawfulness of processing carried out before withdrawal.
• Right to raise a grievance regarding how your data is handled.

To exercise these rights, contact us at hello@shapemyidea.com.

13. Privacy by Design and by Default

We apply the principles of privacy by design and by default, ensuring that data processing is configured from the outset around data minimization, necessity, proportionality, and security.

14. Children's Privacy

The Service is intended for business use by adults and is not directed at individuals under 18 years of age. We do not knowingly collect personal data from minors.

15. Regulatory Compliance

We are committed to complying with applicable data protection legislation, including the DPDPA and any other national or sector-specific regulations relevant to the territories in which we operate.

16. Changes to This Policy

We may update this Privacy Policy to reflect legislative, technical, or functional changes. In the event of material changes, we will inform users by reasonable means (email or WhatsApp notice).

17. Contact Us

For any questions regarding this Policy, contact: