Security & Privacy

Purpilot is built to comply with the Digital Personal Data Protection Act, 2023 and the Rules made under it. Every piece of customer data collected through your website or booking system has an explicit lawful basis. Consent is collected at the point of booking. Data is never sold. We share it only with the service providers listed in our Privacy Policy, to run Purpilot.

Every Purpilot website is hosted on Cloudflare. That means it is secure, protected from attacks, and loads in a fraction of a second anywhere in India. Included free.

Your customers' deposits go to your own UPI ID or, through a payment provider, to your own merchant account — never through Purpilot. Purpilot's own subscription is billed through Razorpay, a PCI DSS compliant payment aggregator. Purpilot never stores or sees card details.

All communication uses the official WhatsApp Business API, provided by Meta (WhatsApp Business Platform). Message content is used only to run the business's bookings and messages, and each business's data is kept separate.

We collect only what is needed. For booking: client name, phone number, service, time, consent. For messages: the WhatsApp messages and voice notes a customer sends to the business. Nothing more.

If you cancel, your booking history is available for export on request. Your website stays live and your domain keeps running until it expires, at no cost — your static website and business email keep working with it until then. Moving the domain to your own registrar account is optional, ₹299 one-time processing fee. You leave with everything that is yours.