1. Who we are
Chronos Auto is a WhatsApp-based AI assistant operated by Chronomation LLP ("Chronomation", "we", "us", "our"), a limited liability partnership registered in India.
- Registered address: B1 402 Ashok Towers, Marol Military Road, Andheri East, Mumbai 400059
- Website: https://chronomation.ai
- Privacy / Grievance contact: Aman Shetty, [email protected]
We provide an automated lead-qualification and customer-conversation assistant that businesses ("our clients") connect to their own WhatsApp number. We operate from India and may serve people located anywhere in the world.
Controller vs. processor — which is which
- When you message a business's WhatsApp number that uses Chronos Auto, that business is the controller (Data Fiduciary) of your data and decides why it is collected. Chronomation acts as that business's processor, handling your messages on its documented instructions and not for our own purposes. Please also read that business's own privacy notice.
- When you visit chronomation.ai, contact us directly, or use our operator app as a client, Chronomation is the controller of that data.
This policy explains our practices in both roles and your rights under the EU/UK GDPR, the California Consumer Privacy Act (CCPA, as amended by the CPRA), Canada's PIPEDA, and India's Digital Personal Data Protection Act, 2023 (DPDP).
2. What this policy covers
- The Chronos Auto WhatsApp AI assistant.
- Our marketing website, https://chronomation.ai.
- The Chronos Auto operator app used by our business clients.
3. What data we collect
From people who chat with the assistant on WhatsApp:
- Your WhatsApp phone number and WhatsApp display/profile name.
- The content of the messages you send and our replies.
- Information you volunteer in the conversation (e.g. your name, interest, budget, appointment preferences).
- Technical metadata: timestamps and message delivery status.
From visitors to chronomation.ai: basic server/request logs and any essential cookies needed to serve the site (see §11).
From our business clients (operators): account login details and the configuration you provide.
We do not intentionally collect special-category or sensitive personal data (such as health, biometric, financial-account, or precise-location data), and we ask that you do not send it.
4. How we use your data and our lawful basis
| Purpose | Data used | Lawful basis (GDPR / DPDP) |
|---|---|---|
| Answer your messages and qualify your enquiry via our AI assistant | Message content, number, name | Consent; steps toward / performance of a contract; legitimate interests |
| Let a human from the business follow up with you | Conversation, contact details | Consent / legitimate interests |
| Schedule a call or appointment you request | Name, contact, chosen time | Performance of a contract at your request |
| Keep records, prevent abuse, and meet legal/audit obligations | Logs, message metadata | Legitimate interests; legal obligation |
| Operate and improve the website | Server logs, essential cookies | Legitimate interests |
Where we (or the business you contacted) rely on consent, it is captured when you begin chatting and are shown the notice; you can withdraw it at any time (see §8). Because the product is inbound-only — the assistant replies to people who message first — your decision to start the conversation is the basis for our responding to it.
Automated decision-making / profiling: the assistant performs lead qualification, which is a form of profiling. It only routes and replies; it does not make decisions that produce legal or similarly significant effects about you without human involvement, and a human can review and take over at any time (see §5).
5. Automated / AI processing — please read
Your WhatsApp messages are read and answered by an automated AI assistant. The assistant's primary AI provider is Google (Gemini API), which processes your message text on our behalf, solely to generate a reply. If Google's service is temporarily unavailable, the assistant automatically falls back to Anthropic's Claude model, which processes the same message text in the same way and for the same purpose.
- Under our paid-tier / commercial API terms, neither Google nor Anthropic uses your messages to train its AI models, and each deletes the data it processes on a short retention cycle.
- A reply you receive may be generated entirely by AI.
- A human may take over: a member of the business you contacted, or a Chronomation operator, may review the conversation and respond personally at any time.
- You can ask to speak to a human at any point — just say so in the chat.
6. Who we share data with (sub-processors)
We do not sell or share your personal information, and we do not use it for cross-context behavioural advertising or ad targeting. We share data only with the service providers below, who act on our documented instructions under processor terms:
| Sub-processor | What they do | Location |
|---|---|---|
| Google LLC (Gemini API) | Processes the content of WhatsApp chat messages to generate replies. Data is sent to Google's API; under our paid-tier terms it is not used to train Google's models. | United States / global |
| Anthropic, PBC (Claude) | Fallback AI provider, used only if the primary provider is temporarily unavailable; processes the same chat content when active. | United States |
| Meta Platforms (WhatsApp Business Platform) | Delivers and transports WhatsApp messages | United States / global |
| Calendly | Schedules appointments when you book a call | United States |
| GoDaddy | Hosts our business email | United States |
| DigitalOcean | Hosts our assistant's server | United States / region of our server |
| Render | Hosts our marketing-website backend | United States |
A current list is maintained on this page and in our sub-processor register. We may also disclose data where required by law or to protect our rights. If we change sub-processors materially, we will update this list.
7. How long we keep your data
- WhatsApp conversations: we automatically delete your conversation and profile after 30 days of inactivity.
- If you ask us to delete it sooner, we do so promptly (see §8).
- Backups and compliance logs: kept for a short, limited period for security and audit, then purged on a rolling schedule.
8. Your rights and how to exercise them
Depending on where you live, you have some or all of these rights:
- Access — get a copy of, or a summary of, the data we hold about you, including who it has been shared with.
- Correction / rectification — fix inaccurate or incomplete data.
- Deletion / erasure ("right to be forgotten") — have your data deleted.
- Restriction & objection — limit or object to certain processing.
- Data portability — receive your data in a portable, machine-readable form.
- Withdraw consent — at any time, without affecting prior lawful processing.
- Opt out of sale/sharing (CCPA/CPRA) — note we do not sell or share your personal information, so there is nothing to opt out of; you will never be discriminated against for exercising a right.
- Grievance redressal & nomination (DPDP) — raise a complaint with our Grievance Officer (§13), and nominate someone to exercise your rights on your behalf in the event of death or incapacity (email the Grievance Officer to do so).
- In the chat: reply forget me to delete your data, or stop to opt out of further messages.
- By email: contact our Grievance Officer at [email protected]. We respond within the timeframes required by applicable law (and within 30 days where no specific period applies; up to 90 days for DPDP grievances).
You may also lodge a complaint with your local data-protection authority — for example the EU/UK supervisory authority (such as the UK ICO), the California Privacy Protection Agency, the Office of the Privacy Commissioner of Canada, or the Data Protection Board of India. Because a business client may be the controller of your chat data, we may forward your request to them or ask you to contact them directly.
9. International data transfers
We operate from India, and our sub-processors (including Anthropic) process data in the United States and other regions. This means your data may be transferred across borders. Where we transfer personal data out of the EEA or the UK, we rely on appropriate safeguards such as the EU Standard Contractual Clauses (and the UK International Data Transfer Addendum) or equivalent. India's DPDP Act permits such transfers except to countries restricted by the Government of India. You may request a copy of the relevant safeguard by emailing the contact in §13.
10. How we protect your data
- Encrypted transport (HTTPS/TLS) for the website, the operator app, and all sub-processor calls.
- WhatsApp webhooks are verified with HMAC signatures and reject any unsigned or tampered request (fail-closed).
- Access to live data is restricted to authorised operators.
- Per-user rate limiting and abuse protection.
- Automated retention purges remove data we no longer need to hold.
No system is perfectly secure, but we take reasonable, industry-standard measures to protect your data.
11. Cookies and analytics
Our website uses only the essential cookies needed to function. We do not use advertising or cross-site tracking cookies. If this changes, we will update this section and, where required, ask for your consent.
12. Children
Chronos Auto is intended for use by adults and is not directed at children. Under the DPDP Act, individuals under 18 are treated as children and require verifiable parental consent. We do not knowingly collect data from children and do not undertake behavioural tracking or targeted advertising directed at children. If you are under 18, please have a parent or guardian contact us. If you believe a child has contacted us, email [email protected] and we will delete the data.
13. Grievance Officer and contact
For any privacy question, request, or complaint:
- Grievance Officer: Aman Shetty
- Email: [email protected]
- Postal address: B1 402 Ashok Towers, Marol Military Road, Andheri East, Mumbai 400059
We acknowledge grievances promptly and aim to resolve them within the period required under the DPDP Act (within 90 days) and other applicable laws.
14. Changes to this policy
We may update this policy from time to time, and we review it at least annually. We will revise the "Last updated" date above and, for material changes, take reasonable steps to notify you. Your continued use of Chronos Auto after an update means you accept the revised policy.
15. Effective date
This policy is effective as of the date shown at the top (4 June 2026).