Privacy Policy

Tantra is an outreach platform. Our customers connect their own sending accounts, upload or create their own contact records, and decide who receives a message.

Where we act for our customers: For the contact data a customer provides and the messages it sends through the Services ("Customer Content"), the customer is the controller and we are its processor. Under Indian law, the customer is the data fiduciary and we are its data processor. We process Customer Content only to provide the Services and on the customer's instructions.

Where we decide: For account, billing, support, website, workshop and marketing data, we are the controller (the data fiduciary under Indian law), and this Policy describes our own practices.

Each category below lists the personal data involved and the purposes we use it for.

Account information: your name, work email address, company, role, profile image and sign-in identifiers. We use it to create and secure your account, sign you in and contact you about your account.

Billing information: your plan, number of connected accounts, subscription status, billing name, email address, country and invoice records. We use it to charge for the Services, keep accounting records and meet tax obligations. Card and other payment details are collected by our payment provider, Dodo Payments, and are not stored by us.

Usage and device information: IP address, browser and device type, the pages and features you use, timestamps, and diagnostic and error logs. We use it to operate, secure and troubleshoot the Services and to prevent abuse.

Content you create: campaigns, sequences, message and invitation copy, templates, event details, schedules and settings. We use it to run your campaigns as you configure them.

Contact data you provide: records for the people you want to reach, such as name, email address, phone number, company, role, website, social profile identifiers, tags and custom fields. We use it only to run your campaigns, on your instructions.

Messages and activity from connected accounts: sent messages, replies, delivery and bounce notices, calendar responses and webinar attendance, as described in Section 4. We use it to detect replies and bounces, stop sequences, honor opt-outs and report results.

Support and communications: messages you send to our team, feedback and survey responses. We use them to answer you and to improve the Services.

Website, workshop and event information: details you enter in our website forms, workshop registrations and surveys, such as name, email address, WhatsApp number, company and survey answers, together with the referral or campaign link that brought you to us. We use them to respond to inquiries, run the workshops and events you register for, send related reminders, prepare materials you request and credit referral partners.

Marketing preferences: whether you have subscribed to or unsubscribed from our newsletters and product updates. We use this to send, or stop sending, those messages.

We collect only the personal data we need for these purposes. You are not required to give us personal data, but without some of it, such as an email address, we cannot provide an account.

The Services reach a connected platform only with access you grant, and you can withdraw that access at any time.

Google Workspace (Gmail and Google Calendar): You connect Google Workspace with your organization's own service account and the domain-wide delegation you authorize in your admin console. We never receive your Google password. That authorization lets us send email from the mailboxes you nominate, create and update calendar events and invitations, and read the mailbox activity needed to run your campaigns. We process the messages needed to match activity to your campaigns, and we do not retain unrelated mail.

Microsoft Outlook: When you connect an Outlook or Microsoft 365 mailbox, we use Microsoft Graph, with the permissions you approve, to send email from that mailbox and to read the replies and delivery notices your campaigns need.

SendGrid: If your account still sends through a SendGrid key you supplied, which is a legacy option, messages and recipient addresses pass through SendGrid under your SendGrid account.

Message content: We process the messages sent from your connected mailboxes and the responses they receive, including reply text, delivery and bounce notices, and message metadata such as sender, recipient, subject and thread identifiers. This lets the Services detect replies and bounces, stop a sequence when someone answers, honor unsubscribe requests and show your conversations in the shared inbox.

Calendar and RSVP data: The events you create through the Services, their attendee lists, and the RSVP responses returned by the calendar provider.

LinkedIn and WhatsApp: When you connect a LinkedIn or WhatsApp account, the connection runs through Unipile, our connectivity provider, and WhatsApp messages are carried by Meta's WhatsApp service. We process the identifiers and profile details of your connected account, the messages, connection requests and profile actions sent through it, the replies received, and the recipient's profile identifier or phone number. When you connect LinkedIn, a security check provided by Arkose Labs may collect browser and device signals to verify the sign-in.

Webinar platforms: If you connect Zoom or WebinarGeek, we process the webinar and session details, registrant records and attendance information needed for reporting and for attributing attendance to a campaign. We register a contact with a webinar provider only where you turn that option on, and the provider may then email that person directly.

Credentials for connected platforms: Service account keys, provider client secrets and similar credentials you upload are encrypted before they are stored and are used only to operate the connection you created.

Where you turn on website personalization for a campaign step, the AI provider needs to know what a prospect's company does. This is how the company website is read.

• What is read: only publicly available pages on the company domain linked to the contact, taken from the contact's website field or work email domain. Pages behind a login are not read. If a contact has only a personal webmail address and no website, nothing is read and your stored template is used.
• Key-based AI providers (OpenRouter, Cerebras and Novita): our self-hosted crawler fetches the public pages and passes the text to the provider you connected. In limited cases, a legacy third-party page-to-text service is used as a fallback.
• ChatGPT or Claude accounts: when you connect ChatGPT or Claude, that provider reads the public website directly with its own web tools, under its own terms.
• How the text is used: only as context to personalize your message to that prospect.
• How long it is kept: only for as long as the campaign needs it. We do not use it to build a profile of the prospect, and we do not share it with other customers.

Website personalization is off unless you turn it on for a step or campaign.

AI features are optional. They help you draft templates and personalize individual messages.

Campaign personalization uses the AI provider you connect: your own API key for OpenRouter, Cerebras or Novita, or your own ChatGPT or Claude account. The request goes to that provider under your account and is billed by it. If you have not connected a provider, or the provider returns an error, your stored template is sent instead. The content sent can include the contact's details, the relevant message text, campaign context and public website text.

Template drafting tools, which help you write templates inside the product, use the AI provider configured by Tantra, currently Cerebras. The content sent is your instructions and the campaign context you provide for the draft.

Workshops: If you complete a workshop survey, your answers are sent to Anthropic's API to prepare your personal course plan.

We record the model used, token counts, and the request and response content of AI calls so that you can audit usage and cost. Provider API keys you store are encrypted. AI providers process content under their own terms, so review those terms before you enable these features. We do not use Customer Content to train AI models.

Outbound webhooks: If you configure a webhook, we send the events you select, and the associated recipient and campaign data, to the destination URL you provide. You choose that destination and are responsible for how the receiving system handles the data.

API keys and assistant tools: Account-level API keys, and the tools that use them, including our MCP server for AI assistants, allow you or a tool you authorize to read and write the same data you can access in the product. Anyone holding a valid key can act as your account, so treat keys as credentials, share them carefully and revoke any key you no longer use.

Tracking links and opt-outs: Click tracking is off by default. Where you enable it, or where a message carries an unsubscribe link, we record that a recipient clicked or opted out so that reporting and suppression work. We do not use tracking pixels to record message opens.

• Provide and operate the Services, including creating campaigns, sending messages and invitations, tracking replies, bounces, RSVPs and opt-outs, and displaying results.
• Maintain the connections you authorize and keep sending within the limits of each connected platform.
• Produce the reporting and attribution shown in your account.
• Keep the Services reliable and secure through diagnostics and logs.
• Communicate with you about your account, billing, support and product changes.
• Send newsletters, workshop reminders and product updates where you have agreed or the law allows, with an unsubscribe option in every message.
• Detect, investigate and prevent security incidents, abuse and misuse of the Services.
• Meet legal obligations and enforce our terms.

Legal bases: We process personal data because it is needed to perform our contract with you, because you have given consent, because we have a legitimate interest in running, securing and improving the Services that is not overridden by your rights, or because the law requires it. Under Indian law, we rely on your consent or on a legitimate use that the law permits.

Withdrawing consent: Where we rely on your consent, you can withdraw it at any time, as easily as you gave it, by using the unsubscribe link in a message, changing your settings, or writing to [email protected]. Withdrawal does not affect processing that took place before it, but it may mean we can no longer provide a service that depends on that consent.

• We do not sell personal data.
• We do not use your content to build public datasets or to train AI models.
• We do not share your contact data with other customers or add it to a shared lead database.
• We do not use advertising or third-party analytics trackers on our websites.
• We access the content of a connected mailbox or messaging account only to operate the features you enable, such as sending, reply and bounce detection, and your inbox. Staff access is limited to what is needed for support you request, security, or a legal obligation.

We share personal data only with:

• The platforms you connect: your email, calendar, messaging and webinar providers and your AI provider receive what is needed to carry out the actions you request.
• Subprocessors and service providers: the providers listed in Section 11, each for the purpose stated there.
• Destinations you choose: webhook endpoints and the API or assistant clients you configure.
• Business transfers: if we merge, are acquired or sell assets, personal data may transfer to the successor under continued protections.
• Legal: authorities or other parties where the law requires it, or where needed to protect rights, safety or security.

The Subprocessor schedule at the end of this Policy lists every provider that processes personal data for the Services, with its purpose, the personal data involved and where it processes data.

Some entries are platforms you choose to connect, such as Google Workspace, Microsoft Outlook, LinkedIn and WhatsApp through Unipile, Zoom, WebinarGeek or your own AI provider. They process data because you direct us to use them, and their own terms also apply.

We review each provider before engaging it, and our subprocessors are bound by confidentiality, security and data protection obligations. When we add or replace a subprocessor, we update the schedule and the dates of this Policy. Customers with a Data Processing Agreement receive advance notice as that agreement sets out.

The Services are primarily hosted on Microsoft Azure, Central India region (Pune). Some subprocessors process data in the United States, the European Union or on global networks, as shown in the Subprocessor schedule.

Where personal data moves between countries, we apply contractual and technical safeguards suited to the transfer, and we do not transfer personal data to any country to which the Government of India has restricted transfers.

Customers in the EU and UK: The European Commission has not issued an adequacy decision for India, so transfers of EU personal data to us and our subprocessors rely on the European Commission's Standard Contractual Clauses, with the UK International Data Transfer Addendum for UK personal data. Standard Contractual Clauses are model contract terms, approved by the European Commission, that require the recipient to protect personal data to the standard EU law expects.

Data Processing Agreement: A Data Processing Agreement is a contract that sets out how we process personal data on a customer's behalf, including security, confidentiality, subprocessors and help with individuals' requests. It is available on request at [email protected].

We keep personal data for as long as your account is active and for as long as needed for the purposes described in this Policy, including reporting, security, resolving disputes, and meeting legal and accounting obligations. When a purpose is complete, we delete or anonymize the data unless the law requires us to keep it.

You can delete contacts, campaigns, messages and templates in the product, and you can disconnect any connected account at any time. Disconnecting revokes our ability to act on that account from then on. You can also revoke access directly with the provider, for example in your Google Workspace admin console.

When your account is closed, we delete or anonymize the personal data we hold for you within a reasonable period, except where we must keep records to comply with law, resolve a dispute or enforce our agreements. Suppression and unsubscribe records are kept so that an opt-out continues to be honored.

You may request export or deletion as described in Section 17.

We use administrative, technical and physical safeguards designed to protect personal data, including encryption in transit, encryption of stored credentials such as service account keys and provider API keys, access controls and event logging. No method of transmission or storage is completely secure, and we continue to improve our protections. You are responsible for keeping your own credentials, API keys and connected accounts secure.

If a personal data breach affects your data, we will notify you, and the authorities where the law requires, without undue delay.

We use cookies and browser storage that are needed to sign you in, keep sessions secure and remember preferences such as your currency. We do not use advertising cookies or third-party analytics cookies.

To show prices in your local currency, our website sends your IP address to a country lookup service. You can control cookies in your browser settings, but the application may not work without the essential ones.

• Access and update: You can view and update your account information in Settings.
• Connected accounts: You can disconnect any connected mailbox, calendar, messaging or webinar account at any time.
• AI features: Personalization and website reading are optional and can be turned off per campaign or step.
• Communications: You can unsubscribe from our newsletters and product updates using the link in any message.
• Cookies: You can control cookies in your browser; some features rely on them.

Depending on where you live, you may have the right to:

• obtain a summary of the personal data we hold about you and how we process it;
• correct, complete or update your personal data;
• have your personal data erased;
• restrict or object to processing, including direct marketing;
• receive your personal data in a portable format;
• withdraw consent you have given;
• nominate another person to exercise your rights if you die or become unable to do so; and
• complain, as described in Section 19.

To make a request, write to [email protected]. We may need to verify your identity first. We respond within one month, and in every case within the period the applicable law allows.

If you were contacted through the Services and want your data removed, the customer who provided it is the controller of that data. We will refer your request to that organization and help it act on the request.

If you received an email, invitation, LinkedIn message or WhatsApp message sent through Tantra, the sender is our customer and chose to contact you. You can use the unsubscribe or opt-out option in the message, or reply to the sender directly. You can also write to us at [email protected], and we will pass your request to the sender and record the opt-out so that the sender's future messages respect it.

We have appointed a Grievance Officer to handle concerns and complaints about how we process personal data.

• Grievance Officer: Adithya Murali, Founder, GrowthClub Marketing LLP
• Email: [email protected]
• Post: the postal address in Contact Us, below

We will acknowledge your grievance and resolve it within one month of receiving it.

If you are not satisfied with our response, you may complain to the Data Protection Board of India once it begins accepting complaints under the Digital Personal Data Protection Act, 2023. If you are in the European Union or the United Kingdom, you may also complain to your local data protection authority.

The Services are not directed to individuals under 18, and we do not knowingly collect their personal data. If we learn that we have collected personal data from a child, we will delete it.

The Services may contain links to external sites. Those sites are governed by their own privacy policies.

When we update this Policy, we revise the dates at the top of this page. For material changes, we notify you by email or in the product before they take effect. Where a change requires your consent, we will ask for it.

• Privacy questions and requests: [email protected]
• Post: GrowthClub Marketing LLP, Gayathri Darsan, Panachamoodu, Chettikulangara P.O., Mavelikkara, Kerala 690106, India