Privacy Policy
Effective Date: August 24, 2026 • Last Updated: October 13, 2026 (Version 2.2)
Introduction & Commitment
At Takneek OS (accessible via https://takneek.in), we prioritize the privacy and security of our SaaS tenants, enterprise users, and their end customers. This Privacy Policy outlines how we collect, process, store, and safeguard your data, particularly in connection with our Google API integrations, Meta WhatsApp Cloud API, and embedded communication modules.
1. Information We Collect
Account & Business Data
Tenant name, business email, billing address, tax identification (GSTIN), and verified enterprise login credentials.
WhatsApp Integration Data
WhatsApp Business Account ID (WABA ID), Phone Number ID, template message payloads, delivery receipts, and webhook status payloads authorized via Meta Embedded Signup.
2. Use of WhatsApp Business & Meta APIs
Takneek OS interacts with Meta Platforms Inc. APIs strictly to facilitate transactional alerts, OTP verifications, appointment notifications, and billing invoices initiated by authorized tenants.
- We do not sell or monetize any WhatsApp contact lists or message content.
- Messages are transmitted via encrypted Meta Cloud API channels over TLS/HTTPS.
- We strictly adhere to the WhatsApp Business Messaging Policy.
3. Use of Google APIs & User Data Disclosures
Takneek OS's Social Hub lets an authorized tenant connect their own Google account so our Content Pipeline can publish the posts they create and schedule to their own YouTube channel and Google Business Profile, and display reporting analytics. We never access, post to, or read from a Google account that hasn't been explicitly connected by its owner through Google's own OAuth consent screen.
3.1 Scopes Requested and Purpose of Use
YouTube (youtube scope)
Used only to identify the connected channel and upload/edit videos and Shorts the tenant has already composed and scheduled in the Content Pipeline. We do not read, analyze, or share existing videos, comments, playlists, or subscriber data.
Google Business Profile (business.manage scope)
Used only to identify the connected location, publish posts and media the tenant has already composed, display incoming customer reviews so the tenant can reply to them, and show location performance metrics.
Google Analytics (analytics.readonly scope)
Read-only. Used only to show the tenant their own GA4 traffic figures beside the posts we published for them, so they can evaluate content performance. We never write to Analytics, and we never access a property the tenant has not selected.
Search Console (webmasters.readonly scope)
Read-only. Used only to show the tenant their own search impressions and clicks alongside the same posts. We never write to Search Console, and we never access a property the tenant has not selected.
3.2 Sharing, Transfer, and Disclosure of Google User Data
Takneek OS takes your privacy seriously. We do not share, transfer, or disclose Google user data to any third parties, except in the specific, limited operational circumstances described below:
- No Sharing with Third Parties: We do not sell, rent, trade, lease, or share Google user data with any third-party commercial entities, marketing companies, data brokers, or advertising networks.
- No Transfer for Advertising: Google user data is never transferred, shared, or disclosed for advertising, retargeting, or profiling purposes.
- No Artificial Intelligence (AI) Model Training: Google user data is never shared with external AI/LLM providers, and is never used to train, retrain, or fine-tune generalized machine learning or artificial intelligence models.
- Infrastructure Service Providers (Subprocessors): Google user data (such as encrypted OAuth access and refresh tokens) is stored and processed exclusively via enterprise-grade cloud infrastructure providers (specifically Google Cloud Platform / Firebase and Cloudflare). These providers act strictly as data hosting and execution subprocessors under strict contractual data protection and confidentiality agreements, solely to host our databases and execute scheduled background jobs on your behalf. They are legally prohibited from using, sharing, or disclosing your data for any independent purpose.
- Direct API Interaction with Google: When you publish videos, manage profile posts, or request analytics, data is transmitted directly to Google's official APIs (YouTube API Services, Google Business Profile API, Google Analytics API, Search Console API) solely upon your explicit instruction.
- Legal and Regulatory Compliance: We may disclose Google user data only if required to do so by applicable law, regulation, subpoena, court order, or valid governmental legal process.
Except for the trusted infrastructure subprocessors strictly required to operate and host the service as stated above, Takneek OS does not transfer, disclose, or share Google user data with any other third party or external application.
3.3 Google API Services User Data Policy Compliance & Sensitive Data Protection
Takneek OS's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Data Protection for Sensitive Google Data: All Google user data, including OAuth access tokens and refresh tokens, is protected by multi-layered technical controls. Tokens are encrypted at rest using AES-256 encryption, isolated using database Row Level Security, transmitted solely over TLS 1.2/1.3 encrypted connections, and never exposed in cleartext logs or shared with unauthorized processes or third parties.
By using our YouTube features, you agree to be bound by the YouTube Terms of Service. Google's own handling of your personal data is governed by the Google Privacy Policy.
You can revoke Takneek OS's access to your Google account at any time from Social Hub → Accounts, or directly via Google Account Security Permissions. When you disconnect or revoke access, stored authentication tokens are permanently deleted and we immediately cease accessing your Google data.
4. Data Protection and Security Mechanisms for Sensitive Data
Takneek OS implements comprehensive technical, administrative, and physical safeguards designed to ensure the confidentiality, integrity, and protection of all sensitive user data, including Google user data, OAuth authentication tokens, and business credentials.
Encryption in Transit
All communications between user browsers, Takneek OS servers, and external Google APIs are encrypted during transmission using industry-standard TLS 1.2 and TLS 1.3 cryptographic protocols with modern cipher suites over HTTPS. Unencrypted HTTP traffic is strictly prohibited and automatically rejected.
Encryption at Rest
All sensitive credentials, including Google OAuth access tokens, refresh tokens, and API secret keys, are encrypted at rest using industry-standard AES-256 encryption. Database storage volumes and backups are encrypted at rest using secure cryptographic keys managed via enterprise key management standards.
Multi-Tenant Isolation & Access Controls
Our database enforces strict tenant isolation using Row Level Security (RLS) and isolated tenant namespaces, ensuring no customer can ever view or access another business's data or tokens. Server-side access to decryption mechanisms is governed by the principle of least privilege, restricted only to authenticated backend jobs executing user-requested actions. Sensitive tokens are never stored in client-side storage, browser cookies, or application logs.
Operational Security & Monitoring
Our infrastructure is hosted on enterprise-grade cloud environments (Google Cloud Platform / Firebase and Cloudflare) featuring automated DDoS mitigation, web application firewalls (WAF), continuous intrusion monitoring, dependency vulnerability auditing, and automated security patch management to prevent unauthorized access or alteration.
5. Data Retention & Deletion Instructions
User Data Deletion Policy
Tenants may disconnect their WhatsApp, Facebook/Instagram, or Google integration at any time from Social Hub → Accounts, or request complete account erasure by emailing privacy@takneek.in. Disconnecting Google immediately and permanently deletes the stored OAuth access and refresh tokens for that integration; a full erasure request permanently wipes all remaining tokens, identifiers, and associated logs within 30 days. You can also revoke access anytime at myaccount.google.com/permissions.
Takneek OS Privacy & Security Team
Questions or concerns? Contact our Data Protection Officer.