Privacy Policy

LigiComms is a multi-tenant social publishing and customer messaging platform operated by LigimeX, an MSME Udyam registered enterprise based in Lucknow, Uttar Pradesh, India. For the purposes of data-protection law, LigimeX is the data controller for your account data and the data processor for the audience data you upload and the messages you send through the platform.

• Account details — your name, email address, and organisation name when you register. Staff members invited by a tenant admin also provide name and email.
• Authentication credentials — your password is never stored in readable form; it is processed through an industry-standard one-way derivation function with a unique, cryptographically random salt per account.
• Content you create — posts, reels, stories, videos, templates, messages, recipient lists, and brand assets you add to run your campaigns.
• Connected channels — access tokens and credentials you provide to link email, SMS, WhatsApp, and social-media accounts. These are encrypted at rest using authenticated encryption before they reach the database.
• Messaging credentials — if you bring your own SMTP or SMS-provider credentials, they are encrypted at rest with the same authenticated encryption, and decrypted only at the moment of dispatch.
• Billing information — subscription plan, wallet balance, transaction records, and invoice details. Card numbers and payment secrets are handled entirely by our PCI-compliant payment gateway and are never stored on our servers.
• Usage data — device type, browser, approximate region, pages visited, and actions taken, to keep the service reliable and to detect abuse.

• To provide the service — publishing your content, sending your messages, and showing you results and engagement metrics.
• To authenticate you securely and enforce role-based access controls across your organisation.
• To process payments, generate invoices, and maintain billing records.
• To secure your account — detecting unauthorised access, brute-force attempts, and platform abuse.
• To communicate important updates about your account, subscription, or the service itself.
• To improve LigiComms based on how the product is actually used (aggregate analytics, never individual surveillance).
• To meet legal obligations that apply to us in the regions where we operate.

We share information only with:

• The channels you connect — the social, email, SMS, and messaging providers you choose (so your posts and messages can actually be delivered). We send only the data required for delivery.
• Payment gateway — a PCI DSS-compliant payment processor handles card transactions and recharge flows. We share only the order amount, currency, and a reference identifier — never your message content or contact lists.
• Cloud infrastructure — our hosting and database provider operates in a secure data-centre environment. Data is encrypted in transit between all components.
• SMS delivery partners — regional and global telephony providers deliver your SMS messages. They receive only the recipient number, sender identity, and message body needed for dispatch.
• AI inference provider — when you use AI-assisted caption or template generation, the prompt text you provide is sent to a third-party AI provider for processing. No personal data, contact lists, or channel credentials are included in these requests.
• Legal authorities — only where a valid legal demand of a relevant jurisdiction requires it, and only to the minimum extent necessary.

A detailed list of sub-processor categories is available in our Data Processing Agreement.

We take the security of your data seriously and apply multiple layers of protection:

• Encryption at rest — sensitive credentials (channel tokens, SMTP passwords, SMS provider keys) are encrypted using authenticated encryption before storage. Encryption keys are managed separately from the database.
• Encryption in transit — all communication between your browser and our platform, and between our platform and third-party services, is protected by HTTPS with modern transport-layer security.
• Password security — passwords are processed through a one-way key-derivation function with a unique random salt per account and a high iteration count. We cannot read your password; only you know it.
• Token-based authentication — sessions use short-lived access tokens. Tokens are never exposed to the browser; they are kept server-side and rotated automatically.
• Webhook integrity — inbound webhooks from platforms are verified using cryptographic signatures before processing. Invalid signatures are rejected immediately.
• Payment security — payment webhooks are verified using cryptographic message authentication with replay-window protection. Card data never touches our servers.
• Access controls — role-based permissions (dynamically configurable) ensure each user sees and can do only what their role permits. Permission checks are enforced server-side on every request.

For a more detailed overview, see our Security page.

LigiComms is a multi-tenant platform, meaning multiple organisations share the same infrastructure. We enforce strict logical separation to ensure your data remains private:

• Every database query is scoped to your tenant identifier. One tenant's data cannot be accessed by another tenant's users, regardless of role.
• Channel credentials, messaging settings, and wallet balances are isolated per tenant and encrypted independently.
• Staff members can only be invited by their own tenant admin and can only access that tenant's resources.
• The platform owner (LigimeX) has administrative access for support and system operations but does not access your content, contact lists, or channel credentials except when required for technical support you have requested, or to comply with a legal obligation.

LigiComms is operated from India and serves customers worldwide. When you use the service from outside India, your information may be transferred to and processed on servers located in India or in the regions where our infrastructure partners operate. We apply the same protections described in this policy regardless of where your data is processed.

If your country has privacy rights not listed here, contact us — we extend the core rights in section 08 to all users, everywhere.

Wherever you are, you can:

• Access & update — view and correct your account information at any time from your dashboard profile.
• Export — request a copy of your data in a portable format by contacting us.
• Disconnect — unlink any connected channel at any time from your dashboard, which immediately revokes our access to that channel's API.
• Delete — request full account deletion. See section 09 for how this works.
• Object or restrict — where local law (such as GDPR) gives you additional rights like objection to processing or restriction, we honour them.
• Withdraw consent — where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.
• Lodge a complaint — you have the right to complain to your local data protection authority if you believe we have not handled your data correctly.

To exercise any of these, use your dashboard or write to us at info@ligicomms.in. We respond within the timelines your local law requires — and usually much faster.

You may request deletion of your account at any time by contacting us at info@ligicomms.in. When you do:

• Your account is deactivated immediately, blocking all access for you and any staff members.
• All connected channels are disconnected, revoking our access to their APIs.
• Your personal data, content, templates, contact lists, channel credentials, and messaging settings are permanently deleted within 30 days of the request.
• Billing records and invoices may be retained beyond 30 days where required by tax, accounting, or legal obligations — but only the minimum necessary for compliance.
• Data that has already been delivered to third-party platforms (published posts, sent messages) is governed by those platforms' own retention policies and is outside our control.

For users who connected through Meta platforms (Facebook, Instagram, WhatsApp), we also honour Meta's data-deletion callbacks. You can check the status of a Meta data-deletion request on our data-deletion status page.

We keep your data only as long as your account is active or as needed to provide the service. Specifically:

• Active accounts — data is retained for the duration of your subscription and active use.
• After account deletion — personal data is purged within 30 days, except for records we must keep for legal, tax, or audit purposes.
• Operational logs — platform error logs and API interaction logs are retained for a limited period for debugging and security purposes, then automatically purged.
• Engagement metrics — post-level insights (likes, comments, shares) are refreshed periodically and subject to retention policies to prevent unbounded growth.

LigiComms offers optional AI-assisted content generation (captions, hashtags, templates). When you use these features:

• Only the text you provide in the prompt field is sent to the AI provider — no personal data, contact lists, channel credentials, or account information is included.
• Input is sanitised before processing to prevent prompt-injection attacks.
• AI requests are rate-limited per tenant and per user to prevent abuse.
• Every AI request is logged internally for audit and abuse-detection purposes.
• We do not use your content to train AI models. The AI provider processes your request and returns a result — your content is not retained by them for training.

LigiComms uses only one essential cookie required for the service to function:

• Session cookie — maintains your authenticated session while you use the dashboard. It is HTTP-only, secure, and not accessible to client-side scripts.

Cross-site request forgery protection does not rely on a separate cookie — it is enforced by requiring every state-changing request to carry a same-origin request header that a third-party site cannot forge.

We do not use tracking cookies, advertising cookies, or third-party analytics cookies. We do not participate in cross-site tracking or ad networks.

LigiComms is a business tool and is not directed at children. You must be at least 18 years old (or the age of majority in your jurisdiction) to create an account. We do not knowingly collect personal information from children; if you believe a minor has provided us data, contact us and we will delete it promptly.

We may update this policy from time to time. If we make material changes, we'll notify you by email or inside the product before they take effect. The "Last updated" date at the top always tells you the current version. Continued use of the service after changes take effect constitutes acceptance of the revised policy.

Questions about this policy or your data? Visit our contact page or email info@ligicomms.in — we'll be glad to help, whichever timezone you're in.

If you are in the EU/UK and wish to reach a data protection point of contact, use the same email address and include "Data Protection" in the subject line.