Legal
Privacy Policy
This Privacy Policy explains how Eldor AI Technologies Private Limited ("Eldor", "we", "us") collects, uses, shares and protects personal data when you use our website eldor.ai, the Eldor dashboard at admin.eldor.ai, and Eldor's apps for Shopify, WhatsApp and Instagram (together, the "Services"). It also explains your rights under India's Digital Personal Data Protection Act, 2023 ("DPDP Act") and, where they apply to you, the EU and UK General Data Protection Regulation ("GDPR") and California privacy law.
Last updated 8 October 2026
Who we are and our role
Eldor AI Technologies Private Limited is a company incorporated in India, with its registered office at No-2590, KNO-2152/2590, HSR Layout 1st Sector, Bangalore South, Bengaluru, Karnataka 560102, India. Our role depends on whose data it is:
Merchants and website visitors. For the brands that use Eldor ("merchants") and for visitors to eldor.ai, we decide how personal data is used. We are the Data Fiduciary under the DPDP Act and the controller under the GDPR.
Shoppers. When a merchant uses Eldor to talk to its own customers ("shoppers") on WhatsApp, Instagram, web chat or email, we process shopper data on the merchant's behalf and under its instructions. The merchant is the Data Fiduciary or controller, and we are its Data Processor. If you are a shopper, the merchant's privacy policy also applies, and requests about your data are best sent to the merchant first. We will help them respond.
Information we collect
Information you give us. Your name, work email, phone number, company and store details, and billing contact details when you sign up, book a demo, request an AI visibility audit, contact us or apply for a role.
Information from platforms you connect. Only with your permission, and only what is needed to run the Services:
Google sign-in: your name, email address and profile picture.
Shopify: store details, products and catalog, inventory, orders, and the shopper details needed to answer order questions, such as name, contact details, shipping address and order status.
Meta (WhatsApp, Instagram and Facebook Login): your business account and phone number IDs, connected catalog, and the messages exchanged with shoppers. See "Data from Meta, WhatsApp and Instagram" below.
Shipping partners such as Delhivery: shipment and delivery status for orders a shopper asks about.
Shopper conversation data. On a merchant's behalf, we process the messages shoppers send and receive, their WhatsApp or Instagram profile name and phone number or handle, products viewed or added to cart in the Eldor chat widget, and related order details.
Information collected automatically. IP address and an approximate location derived from it, browser and device type, pages visited, timestamps, and diagnostic logs.
We do not ask for sensitive personal data such as health, financial account or biometric information. Please do not share it with us or with Eldor's agents.
How we use information
We use personal data only for the purposes below:
To provide the Services: set up your account, connect your store and channels, and let Eldor's agents answer shoppers, recommend products, track orders, raise support tickets and recover carts.
To send messages on a merchant's behalf, including cart recovery and order updates, only to shoppers who have opted in where the law or platform rules require it, such as WhatsApp's opt-in and template rules.
To provide support, send service and billing notices, and, if you agree, product updates. You can unsubscribe from marketing at any time.
To keep the Services secure, prevent fraud and abuse, and debug problems.
To understand usage and improve the Services, using aggregated or de-identified data wherever possible.
To meet legal obligations and enforce our terms.
Legal basis. Under the DPDP Act we rely on your consent or on legitimate uses permitted by the Act. Under the GDPR we rely on performance of our contract with you, our legitimate interests in running and securing the Services, your consent (for example, marketing emails), and compliance with legal obligations. You can withdraw consent at any time. This does not affect processing that happened before you withdrew it.
How Eldor's AI processes data
Eldor's agents use large language models from third-party providers, currently OpenAI and Anthropic, to understand shopper messages and draft replies. The relevant message text, catalog and order context are sent to these providers through their business APIs, under terms that do not allow them to use this data to train their models.
Eldor's agents identify themselves as automated assistants and hand conversations to a merchant's team when needed. AI-generated replies can be wrong, so merchants control which actions the agents may take on their behalf. We do not use automated processing to make decisions that have legal or similarly significant effects on shoppers.
Data from Meta, WhatsApp and Instagram
When a merchant connects Eldor's Meta app through Facebook Login, we receive the business account details, WhatsApp phone number and Instagram account IDs, connected catalog, and the messages sent to and from that business, including the sender's profile name and phone number or handle.
We use this data only to provide the Services to that merchant: to reply to shoppers, send permitted messages and show conversations in the merchant's inbox. We do not sell it, use it for advertising, or combine it across merchants. Our use of Meta data follows Meta's Platform Terms and the WhatsApp Business policies.
You can disconnect Eldor at any time from your Facebook settings or from the Eldor dashboard. To have data received from Meta deleted, follow our Data Deletion Policy at eldor.ai/data-deletion-policy.
International data transfers
We and our providers process data in India, the United States, Taiwan and other countries where they operate. Under the DPDP Act, we will not transfer personal data to any country the Government of India restricts. For transfers of personal data from the EU or UK, we rely on appropriate safeguards such as the Standard Contractual Clauses in our providers' data processing terms.
How long we keep data
Merchant account, store, catalog and shopper conversation data are kept while the merchant's account is active, then deleted from our active systems within 30 days of cancellation. Backups are overwritten within a further 30 days.
A merchant can ask us to delete specific shopper data at any time, and we act on it within 30 days.
Demo, audit and contact requests from people who do not become customers are deleted when no longer needed for that conversation, and no later than 24 months after our last contact.
We keep limited records for longer only where the law requires it, such as invoices and tax records, or to resolve disputes, prevent fraud and enforce our agreements.
How we protect data
We use reasonable security practices and procedures, including encryption in transit and at rest, per-store data isolation so one brand's data is never shared with another, access controls based on least privilege, and audit logging. No system is completely secure. If a personal data breach occurs, we will notify the Data Protection Board of India, other relevant authorities and affected people as the law requires.
Your rights
Depending on where you live, you have the right to:
Access a summary of the personal data we hold about you and how it is used.
Correct, complete or update inaccurate data.
Erase your data, unless we must keep it by law.
Withdraw consent at any time, as easily as you gave it.
Nominate another person to exercise your rights if you die or become incapacitated (DPDP Act).
Object to or restrict certain processing, and receive your data in a portable format (GDPR).
Know, delete and correct personal information, and not be discriminated against for using these rights (California). We do not sell or share personal information as those terms are defined in California law.
Complain to a regulator, such as the Data Protection Board of India or your local data protection authority.
To use any of these rights, email support@eldor.ai from the address linked to your account. We may need to verify your identity, and we respond within 30 days. If you are a shopper, you can also contact the brand you chatted with. For deletion, see our Data Deletion Policy at eldor.ai/data-deletion-policy.
Children
The Services are for businesses and are not directed at children. We do not knowingly collect personal data from anyone under 18 without verifiable parental consent, and we do not track, behaviourally monitor or target advertising at children. If you believe a child has given us personal data, email support@eldor.ai and we will delete it.
Cookies and similar technologies
Essential: cookies that keep you signed in to admin.eldor.ai and keep the Services secure.
Functional: browser storage that lets the Eldor chat widget keep a shopper's conversation open across pages of a merchant's store.
Analytics: Google Analytics cookies that show how visitors use eldor.ai, set only if you accept analytics cookies in our cookie banner. You can change your choice at any time from the banner. Google processes this data under its own privacy policy.
We do not use third-party advertising cookies on eldor.ai. You can block or delete cookies in your browser settings, but parts of the Services may stop working.
Changes to this policy
We may update this policy as the Services or the law change. We will post the new version here and update the date at the top. If a change is material, we will tell merchants by email or in the dashboard before it takes effect.
Grievance Officer and contact
If you have a question or complaint about how we handle personal data, contact our Grievance Officer:
Name: Lokesh Sharma, Co-founder & CEO
Email: founders@eldor.ai
Company: Eldor AI Technologies Private Limited
Address: No-2590, KNO-2152/2590, HSR Layout 1st Sector, Bangalore South, Bengaluru, Karnataka 560102, India
We acknowledge grievances promptly and resolve them within 30 days. For everyday privacy requests, you can also write to support@eldor.ai. If you are not satisfied with our response, you may complain to the Data Protection Board of India.