PRIVACY POLICY

1. About Galla.app

Galla.app is a SaaS platform for retail, warehouse, billing, inventory, ecommerce, customer communication, WhatsApp marketing, third-party integrations, and business operations. 

Depending on the customer’s subscribed plan or commercial agreement, Galla.app may provide: 

1. Retail management software. 
2. POS billing and invoicing. 
3. Warehouse management system. 
4. Inventory and stock management. 
5. Product, vendor, customer, purchase, sales, order, and dispatch management. 
6. WhatsApp marketing and customer communication tools. 
7. Ecommerce website or store development and managed ecommerce services. 
8. Third-party integrations with ERP, accounting, payment gateway, ecommerce, marketplace, logistics, WhatsApp, SMS, email, cloud, analytics, and other platforms. 
9. Dashboards, reports, APIs, automations, and support services. 

Because Galla.app processes business, operational, customer, employee, vendor, and transaction-related information, we take privacy and data protection seriously. 

2. Scope of this Privacy Policy

This Privacy Policy applies to personal data and other information processed when: 

1. You visit https://galla.app or related websites. 
2. You create or use a Galla.app account. 
3. You use Galla.app as a customer, admin, employee, staff member, warehouse user, POS user, billing user, ecommerce user, or authorised user. 
4. You interact with us for sales, demo, onboarding, support, billing, training, or service delivery. 
5. You submit information through forms, chat, email, calls, WhatsApp, campaigns, landing pages, or support channels. 
6. You use Galla.app modules such as Retail Management, POS Billing, Warehouse Management, WhatsApp Marketing, Ecommerce Development, or Third-Party Integrations. 
7. You are an end customer, vendor, supplier, employee, contractor, shopper, recipient, or business contact whose data is processed by one of our customers through Galla.app. 

This Privacy Policy does not apply to third-party websites, applications, payment gateways, ecommerce platforms, marketplaces, WhatsApp/Meta services, ERP systems, logistics platforms, or other third-party services that are not owned or controlled by Treewalker Digital Private Limited.

3. Our Role in Processing Personal Data 

Depending on the context, Treewalker Digital Private Limited may act in different roles

3.1 When we act as an independent data fiduciary / controller 

We may act as an independent data fiduciary or controller when we collect and use personal data for our own purposes, such as: 

1. Website visitors. 
2. Sales leads. 
3. Demo requests. 
4. Customer account creation. 
5. Billing and invoicing. 
6. Vendor and partner management. 
7. Customer support and service communications. 
8. Marketing communications sent by Treewalker Digital. 
9. Security, fraud prevention, and platform improvement. 
10. Legal, accounting, tax, and compliance requirements. 

3.2 When we act as a data processor / service provider 

We may act as a data processor or service provider when our business customers use Galla.app to process personal data of their own customers, employees, vendors, suppliers, shoppers, recipients, or business contacts. 

In this case: 

1. The business customer decides what data is collected. 
2. The business customer decides why and how the data is used. 
3. The business customer is responsible for providing notices and obtaining consent where required. 
4. Galla.app processes such data only to provide, secure, support, maintain, and improve the services. 
5. Data processing may also be governed by a Data Processing Addendum or written agreement. 

4. Types of Information We Collect

We may collect the following categories of information, depending on how you use Galla.app.

4.1 Business and account information 

This may include: 

1. Business name. 
2. Legal entity name. 
3. GSTIN, CIN, tax registration, and billing details. 
4. Registered office or business address. 
5. Contact person name. 
6. Designation. 
7. Email address. 
8. Phone number. 
9. Login credentials. 
10. User roles and permissions. 
11. Store, warehouse, branch, company, or location details. 
12. Subscription plan, payment status, and order details. 

4.2 User profile and access information 

This may include: 

1. Name. 
2. Email address. 
3. Phone number. 
4. User ID. 
5. Role or designation. 
6. Department or location. 
7. Access permissions. 
8. Login time. 
9. IP address. 
10. Device and browser details. 
11. Activity logs. 
12. Security and authentication logs. 

4.3 Retail, POS, billing, and transaction data 

When customers use Galla.app for retail management or POS billing, the platform may process: 

1. Product details. 
2. SKU details. 
3. Price and discount details. 
4. Sales records. 
5. Purchase records. 
6. Invoice details. 
7. Credit notes and debit notes. 
8. Tax details. 
9. HSN/SAC details. 
10. Customer details. 
11. Vendor details. 
12. Payment mode. 
13. Billing counter details. 
14. Return and exchange details. 
15. Salesperson or user activity records.

4.4 Warehouse and inventory data 

When customers use Galla.app for warehouse management, the platform may process: 

1. Stock records. 
2. Product movement details. 
3. Inward and outward records. 
4. Putaway, picking, packing, dispatch, and transfer details. 
5. Batch, serial number, barcode, QR code, or RFID-related data. 
6. Location and bin details. 
7. Cycle count and stock audit records. 
8. Warehouse user activity. 
9. Device or scanner logs. 
10. Integration logs with ERP, ecommerce, logistics, or marketplace systems. 

4.5 WhatsApp marketing and communication data 

When customers use Galla.app for WhatsApp marketing or communication, we may process: 

1. Recipient name. 
2. Mobile number. 
3. Message templates. 
4. Campaign details. 
5. Message content. 
6. Consent status, where recorded. 
7. Opt-out status, where recorded. 
8. Delivery, read, failed, or response status. 
9. Communication logs. 
10. WhatsApp Business Account or phone number details. 
11. Template approval status. 
12. Provider or Meta-related messaging metadata. 

Customers are responsible for ensuring that all WhatsApp contacts are lawfully collected and that marketing communication is sent only with appropriate consent and in compliance with applicable rules and platform policies

4.6 Ecommerce data 

When customers use Galla.app for ecommerce development, ecommerce management, or ecommerce integrations, we may process: 

1. Product catalogue data. 
2. Product images and descriptions. 
3. Order details. 
4. Buyer/customer details. 
5. Shipping and billing address. 
6. Payment status. 
7. Cart, checkout, return, refund, or cancellation data. 
8. Marketplace or channel data. 
9. Ecommerce website content. 
10. Support and service request data. 

4.7 Third-party integration data 

When customers connect Galla.app with third-party systems, we may process data received from or sent to: 

1. ERP systems. 
2. Accounting software. 
3. Tally or similar accounting platforms. 
4. Ecommerce platforms. 
5. Marketplaces. 
6. Payment gateways. 
7. Logistics platforms. 
8. WhatsApp or messaging providers. 
9. SMS and email gateways. 
10. Analytics tools. 
11. Cloud platforms. 
12. APIs or custom systems. 

The exact data processed depends on the integration configured by the customer. 

4.8 Support and communication data 

When you contact us, we may collect: 

1. Name. 
2. Email address. 
3. Phone number. 
4. Company name. 
5. Query details. 
6. Support tickets. 
7. Chat messages. 
8. Call notes. 
9. Screenshots or attachments shared by you. 
10. Error logs. 
11. Remote support session details. 
12. Feedback and survey responses. 

4.9 Website, device, and usage information 

When you visit our website or use our platform, we may collect: 

1. IP address. 
2. Browser type. 
3. Device type. 
4. Operating system. 
5. Pages visited. 
6. Referring website. 
7. Time spent on pages. 
8. Click activity. 
9. Session information. 
10. Cookie identifiers. 
11. Approximate location based on IP address. 
12. Error, crash, or performance logs. 
13. Security event logs. 

More information is available in our Cookie Policy.

5. How We Collect Information

We may collect information through: 

1. Website forms. 
2. Demo requests. 
3. Account registration. 
4. Subscription or order forms. 
5. Emails. 
6. Phone calls. 
7. WhatsApp communication. 
8. Support tickets. 
9. Chat tools. 
10. Platform usage. 
11. Uploaded files. 
12. API integrations. 
13. Third-party integrations. 
14. Cookies and similar technologies. 
15. Payment and billing systems. 
16. Training, onboarding, or implementation processes. 
17. Logs generated by the platform. 

We may also receive information from authorised users, business customers, third-party platforms, partners, resellers, payment gateways, communication providers, cloud providers, and integration partners. 

6. How We Use Information 

We use information for the following purposes. 

6.1 To provide and operate Galla.app 

We use information to: 

1. Create and manage accounts. 
2. Provide access to subscribed modules. 
3. Process retail, POS, warehouse, inventory, ecommerce, WhatsApp, and integration workflows. 
4. Enable dashboards, reports, APIs, and automations. 
5. Configure customer accounts. 
6. Provide onboarding, training, and implementation. 
7. Deliver support and troubleshooting. 
8. Maintain platform availability and performance.

6.2 To process transactions and billing 

We use information to: 

1. Generate invoices. 
2. Process payments. 
3. Track subscriptions. 
4. Manage renewals. 
5. Apply taxes. 
6. Handle overdue payments. 
7. Maintain accounting and statutory records. 
8. Respond to billing queries. 

6.3 To provide customer support 

We use information to: 

1. Respond to support requests. 
2. Investigate issues. 
3. Troubleshoot bugs. 
4. Review logs. 
5. Improve user experience. 
6. Provide remote assistance where authorised. 
7. Communicate about service issues or updates. 

6.4 To enable WhatsApp marketing and communication features 

We use information to: 

1. Send messages selected or configured by the customer. 
2. Manage message templates. 
3. Track campaign delivery. 
4. Process message status. 
5. Maintain communication logs. 
6. Support opt-out or consent records where configured. 
7. Integrate with WhatsApp Business providers. 

Customers are responsible for lawful use of WhatsApp marketing features. 

6.5 To enable third-party integrations 

We use information to: 

1. Connect Galla.app with customer-authorised third-party systems. 
2. Send and receive data through APIs. 
3. Sync orders, invoices, stock, customers, vendors, payments, and reports. 
4. Maintain integration logs. 
5. Troubleshoot integration errors. 
6. Support customer workflows

6.6 To improve and secure our services

We use information to: 

1. Monitor service performance. 
2. Detect errors and bugs. 
3. Improve product features. 
4. Enhance security. 
5. Prevent fraud, abuse, spam, or unauthorised access. 
6. Conduct internal analytics. 
7. Test new features. 
8. Maintain audit logs. 
9. Protect the platform, customers, and users. 

6.7 To communicate with you 

We may use information to send: 

1. Account notifications. 
2. Security alerts. 
3. Service updates. 
4. Billing notices. 
5. Renewal reminders. 
6. Product updates. 
7. Training and onboarding communication. 
8. Support responses. 
9. Marketing communication, where permitted. 
10. Legal or policy notices. 

You may opt out of non-essential marketing communication, but we may continue sending service, security, billing, legal, or transactional messages. 

6.8 To comply with legal obligations 

We may use information to: 

1. Comply with applicable law. 
2. Maintain tax, accounting, and statutory records. 
3. Respond to lawful requests by government, court, or regulatory authorities. 
4. Enforce our agreements and policies. 
5. Protect our legal rights. 
6. Investigate misuse, fraud, security incidents, or unlawful activity. 

7. Legal Basis for Processing 

Depending on the applicable law and context, we may process personal data based on one or more of the following grounds: 

1. Consent. 
2. Performance of a contract. 
3. Compliance with legal obligations. 
4. Legitimate business purposes. 
5. Security and fraud prevention. 
6. Customer instructions, where we act as a processor or service provider. 
7. Legal claims or dispute resolution. 
8. Any other lawful basis permitted under applicable law. 

Where consent is required, you may have the right to withdraw consent, subject to legal, contractual, operational, and technical limitations. 

8. Customer Responsibilities for End Customer Data

If you are a Galla.app business customer, you are responsible for personal data that you upload, import, collect, or process through Galla.app. 

You are responsible for: 

1. Providing appropriate privacy notices to your customers, employees, vendors, suppliers, and users. 
2. Obtaining consent where required. 
3. Ensuring that personal data is collected lawfully. 
4. Ensuring that WhatsApp, SMS, email, or marketing communication is sent lawfully. 
5. Ensuring that uploaded contact lists are not purchased, scraped, unauthorised, or unlawful. 
6. Handling opt-out, unsubscribe, correction, deletion, and grievance requests from your end customers. 
7. Ensuring that your use of Galla.app complies with applicable laws and third-party platform policies. 
8. Configuring access controls and permissions correctly. 
9. Avoiding upload of unnecessary, excessive, or unlawful personal data. 

Treewalker Digital Private Limited is not responsible for unlawful data collection, unlawful marketing, incorrect customer data, or misuse of the platform by the customer or its users. 

9. Sharing of Information 

We do not sell personal data. 

We may share information in the following cases. 

9.1 With service providers and subprocessors 

We may share information with trusted service providers who help us operate, host, secure, support, and improve Galla.app. 

These may include: 

1. Cloud hosting providers. 
2. Database and infrastructure providers. 
3. Email service providers. 
4. SMS providers. 
5. WhatsApp Business service providers. 
6. Payment gateways. 
7. Analytics providers. 
8. Customer support tools. 
9. Security and monitoring tools. 
10. Backup and storage providers. 
11. Professional advisors. 
12. Implementation or development partners. 

Our Subprocessor List may provide additional information about such providers. 

9.2 With third-party integrations selected by customers 

If a customer connects Galla.app with a third-party service, we may share or receive data with that service as authorised by the customer. 

Examples include: 

1. ERP systems. 
2. Accounting software. 
3. Ecommerce platforms. 
4. Marketplaces. 
5. Logistics providers. 
6. Payment gateways. 
7. WhatsApp/Meta or communication providers. 
8. SMS/email gateways. 
9. Custom APIs. 

The customer is responsible for reviewing the privacy practices and terms of third-party services. 

9.3 With business users and account admins 

Information may be visible to account owners, admin users, authorised users, managers, or other users configured by the customer. 

Customers are responsible for assigning correct user roles and permissions. 

9.4 For legal and compliance reasons

We may disclose information if required to: 

1. Comply with law. 
2. Respond to court orders, legal process, or government requests. 
3. Protect our rights, property, customers, users, or the public. 
4. Investigate fraud, misuse, security incidents, or unlawful activity. 
5. Enforce our Terms of Service or agreements. 

9.5 In connection with business transfers 

If Treewalker Digital Private Limited is involved in a merger, acquisition, restructuring, investment, financing, sale of assets, or business transfer, information may be transferred as part of that transaction, subject to appropriate confidentiality and legal protections. 

10. International Data Transfers 

Galla.app may use cloud, infrastructure, support, communication, analytics, or integration providers located in India or other countries. 

Where personal data is transferred outside the country where it was collected, we use reasonable safeguards as required by applicable law, which may include contractual protections, customer instructions, vendor due diligence, data processing agreements, and security measures. 

Customers using Galla.app for international operations are responsible for ensuring that their own data transfer obligations are met. 

11. Data Retention

We retain information only for as long as reasonably required for the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law, contract, tax requirements, accounting rules, audit obligations, dispute resolution, fraud prevention, security, or legitimate business purposes. 

Retention periods may vary depending on the type of data. 

11.1 Account and billing data 

Account, invoice, payment, tax, and commercial records may be retained for the period required under applicable law and business record requirements. 

11.2 Customer Data inside Galla.app 

Customer Data may be retained while the subscription is active. After termination, cancellation, expiry, or prolonged non-payment, Customer Data may be retained for a limited period and then deleted as per our Data Retention and Deletion Policy.

11.3 Backups 

Backup copies may remain for a limited period before being overwritten or deleted according to backup cycles. 

11.4 Support records 

Support tickets, emails, issue logs, chat records, and troubleshooting records may be retained for service quality, training, security, dispute resolution, and audit purposes. 

11.5 Security logs 

Security logs, access logs, error logs, and audit logs may be retained to detect, investigate, and prevent security incidents, misuse, fraud, or unauthorised access. 

12. Data Deletion

Customers may request deletion of their account or Customer Data, subject to: 

1. Active subscription status. 
2. Contractual obligations. 
3. Payment obligations. 
4. Legal and tax retention requirements. 
5. Backup cycles. 
6. Dispute resolution. 
7. Fraud prevention. 
8. Security requirements. 
9. Technical limitations. 
10. Any applicable written agreement. 

When deletion is completed, we may provide confirmation where commercially and technically feasible. 

We may retain limited records where required for legal, tax, security, audit, or dispute purposes. 

13. Data Security

We use reasonable technical and organisational measures designed to protect information from unauthorised access, misuse, alteration, disclosure, loss, or destruction. 

Security measures may include: 

1. Encryption in transit. 
2. Access controls. 
3. Role-based permissions. 
4. Authentication controls. 
5. Secure development practices. 
6. Logging and monitoring. 
7. Backup processes. 
8. Vulnerability management. 
9. Limited access by authorised personnel. 
10. Administrative safeguards. 
11. Vendor due diligence. 
12. Incident response procedures. 

However, no internet-based system, SaaS platform, cloud service, or electronic transmission is completely secure. Customers are responsible for securing their own devices, users, passwords, networks, browsers, printers, barcode scanners, POS hardware, and local systems. 

14. Security Incidents

If we become aware of a security incident that affects personal data processed through Galla.app, we will take reasonable steps to investigate, contain, mitigate, and remediate the incident. 

Where required by applicable law or contract, we will notify affected customers or authorities within applicable timelines. 

Customers are responsible for notifying their own end customers, employees, vendors, suppliers, or regulators where the customer is legally responsible for such notification.

15. Children’s Personal Data

Galla.app is intended for business use and is not directed to children. 

Customers should not use Galla.app to knowingly collect or process personal data of children unless they have a lawful basis, required parental or guardian consent, and appropriate safeguards under applicable law. 

If we become aware that personal data of a child has been processed unlawfully through Galla.app, we may take steps to delete or restrict such data, subject to customer instructions and legal obligations. 

16. Marketing Communications

We may send marketing communication about Galla.app products, services, events, webinars, updates, offers, or educational content. 

You may opt out of marketing communication by using the unsubscribe link, replying with an opt-out request, or contacting us. 

Even if you opt out of marketing communication, we may still send transactional, service, billing, legal, security, or account-related communication. 

Customers using Galla.app for WhatsApp, SMS, email, or marketing campaigns are responsible for obtaining consent and managing opt-outs from their own recipients. 

17. Cookies and Similar Technologies

Our website and platform may use cookies, local storage, pixels, tags, scripts, SDKs, and similar technologies to provide essential functionality, improve performance, analyse usage, remember preferences, secure the platform, and support marketing. 

For more details, please read our Cookie Policy. 

You can manage cookies through your browser settings or through our cookie consent tool where available.

18. Third-Party Websites and Services

Galla.app may contain links or integrations with third-party websites, applications, platforms, services, APIs, or tools. 

We are not responsible for the privacy practices, content, security, availability, or data handling of third-party services. 

Third-party services may include: 

1. WhatsApp/Meta. 
2. Payment gateways. 
3. Ecommerce platforms. 
4. Marketplaces. 
5. Logistics providers. 
6. ERP or accounting systems. 
7. Cloud providers. 
8. Analytics tools. 
9. SMS and email providers. 
10. Support tools. 

You should review the privacy policies and terms of such third-party services before using them. 

19. User Rights

Depending on applicable law, you may have rights in relation to your personal data, including: 

1. Right to access personal data. 
2. Right to correct inaccurate or incomplete data. 
3. Right to update data. 
4. Right to delete data. 
5. Right to withdraw consent. 
6. Right to object to or restrict certain processing. 
7. Right to receive a copy of data, where applicable. 
8. Right to grievance redressal. 
9. Right to nominate another person, where applicable. 
10. Right to complain to a regulatory authority, where applicable. 

Rights may be subject to limitations under applicable law, contract, security requirements, tax retention rules, legal claims, and technical feasibility. 

20. How to Exercise Your Rights

You may contact us at: 

Privacy Email: legal@treewalkerlabs.com
Grievance Email: legal@treewalkerlabs.com
Company: Treewalker Digital Private Limited
Address: Vikas Plaza.38/ 1A (4), Kanappana Agrahara, Hosur Rd, Phase II, Electronic City, Bengaluru, Karnataka 560100

To process your request, we may need to verify your identity and confirm your relationship with the relevant account or organisation. 

If your data is processed by one of our business customers through Galla.app, we may direct your request to that customer because the customer controls how such data is collected and used. 

21. Customer Admin Controls 

Business customers and admin users may be able to: 

1. Add or remove users. 
2. Assign roles and permissions. 
3. Export data. 
4. Configure integrations. 
5. Manage communication templates. 
6. Review activity logs. 
7. Configure access settings. 
8. Request deletion or closure of accounts. 
9. Manage connected services. 

Customers are responsible for using these controls properly and ensuring that only authorised persons have access.

22. Automated Processing and Analytics

Galla.app may use automated processing, analytics, dashboards, reports, alerts, and system-generated insights to support business operations. 

Such processing may help customers understand: 

1. Sales trends. 
2. Inventory movement. 
3. Stock levels. 
4. Order status. 
5. Billing activity. 
6. Warehouse activity. 
7. Campaign performance. 
8. User activity. 
9. Integration performance. 
10. Operational exceptions. 

Customers should independently verify business-critical, financial, tax, accounting, warehouse, and compliance data before relying on it. 

23. Aggregated and Anonymised Data

We may create aggregated, anonymised, or de-identified data that does not identify a specific individual or customer. 

We may use such data to: 

1. Improve Galla.app. 
2. Develop new features. 
3. Analyse performance. 
4. Understand usage trends. 
5. Publish high-level insights. 
6. Improve security and reliability. 

We will not use aggregated or anonymised data to identify individuals.

24. Payment Information

Payments may be processed through third-party payment gateways, banks, UPI providers, or financial service providers. 

We may collect billing details, invoice details, payment status, transaction reference numbers, and related records. 

We do not intentionally store full card numbers or sensitive payment authentication details unless specifically required and lawfully permitted. Payment providers may process payment information under their own terms and privacy policies. 

25. Data Accuracy

Customers and users are responsible for ensuring that data uploaded, entered, imported, configured, or processed through Galla.app is accurate, updated, lawful, and complete. 

Treewalker Digital Private Limited is not responsible for incorrect reports, invoices, messages, stock records, tax records, or integrations caused by inaccurate, incomplete, outdated, or unlawful customer-provided data. 

26. Employee and Contractor Access

Access to customer information by our employees, contractors, or authorised personnel is limited to those who require access for legitimate business purposes such as support, implementation, troubleshooting, security, billing, or service delivery. 

Such access may be subject to confidentiality obligations, internal controls, role-based permissions, and monitoring. 

27. Subprocessors

We may use subprocessors and service providers to deliver Galla.app. 

Subprocessors may help with: 

1. Hosting. 
2. Cloud infrastructure. 
3. Storage. 
4. Security monitoring. 
5. Analytics. 
6. Email delivery. 
7. SMS or WhatsApp communication. 
8. Payment processing. 
9. Customer support. 
10. Error monitoring. 
11. Backup and disaster recovery. 
12. Professional services. 

We recommend maintaining a separate Subprocessor List on the website and updating it when vendors change.

28. Data Location

Customer Data may be stored in cloud infrastructure located in India or other regions depending on the hosting configuration, customer agreement, cloud provider, integration provider, and service architecture. 

Enterprise customers with specific data residency requirements should contact us before subscribing or deploying Galla.app.  

29. Do Not Track

Some browsers provide “Do Not Track” signals. Because there is no uniform industry standard for responding to such signals, our website may not respond to every browser-based Do Not Track signal. 

You may manage cookies through browser settings or our cookie consent tool where available

30. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. 

When we update the Privacy Policy, we will revise the “Last Updated” date. If changes are material, we may notify users through email, dashboard notification, website notice, or other reasonable means. 

Your continued use of Galla.app after the updated Privacy Policy becomes effective means that you acknowledge the updated policy

31. Contact Information

For privacy-related questions, requests, complaints, or grievances, contact: 

Treewalker Digital Private Limited
Website: https://galla.app
Registered Office: Vikas Plaza.38/ 1A (4), Kanappana Agrahara, Hosur Rd, Phase II, Electronic City, Bengaluru, Karnataka 560100 
Legal Email: legal@treewalkerlabs.com
Phone: +91-6366-740-274
GSTIN: 29AAICT9733E1ZX 

32. Recommended Related Policies 

This Privacy Policy should be published along with: 

1. Terms of Service. 
2. Cookie Policy. 
3. Data Processing Addendum. 
4. Subprocessor List. 
5. Acceptable Use Policy. 
6. WhatsApp Marketing Policy. 
7. Security Policy. 
8. Data Retention and Deletion Policy. 
9. SLA and Support Policy. 
10. Responsible Disclosure Policy.