Pretiosus

Privacy Policy

Last updated: 18 October 2026

This policy explains what personal data Pretiosus handles, why, on what basis, how long we keep it, who we share it with, and the rights you have. It applies to this website, to our products Bridge (connectbridge.ai) and FirstTouch (firsttouch.si), and to our AI and automation development services. It is written with India's Digital Personal Data Protection Act, 2023 (the "DPDP Act") in mind.

1. Who we are and our role

Pretiosus is a sole proprietorship of Christy Robin, GSTIN 32BPCPV0220D1ZL, registered at 3rd floor V970, bldg no 60/44, JC Chambers, Panampilly Nagar, Kochi, Kerala 682036, India. Pretiosus is managed by Robin Rajan.

Our role depends on whose data is involved:

  • Our own customers and contacts. For people who visit this website, contact us, buy from us, or use our Products as staff of a customer business, Pretiosus decides why and how the data is processed, and acts as the Data Fiduciary.
  • The people our customers talk to. For the patients and customers who message a clinic or business using Bridge, and for the people who send enquiries to a business using FirstTouch, that clinic or business is the Data Fiduciary. Pretiosus processes the data on its instructions, as a Data Processor. The same applies to personal data we handle while building a system for a Services client. If you are one of these people, you can still contact us; we will pass your request to the business concerned and help it respond.

2. Personal data we collect

2.1 Data you give us

  • Name, email address, phone number and business name, when you contact us or use our contact or data request forms.
  • The content of your enquiries and correspondence with us.
  • Account details for staff of customer businesses, such as name, work email address and role.
  • Billing details, such as billing name and address, GST number, and records of what was bought and paid.

2.2 Payment data

Payments are handled by payment providers: Razorpay for INR subscriptions, Lemon Squeezy for USD subscriptions, and bank transfer or PayPal for Services invoices. Card payments may also be processed by Stripe. We never receive or store full card numbers. We may receive limited details from the provider, such as the card brand, the last four digits, and whether the payment succeeded.

2.3 Data processed for customer businesses

  • Bridge: WhatsApp messages that patients and customers send to a business, including any attachments; the sender's WhatsApp number and profile name, as supplied by Meta; message timestamps and delivery status; and replies and internal notes from the business's staff. If a business connects its Instagram professional account, Bridge can send one automatic private reply to people who comment on the business's posts, with a link the business chooses. For this, Bridge stores the business's Instagram account ID and username and its access token (encrypted), the automations the business sets up, and, for each comment it handles, the comment's ID, when it was made, and the commenter's Instagram ID and username. Bridge never reads or stores the text of comments, does not read the business's Instagram inbox, and sends at most one private reply per person per post, within 7 days of the comment.
  • FirstTouch: inbound enquiries a business receives, including the sender's name, contact details and message content, and the business's replies and notes.

Messages to a clinic may contain health-related information. We do not ask for it; patients choose what they send to their clinic. Replies in Bridge are scripted, not generated by AI.

2.4 Technical data

  • Server logs, including IP address, browser type, pages requested and timestamps.
  • Security and audit records, such as sign-in events and administrative actions in an account.
  • This website loads its font from Google Fonts, so your browser sends your IP address to Google when a page loads. The website does not use advertising or cross-site tracking.

2.5 What we do not do

  • We do not sell personal data.
  • We do not buy, rent or otherwise acquire contact lists.
  • We do not use personal data for cold outreach or unsolicited bulk messaging.

3. Why we use personal data, and on what basis

Under the DPDP Act we process personal data with consent, or for a legitimate use the Act permits. We use it only for the purpose stated.

  • Providing the Products: receiving, storing, organising and displaying conversations and enquiries, and providing FirstTouch's AI-assisted features, so a business can reply. Basis: our contract with the customer business, acting on its instructions; the business is responsible for its own basis for the data of the people who contact it.
  • Delivering Services to clients. Basis: our contract with the client.
  • Replying to enquiries you send us. Basis: your consent, given by contacting us.
  • Billing, accounting and tax. Basis: our contract with you, and our obligations under Indian tax and accounting law.
  • Support and account administration. Basis: our contract with the customer business.
  • Security and preventing misuse. Basis: legitimate use in connection with the security of our services.
  • Meeting legal obligations, such as responding to lawful requests from authorities. Basis: compliance with law.

4. Who we share personal data with

We share personal data only with the following, and only as far as needed for the purposes above. Service providers act on our instructions or, where stated, under their own terms.

  • Payment providers: Razorpay, Lemon Squeezy, PayPal and, where used, Stripe, to take payments. When you buy through Lemon Squeezy, Lemon Squeezy is the merchant of record and handles your purchase data under its own privacy policy.
  • Google Workspace, which we use for email and documents.
  • Microsoft, for Microsoft services we use, and where a FirstTouch customer connects a Microsoft mailbox.
  • Meta, through the WhatsApp Business Platform and Instagram messaging, which are needed to send and receive messages for businesses using Bridge. Those messages are also subject to Meta's own terms and privacy practices.
  • AI model providers used by our Products' AI-assisted features, such as those in FirstTouch. They receive the content needed to produce an AI-assisted feature's output.
  • Hosting and infrastructure providers that run our Products and this website.
  • The customer business a conversation or enquiry belongs to, and the staff it has authorised.
  • Authorities, where the law requires it, such as in response to a valid order of a court or authority.
  • A successor business, if Pretiosus's business is transferred, on condition that this policy continues to apply to your data.

5. International transfers

Several of the providers above process data outside India, including in the United States and Europe. Our Services clients are mostly outside India, so their data may also be transferred to India for us to work on it. Where data is transferred, we do so as permitted under the DPDP Act and any restrictions the Government of India notifies, and we use providers that commit contractually to protect it.

6. How long we keep it

  • Conversation and enquiry data in the Products: for as long as the customer business keeps its account and needs the data, or until it tells us to delete it.
  • Correspondence with us: as long as needed to deal with it and any follow-up.
  • Billing and tax records: for the period Indian tax and accounting law requires.
  • Security logs: for a limited period suitable for investigating incidents.

When we no longer need personal data and no law requires us to keep it, we delete it.

7. Security

  • Access to personal data is limited to people who need it for the purposes above, and they are bound by confidentiality.
  • Data is encrypted in transit (HTTPS/TLS).
  • Administrative actions in accounts are logged so access can be reviewed.

No system is completely secure. If a personal data breach occurs, we will inform the Data Protection Board of India and affected people as the DPDP Act requires.

8. Your rights

Subject to the DPDP Act and to verifying your identity, you can ask us to:

  • Access: give you a summary of the personal data we hold about you and how it is used.
  • Correct: fix inaccurate or incomplete data.
  • Erase: delete data we no longer need and are not required by law to keep.
  • Withdraw consent: stop processing that relies on your consent, from then on.
  • Handle a grievance: respond to a complaint about how your data has been handled.
  • Nominate: name someone to exercise these rights for you if you die or become unable to.

9. How to request deletion of your data

  1. Use our data request page, or email office@pretiosus.cc with the subject "Data deletion request".
  2. Include your name, the email address or phone number we hold for you and, if you messaged a business that uses Bridge or FirstTouch, the name of that business.
  3. We may ask you to confirm your identity before acting.
  4. We delete the data, or pass the request to the business that is the Data Fiduciary for it, and confirm to you what was done.

If you messaged a clinic or business through Bridge and want your messages deleted, you can also ask that business directly. Data we must keep by law, such as tax records, is kept only for the required period.

If you commented on the Instagram post of a business that uses Bridge, the same process applies; please include your Instagram username and the business's name. If your business connected its Instagram account to Bridge, it can disconnect at any time in Bridge under Settings → Instagram, or remove our app in Instagram's own settings (Apps and websites). Either one deletes the access token and switches every automation off; the account's ID and username, its automations and its reply records are kept, so the business can still see what was sent. When the account holder asks Instagram to have us delete their data, Instagram tells us, and Bridge deletes the connection, the access token, every automation and the record of each reply straight away. Copies in our backups are deleted within 30 days.

10. Children

Our Products are for businesses and are not directed at children. A parent or guardian may message a clinic using Bridge on a child's behalf; in that case we act on the clinic's instructions to meet the DPDP Act's requirements for children's data.

11. Grievance Officer and privacy contact

Send questions, requests and complaints about privacy to our Grievance Officer. We will acknowledge your grievance and respond within the time the DPDP Act requires. If you are not satisfied with our response, you can complain to the Data Protection Board of India.

Robin Rajan, Grievance Officer, Pretiosus
office@pretiosus.cc · +91 79998 38411
3rd floor V970, bldg no 60/44, JC Chambers, Panampilly Nagar, Kochi, Kerala 682036, India

12. Changes to this policy

If we change this policy we will update this page and its date. If a change materially affects how personal data is handled, we will also tell customer businesses by email.