Privacy Policy

1. Introduction

Sunlight uPVC Windows is a brand of Sunlight Fenestration Private Limited, Chennai. This policy is the plain-English version of what happens to your information when you use our website or message our WhatsApp Business number. There is no small print hiding somewhere else.

It covers two things: enquiries you submit through this website, and conversations with LUMI, our automated assistant on WhatsApp.

Under India’s Digital Personal Data Protection Act, 2023, we are the Data Fiduciary for everything described here — meaning we are the ones answerable for it.

2. Information We Collect On This Website

When you submit an enquiry via our website, we may collect the following personal data:

• Full Name
• Email Address
• Phone Number
• Type of Service Requested
• Project Details or Technical Specifications

3. Information We Receive On WhatsApp

When you message our WhatsApp Business number, you are talking to LUMI, an automated assistant. Here is exactly what reaches us:

• Your phone number. WhatsApp gives it to us the moment you send a message. It is how our reply finds you, and it is the reference we file your conversation under.
• Your WhatsApp display name. Sent to us with each message by Meta. We do not save it.
• What you write— the text of your messages, and the buttons or list options you tap. This is saved, because a conversation with no memory is not much of a conversation.
• Whatever you choose to tell us in that text: your name, your locality, the size of the opening, your budget, when you are free for a site visit. You decide how much to share.
• Technical details attached by WhatsApp— message ID, timestamp and message type. We keep message IDs briefly so a network retry does not make us answer you twice.
• Photos, voice notes and files are not opened. LUMI cannot read attachments. We do not download the file or its contents — our system records only that a message of that type arrived, and replies asking you to send your requirement as text.

What we never ask for:we do not ask for Aadhaar or PAN numbers, bank or card details, UPI PINs, OTPs, or health information — and you should not send them. If something like that reaches us anyway, we delete it when we notice. LUMI will never ask you to pay anything over chat.

4. How We Use Your Information

The information collected is used for the following purposes:

• To respond to your specific enquiries and provide requested information.
• To generate accurate quotations and facilitate project consultations.
• To search our own product documentation, so an answer is based on our actual specifications rather than guesswork.
• To remember the last few messages of a WhatsApp conversation, so you are not repeating yourself.
• To hand you to a human when you ask about price, want a site visit, or raise a complaint.
• To improve our product range and website functionality.
• To keep the service standing up — usage limits and a daily processing cap that stop one sender, or one bad day, from taking the assistant down for everyone.

Under the DPDP Act, our basis is your consent: you submitted an enquiry, or you started a conversation with our business number and continued it, knowing this policy is published. You can withdraw that consent at any time (see Section 12).

What we do not do:we do not sell, rent or trade your personal information to anyone. We do not add you to promotional lists because you asked a question. Your messages are not used to train any AI model — ours or anyone else’s. We do not build advertising profiles or share your data with advertisers.

5. AI Processing And Third Parties

LUMI’s replies are generated by artificial intelligence. That means your WhatsApp messages are processed by a third-party AI provider on our behalf. We think you should know precisely who handles what:

• Meta Platforms (WhatsApp Business Platform) — carries every message in both directions. Meta’s own handling of your data is governed by WhatsApp’s Privacy Policy and is outside our control.
• Anthropic PBC (the Claude API), United States — writes LUMI’s replies. We send it your message text, the last few turns of the conversation, and the product documents we retrieved for that question. We do not send your phone number or your name — they are not part of that request. If you write in Tamil or another non-English script, your message is also sent to be translated into English first, because our product documentation is in English and the search only works against it. Under Anthropic’s commercial terms, business API data is not used to train their models, and is retained only for a limited period for safety and abuse monitoring.
• Supabase (managed PostgreSQL)— the database where conversation records are stored.
• Google— Analytics and reCAPTCHA on this website only, as described in Sections 7 and 8. Google has no part in the WhatsApp assistant.
• Our own team, in Chennai— the people who read your enquiry and call you back. This is the point of the whole thing.

If we connect an internal alerting or CRM tool in future, the only thing it would receive is a handoff notice: your number, the message that triggered it, and the time. We will list it here before that happens.

Separately, we may disclose data if the law genuinely requires it — a court order, a valid request from an authority, or to establish or defend a legal claim. We do not hand over customer chats on an informal request.

6. Where Your Data Is Stored

So yes — as things stand, your data leaves India. The DPDP Act permits this except to countries the Government has specifically restricted, and none of these is on that list. Each provider is bound by its own data-protection commitments to us. If our storage location changes, this table changes with it.

8. Google reCAPTCHA

We use Google reCAPTCHA v3 on our website to prevent spam and abuse on our contact forms. This service operates by collecting hardware and software information, such as device and application data, and sending these data to Google for analysis.

The information collected in connection with your use of the service will be used for improving reCAPTCHA and for general security purposes. It will not be used for personalized advertising by Google. By using the reCAPTCHA service, you consent to the processing of data about you by Google in the manner and for the purposes set out above. For more information, please visit the Google Privacy Policy and Terms of Service.

9. Data Protection & Security

We implement industry-standard technical and organizational security measures to protect your personal data against unauthorized access, alteration, disclosure, or accidental destruction. For the WhatsApp assistant specifically:

• Every incoming message from WhatsApp is cryptographically signature-verified. Anything not genuinely from Meta is rejected, not processed.
• All traffic is encrypted in transit over TLS.
• The database has row-level security enabled. Public-facing keys can read none of these tables — only our server can.
• Phone numbers are masked in our server logs. A log line shows 91***576, never the full number.
• Message length is capped, message rates are limited per number and overall, and there is a hard daily ceiling on AI processing.
• Replies are checked before they are sent. LUMI is blocked from quoting a firm price, and from acting on instructions someone might try to smuggle into our documents.
• Access to stored conversations is limited to the staff who need it to do their job.

No system is perfectly secure, and we are not going to pretend otherwise. If a breach affects your data, we will inform you and report it to the Data Protection Board of India, as the DPDP Act requires.

10. Data Retention

We retain website enquiry information only for as long as necessary to fulfil the purposes outlined in this policy, or as required to comply with legal, accounting, or reporting obligations. WhatsApp data is cleared automatically on a fixed schedule:

A scheduled job clears these records every day. If you ask us to delete your data, that request overrides every row in this table — see our data deletion instructions.

Separately, if you go on to place an order with us, the sale records — quotation, invoice, warranty — are business records we are required to retain under Indian tax and company law.

11. What LUMI Is, And What It Cannot Do

LUMI is software, not a person. It is quick and it is usually right, but it can be wrong.

• It cannot quote you a firm price. uPVC pricing depends on measurements, glass, hardware and site conditions. Any figure you need to rely on comes from a human, after a site measurement.
• Nothing LUMI says is a binding commitment on specification, delivery date, warranty or price until a person from our team confirms it in writing.
• It never takes payments and will never ask you for card details, UPI IDs or an OTP. If any chat claiming to be Sunlight asks you to pay, stop and call us on +91 98418 19576.
• A human can step in at any time. Ask to speak to someone and we will arrange it.

12. Your Rights

Under the Digital Personal Data Protection Act, 2023, you can:

• Ask what we hold about you and how it is being used.
• Ask us to correct anything wrong, incomplete or out of date.
• Ask us to delete your number, your enquiry and your chat history.
• Withdraw your consent — we stop processing and delete what we hold. LUMI will no longer be able to help you over WhatsApp, though you can always call us.
• Nominate someone to exercise these rights on your behalf if you die or become incapacitated.
• Raise a grievance with us, and escalate it if we do not resolve it.

How to use any of them: message our WhatsApp number from the number in question, or email info@sunlightupvcwindows.com with the subject “Data request” and the phone number you used to contact us. We reply within 7 working days. There is no charge.

Deletion is straightforward enough to have its own page: how to delete your data.

13. Messages From Us

We reply to conversations you start. We do not buy phone number lists, and we do not send promotional broadcasts to people who never asked to hear from us. If we ever send updates or offers by WhatsApp template message, it will only be to numbers that have asked for them, and there will always be a way to stop.

To stop hearing from us: tell us in the chat, or email us. You can also block or report our number in WhatsApp at any time — that works instantly and does not need our cooperation.

14. Children

This service is meant for adults arranging windows and doors. It is not directed at anyone under 18, and we do not knowingly collect a child’s data. If we find that we have, we delete it.

15. Third-Party Links

Our website may contain links to external sites. Sunlight uPVC Windows is not responsible for the privacy practices, terms of use, or content of such third-party websites.

16. Changes To This Policy

If what we do with your data changes, this page changes first — and the effective date at the top changes with it. We will not quietly start using your information for something new and mention it afterwards.