India's Digital Personal Data Protection Act, 2023, is the law that governs what a business may do with personal information such as a customer's phone number and messages. It applies to a dental clinic and a coaching institute just as much as to a large company. The good news is that the rules are mostly common sense, and a well-built WhatsApp assistant follows them automatically.
Purpose and consent
You may use a customer's number for the purpose they gave it to you: to answer their enquiry, to book and remind them, to send a receipt. Promotional messages are a different purpose and need a clear yes. On WhatsApp this is easy: the assistant asks once, with a button, and remembers the answer.
The right to stop and the right to be forgotten
A customer can withdraw consent at any time. Replying STOP must end promotional messages immediately. A customer can also ask for their data to be deleted. Dunnflow's assistant understands STOP, START and DELETE MY DATA as plain messages, and deletion is done within seven days.
Keep only what you need
Store the conversation records and bookings you need to serve the customer and run the business, not more. Payment details never pass through the assistant; links open the customer's own UPI app or a card page run by the payment provider.
Tell people what you do
A short privacy note on your website or in the first message is enough: what you collect, why, how to stop, how to ask for deletion, and whom to contact. Dunnflow provides this wording for every client, and our own policy is on this site.