This Privacy Policy explains how AIVIO CRM collects, stores, processes, and protects customer data when using our WhatsApp Cloud API integration.
Transparency
We list all metadata and message payloads collected through webhook integrations.
Encryption
All access credentials, API keys, and app secrets are stored in secure Postgres clusters.
Data Integrity
We respect data storage boundaries and process webhook payloads inside verified nodes.
1. Information We Collect
To power the WhatsApp CRM suite, we collect and process the following categories of information:
User Account Information: Registration details including your business name, mobile number, email, and billing info.
Meta API Credentials: WhatsApp Business Account ID, Phone Number ID, App ID, App Secret, and System User Access Tokens configured inside your dashboard settings.
Messaging Data: Incoming and outgoing chat history, message content, media, Location information, and delivery/read status packets received via webhook alerts.
2. How We Process WhatsApp Data
We act as a data processor for the conversations flowing through the WhatsApp Business Platform. This data is exclusively processed to:
Render dynamic chats and logs inside your stateful Kanban Pipeline.
Trigger stateful keyword-matching automations and sequence drips created by your admins.
Compute delivery rates, quality scores, and real-time read metrics.
We never use user conversation data or WhatsApp payloads for advertisement profiling, model training, or selling to third-party data aggregators.
3. Security and Token Safekeeping
We prioritize the security of your Meta Developer integration. All system-wide credentials are safeguarded through:
Server-Side Only Execution: App Secrets and Access Tokens are processed on secure nodes and never sent to client browsers.
Strict Verification: All incoming payloads from Meta webhooks are authenticated via HMAC-SHA256 signature verification matching your App Secret.
Secure Transport: All data is transmitted utilizing TLS 1.3 encryption.
4. Your Rights and Data Deletion
We respect your rights under global data frameworks (including GDPR & CCPA). You hold complete control over your data:
Instant Data Erasure
You can purge your WhatsApp integration history, custom fields, and credentials at any time. For explicit step-by-step guidance, please visit our public Data Deletion Instructions Page.
5. Digital Personal Data Protection Act, 2023 (India)
This is the Privacy Notice shown when you register. It explains the personal data we collect from account holders and your rights under the DPDP Act, 2023.
What we collect and why
s.5 / s.6
Full name — to address you and label your workspace.
Email — for login, account security alerts, invoices and receipts.
WhatsApp mobile number — for your sign-up / login OTP and important service alerts.
City, business name and industry — to set up your workspace, invoice defaults and industry presets.
Password — stored only as a one-way hash; nobody at AIVIO can read it.
Technical data (IP address, browser) — for security and as proof of the consent you give here.
How we process it
s.4 / s.8
Only to create and run your account, bill your usage and support you.
We never sell your personal data or use it to train third-party AI models.
Shared only with processors needed to run the service: cloud database hosting, the WhatsApp Business API (Meta), email delivery and the payment gateway.
Promotional messages are sent only if you tick the separate, optional marketing box.
How we store and protect it
s.8(5) / s.8(7)
Encrypted in transit (TLS) and at rest on our hosting provider.
Access is limited by role, and sensitive actions are audit-logged.
Kept while your account is active. On deletion it is erased, except records the law requires us to keep (such as GST / tax invoices) and your consent record.
What we will tell you
s.8(6) / s.11
On request: a summary of the personal data we hold about you and how it is processed.
On request: the processors your data is shared with.
If a personal data breach affects you, we will inform you.
What you can change
s.12
Company details (logo, address, GSTIN, bank) — any time in the app under Proposals → Company details.
Password — any time via “Forgot password” on the sign-in page.
Name, email, mobile, city or business details — write to our Grievance Officer and we will correct them.
What you can delete or withdraw
s.6(4) / s.12
Your account and all its data — request erasure from the Data Deletion page or by writing to our Grievance Officer.
Marketing consent — withdraw any time by writing to us; your account is not affected.
Withdrawing consent for account processing means closing the account, since we cannot run it without that data.
Grievances
s.13
Write to our Grievance Officer (details below) for any privacy question or complaint.
If you are not satisfied with our response, you may complain to the Data Protection Board of India.
Grievance Officer: admin@aiviox.in · Notice version account-notice-2026-09-26
6. Google User Data (Gmail and Google Drive)
You can choose to connect a Google account to Aivio Intelligence. You may connect any Google account you own; it does not have to be the email you sign in with.
Gmail (read-only): with your permission we read the emails in your connected mailbox that match the rules you set (for example, the vendors who send you bills), including their attachments and invoice links, to create purchase bill records in your own Aivio workspace. We cannot send, delete or change your emails.
Google Drive (files this app creates or you pick): we save copies of your own documents, such as purchase bills and invoice PDFs, into the folders you choose.
Only for features you see: Google user data is used only to provide these features to you. It is not sold, not used for advertising, and not used to develop, improve or train generalized AI or machine-learning models.
Who processes it: to read the amounts on a bill, its text may be sent to the AI model service that powers Aivio’s bill reading, only to return the result to you. People at Aivio do not read your emails, except with your explicit permission for a support request, when needed for security or legal reasons, or when the data is aggregated and anonymized for internal operations.
Storage and security: Google access tokens are encrypted and kept only on our servers. We store only what is needed for the feature (sender, subject, date and the bill document), not your whole mailbox.
Your control: disconnect any time from Integrations in Aivio or from your Google Account’s third-party access page. Disconnecting revokes our access and deletes the stored tokens and email references; bills you kept stay in your workspace until you delete them.
Aivio Intelligence’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.