Privacy Policy

1. Introduction

Navdox ("the Platform", "we", "us", "our") is a WhatsApp Business management SaaS platform that enables businesses to send broadcast campaigns, manage customer conversations, and automate WhatsApp communication using Meta's official WhatsApp Business Platform API.

This Privacy Policy explains how we collect, use, share, and protect your information, and what rights you have over your data. It applies to all users of our platform, including business subscribers ("Clients") and, to the extent described below, the end customers of those businesses ("End Users").

2. Information We Collect

2.1 Account & Business Information

• Name, email address, and phone number when you register
• Company / organisation name and business details
• Billing information (processed securely via Razorpay; we do not store card details)
• Profile settings and preferences

2.2 WhatsApp & Meta Data

When you connect your WhatsApp Business Account to Navdox via Meta's Embedded Signup or API, we access and process:

• Your WhatsApp Business Account (WABA) ID and phone number(s)
• Message templates you create or submit for Meta approval
• Contacts you import or who message your business
• Conversation history between your business and your customers
• Message delivery and read receipts
• Media files (images, documents, audio) shared in conversations
• WhatsApp Business Profile information (display name, category, description)

2.3 Usage & Technical Data

• Log data: IP address, browser type, pages visited, timestamps
• Device information: device type, operating system
• Feature usage analytics to improve the platform
• Embedded Signup session data when clients onboard their WhatsApp Business Account

3. How We Use Your Information

• To provide, operate, and maintain the Navdox Platform
• To process your WhatsApp messages, broadcast campaigns, and automations
• To authenticate your account and maintain session security
• To process billing and send transactional emails
• To provide customer support and respond to queries
• To improve and develop new platform features
• To comply with legal obligations under applicable law
• To detect and prevent fraud, abuse, and security threats

We do not sell your personal data or your customers' data to any third party.

4. WhatsApp / Meta Integration

Navdox uses the Meta WhatsApp Business Platform API and Embedded Signup. By connecting your WhatsApp Business Account:

• You authorise Navdox to send and receive messages on behalf of your registered business number
• You remain the data controller for your customers' data; Navdox acts as a data processor
• You are responsible for ensuring you have obtained appropriate consent from your customers before messaging them
• You must honour opt-out requests from your customers promptly

Navdox complies with the WhatsApp Business Policy and Meta Platform Policies. Data shared with Meta is governed by Meta's own Privacy Policy.

5. Data Storage & Security

All data is stored on servers located in India. We implement industry-standard security measures including:

• TLS/SSL encryption for all data in transit
• Encryption at rest for sensitive data
• Role-based access controls and least-privilege principles
• Regular security audits and vulnerability assessments
• Multi-factor authentication for administrative access

6. Data Sharing & Third Parties

We share data only with the following categories of third parties, strictly for service delivery:

• Meta / WhatsApp: To deliver messages through the WhatsApp Business Platform API
• Razorpay: Payment processing (governed by Razorpay's Privacy Policy)
• Cloud infrastructure providers: Hosting, storage, and database services (data stored in India)
• Email service providers: For transactional and support emails

We do not share data with advertising networks or data brokers. We may disclose data if required by a valid court order, government request, or applicable law, or to protect the rights, property, and safety of Navdox, our users, or the public.

7. Cross-Border Data Transfers

Your data is primarily stored and processed in India. When messages are transmitted through Meta's WhatsApp Business Platform API, data may transit through Meta's global infrastructure. Such transfers are governed by Meta's Data Transfer Mechanisms and their standard contractual protections. We ensure that any sub-processors we engage provide an equivalent level of data protection.

8. Data Retention

• Account data is retained for the duration of your subscription and up to 90 days after account closure
• Conversation and message data is retained for up to 12 months by default
• Billing records are retained for 7 years as required by Indian tax law (GST Act)
• You may request earlier deletion — see Section 9 below

9. Your Rights & Data Deletion

Under India's Digital Personal Data Protection Act 2023 (DPDPA 2023) and applicable data protection law, you have the following rights:

To exercise any of these rights, contact us at connect@aswathcyber.com or visit our Data Deletion page. We respond within 30 days. You may also delete your account directly from Settings → Account → Delete Account inside the Navdox dashboard.

For End Users (customers of businesses using Navdox): If you are a customer of a business that uses Navdox and you wish to have your data deleted or access your data, please contact that business directly. You may also contact us at connect@aswathcyber.com and we will coordinate with the relevant business account holder to fulfil your request.

10. Cookies

Navdox uses only essential cookies to maintain your login session and platform preferences. We do not use third-party advertising cookies, tracking pixels, or behavioural profiling cookies.

11. Children's Privacy

Navdox is a business-to-business platform not directed at children under 18 years of age. We do not knowingly collect personal information from minors. If you believe a minor has provided us with personal data, contact us immediately at connect@aswathcyber.com.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email and/or a prominent notice on the Platform at least 15 days before the change takes effect. The "Last updated" date at the top of this page reflects the most recent revision. Continued use of the Platform after changes constitutes acceptance of the revised policy.

13. Grievance Officer

In accordance with the Information Technology Act 2000, the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021, and India's Digital Personal Data Protection Act 2023 (DPDPA 2023), we have appointed a Grievance Officer to address complaints and concerns:

14. Contact Us