Privacy Policy

1. Who we are and when this policy applies

“Beyox,” “we,” “us,” or “our” means Beyox, an Indian partnership firm. Our correspondence address is Madras CO Works, 70, Race Course Road, Race Course, Gopalapuram, Coimbatore, Tamil Nadu 641018, India. This policy applies to our public website, consulting and software services, and Beyox Platform.

For information submitted directly to Beyox, such as website inquiries and Beyox account details, Beyox determines why and how that information is handled. When a business customer uses Beyox Platform to communicate with people through its own WhatsApp Business Account, that customer controls the relevant WhatsApp conversations and customer records, and Beyox generally processes that data on the customer's behalf and instructions. The business you communicate with remains responsible for its own privacy notices, permissions, and lawful use of your information.

2. Personal data we collect and process

Website, consulting, and recruitment information

• Contact details and inquiry content, including your name, email address, phone number, company details, and the message you send.
• Recruitment details, such as your name, email address, phone number, CV or resume, and information you include in an application.
• Contract, billing, project, and business correspondence needed to provide consulting or software services.

Beyox Platform account and workspace information

• User and workspace details, such as name, business name, email address, role, workspace membership, hashed password, and authentication or session tokens.
• WhatsApp Business Account configuration received through Meta's Embedded Signup and Cloud API, including account and phone-number identifiers, access tokens, permissions, templates, webhook events, and related configuration data.
• Product usage, support, audit, and security information, such as feature activity, login history, IP address, browser or device information, error logs, and support communications.

WhatsApp conversation and CRM information

On behalf of each Beyox Platform business customer, we may process the names, WhatsApp phone numbers, profile information, message content and media, message timestamps and delivery status, conversation assignments and notes, lead-qualification details, and associated catalog, product, order, and customer-service data. This can include personal data about people who message a customer's WhatsApp business number even if they do not have a Beyox account.

Website analytics and cookies

Our website uses Google Tag Manager and Google Analytics. These tools may use cookies or similar identifiers and process information such as your IP address, device and browser type, approximate location, referring page, pages viewed, and interaction events. We do not load these analytics tools unless you select “Accept analytics” in our cookie banner. We store your consent choice in your browser's local storage for six months. When accepted, Google Analytics cookies are configured to expire six months after they are first set and not to renew on each page visit. You can change your decision at any time through “Cookie Settings” in the footer or limit cookies through your browser and applicable Google controls.

3. How we use personal data

We use personal data to:

• respond to inquiries, evaluate job applications, deliver consulting work, administer contracts, and provide support;
• create and secure accounts, manage workspaces, authenticate users, prevent fraud and abuse, and maintain service logs;
• connect a customer's own WhatsApp Business Account, receive webhook events, and send and receive messages on that customer's behalf through Meta's Cloud API;
• store and organize contacts, conversations, messages, leads, orders, and catalog information as an AI-assisted CRM;
• use Sarvam AI to generate suggested replies, summarize conversations, and extract lead-qualification details from message content for the relevant customer workspace;
• monitor reliability, understand product and website usage, troubleshoot issues, improve our services, and comply with law and enforce our agreements.

We do not sell personal data or Meta Platform Data, and we do not use WhatsApp message content or customer CRM data for advertising. We do not use customer content to train models operated by Beyox, and model training is disabled for Beyox's Sarvam AI organisation. Sarvam AI processes selected customer content only to provide the requested reply-generation, conversation-summary, and lead-qualification features; Beyox does not authorize that content to be used to train Sarvam AI's general-purpose models.

4. Meta Platform Data and customer instructions

Information received from Meta or WhatsApp through Beyox Platform, including access tokens and WhatsApp Business messaging data, is “Platform Data” where defined by the applicable Meta terms. We process that data only to provide and secure Beyox Platform for the relevant business customer, as described in this policy and as directed by that customer.

Our handling of Platform Data is also subject to the Meta Platform Terms, applicable Meta Developer Policies, WhatsApp Business Messaging Policy, and other applicable Meta and WhatsApp terms. This policy does not replace or modify those terms.

5. When we share data

We disclose personal data only as needed for the purposes above, under appropriate instructions and safeguards, to:

• the relevant Beyox Platform customer and its authorized workspace users, who can view and manage their own contacts, conversations, and related records;
• Meta Platforms and WhatsApp, to connect WhatsApp Business Accounts and transmit messages, templates, delivery events, account configuration, and related Platform Data;
• Sarvam AI, to process selected message content to provide AI-generated replies, summaries, and structured lead details;
• Google, through Google Tag Manager and Google Analytics for website measurement;
• hosting, database, storage, email, monitoring, and security providers contracted to operate and protect the Beyox website and Beyox Platform. These providers may process only the information reasonably necessary to deliver their services to us and must handle it under applicable contractual and legal obligations;
• professional advisers, regulators, courts, law enforcement, or a successor in a corporate transaction where disclosure is required by law or reasonably necessary to protect rights, safety, and the service.

Service providers are permitted to handle data only to provide the contracted service and subject to applicable contractual and legal obligations. Data may be processed outside your state or country, subject to safeguards required by applicable law.

6. Retention and deletion

We retain personal data only while it is reasonably necessary to provide the services, fulfill the purposes in this policy, secure our systems, resolve disputes, and meet legal, accounting, or contractual requirements. Workspace data is kept while the customer account is active and is deleted or returned after account closure or a valid deletion instruction, except where law requires retention. Data in backups is removed on the applicable backup-rotation schedule and is not restored for ordinary use.

• Website and consulting inquiries: up to 24 months after our last interaction, unless the inquiry develops into an active customer relationship.
• Recruitment records: up to 12 months after the applicable hiring decision, unless you consent to longer retention or law requires it.
• Account and workspace data: for the duration of the customer's active subscription. Following account closure or a valid deletion request, we delete eligible account, workspace, WhatsApp conversation, and Meta Platform Data from active production systems as soon as reasonably possible and no later than 30 days.
• Security, audit, and service logs: ordinarily up to 12 months after collection, unless a longer period is needed to investigate an incident or comply with law.
• Backups: deleted data may remain in encrypted or access-restricted backups for up to 90 days before being overwritten through the normal backup cycle. Backup copies are not restored for ordinary business use.
• Legal and financial records: retained for the period required by applicable tax, accounting, contractual, or legal obligations, after which they are deleted or de-identified.

How to request deletion

1. Email nithya@beyox.co.in with the subject “Data deletion request.”
2. State whether the request concerns a Beyox account, a business workspace, a website inquiry, or a WhatsApp conversation. For a WhatsApp request, include your phone number and the name or phone number of the business you contacted so we can locate the correct customer workspace.
3. We may ask for limited additional information to verify your identity and authority. We will confirm receipt, coordinate with the relevant business customer where it controls the data, and delete or de-identify eligible data within the period required by applicable law and Meta's requirements. We will explain if we must retain specific information by law.

WhatsApp users may also contact the business they messaged directly. A Beyox Platform customer can request workspace deletion through its authorized administrator or by using the email process above. This process is available whether or not the requester has a Beyox account.

7. Your choices and rights

Depending on where you live, you may have rights to request access, correction, deletion, restriction, objection, withdrawal of consent, or a copy of personal data, and to raise a grievance with us or a regulator. To exercise a right, use the contact information below. Rights involving data controlled by a Beyox Platform customer may be referred to that customer for action.

8. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect personal data, including access controls, authentication, password hashing, transport security, logging, and workspace separation where applicable. No online service or storage method is completely secure, so we cannot guarantee absolute security. Security concerns can be reported to the contact below.

9. Children

Our website and services are intended for businesses and are not directed to children. We do not knowingly collect personal data directly from children. If you believe a child has provided data to us, contact us so we can review and delete it where appropriate. Beyox Platform customers are responsible for ensuring that their own WhatsApp communications comply with applicable age and consent requirements.

10. Changes to this policy

We may update this policy when our practices, services, or legal obligations change. We will publish the updated version here, revise the effective date, and provide any additional notice required by law.

11. Contact us