Privacy Policy

1. Information We Collect

1.1 Information You Provide

• Account information (name, email address, password)
• Instagram account access tokens (connected via official Meta OAuth)
• WhatsApp Business number and associated configuration
• Payment configuration (your own Razorpay API keys or UPI ID — see §5)
• Workflow settings (keywords, DM messages, automation rules)
• Communication preferences and settings
• Customer support inquiries and correspondence

1.2 Information We Collect on Your Behalf (from Your Customers)

When a consumer comments on your Instagram post and triggers an Inboxa workflow, we may collect and store:

• Instagram username and Instagram user ID of the commenter
• WhatsApp phone number (only if voluntarily shared by the consumer in a DM)
• Interaction history (DM sent, WhatsApp message sent, payment link clicked)
• Payment status (paid / unpaid — via your Razorpay webhook or manual confirmation)

Important: You are the data fiduciary for your customers' data. Inboxa processes this data on your behalf as a data processor. You are responsible for ensuring your customers have consented to this processing. Inboxa never uses your customers' data for its own marketing or analytics.

1.3 Automatically Collected Information

• Usage data and platform analytics
• Device information (IP address, browser type, operating system)
• Cookies and similar tracking technologies
• Dashboard activity and feature usage metrics

2. How We Use Your Information

We use your information to:

• Provide and operate Inboxa's Instagram DM and WhatsApp automation services
• Process your subscription and manage billing
• Send automated DMs and WhatsApp messages on your behalf using official Meta APIs
• Display your leads, conversations, and revenue data in your dashboard
• Improve and optimise our platform
• Communicate with you about product updates, support, and new features
• Ensure compliance with Instagram's Terms of Service, Meta Platform Terms, and WhatsApp Business API policies
• Detect and prevent fraud or unauthorised access
• Comply with applicable Indian law, including the Digital Personal Data Protection Act, 2023

3. Data Sharing and Disclosure

We do not sell your personal information or your customers' data.

We may share data with:

• Meta / Instagram: To facilitate DM automation through the official Instagram Graph API
• Meta / WhatsApp: To send WhatsApp Business messages via official Cloud API or BSP partners
• WhatsApp BSP Partners (e.g. WhatChimp): For WhatsApp message delivery; contractually bound to confidentiality
• Razorpay: For payment webhook processing only — Inboxa never custodies funds
• Supabase: Our database infrastructure; data stored with encryption at rest
• Make.com: Our automation layer; data passes through but is not retained
• Legal Requirements: When required by applicable Indian law, court order, or to protect our rights

A complete sub-processor list is available on request at tejviq@gmail.com.

4. WhatsApp Messaging Consent

Inboxa sends WhatsApp messages only to consumers who have voluntarily shared their phone number inside an Instagram DM conversation. By configuring an Inboxa workflow, you represent that:

• Your Instagram post or DM clearly invites consumers to share their number
• The consumer has voluntarily provided their number in response
• You will use that number only for the purpose communicated (order follow-up, payment link)
• You will honour any opt-out or "STOP" reply immediately

Sending unsolicited WhatsApp messages through Inboxa is prohibited and grounds for account termination.

5. Payment Data — Important Clarification

Inboxa does not custody, hold, or process your customers' payments.

All payments flow directly from your customer to your own Razorpay account or UPI ID. Inboxa only reads the payment status via your Razorpay webhook to update your dashboard. We never store card numbers, bank account details, or full payment credentials. Razorpay's own privacy policy governs payment data handled on their platform.

6. Data Security

We implement the following measures to protect your information:

• Encryption of data in transit (TLS) and at rest (AES-256)
• Row-Level Security (RLS) on our database — each brand's data is isolated
• Instagram access tokens stored encrypted; never exposed in the frontend
• Secure authentication via Supabase Auth
• Webhook signature verification for all inbound Razorpay and Meta events
• Regular security reviews and access controls

Despite these measures, no system is completely secure. Please notify us immediately at tejviq@gmail.com if you suspect unauthorised access.

7. Your Rights and Choices

Under the Digital Personal Data Protection Act, 2023 (India) and applicable law, you have the right to:

• Access your personal information held by us
• Correct inaccurate or incomplete data
• Delete your account and associated data — actioned within 30 days
• Withdraw consent for data processing (may prevent us from providing the service)
• Opt out of marketing communications at any time
• Export your data in a portable format on request

To exercise any of these rights, contact us attejviq@gmail.com.

8. Your Customers' Rights

If a consumer whose data you have collected via Inboxa requests access to, correction of, or deletion of their data, you are responsible as the data fiduciary for honouring that request. Inboxa will assist you in fulfilling such requests within our platform. Consumers may also contact us directly at tejviq@gmail.com and we will route the request to the appropriate brand account.

9. Cookies and Tracking

We use cookies and similar technologies to keep you logged in to your Inboxa dashboard, analyse platform usage, and improve features. You can control cookie preferences through your browser settings. Disabling cookies may affect dashboard functionality.

10. Data Retention

• Active accounts: Retained for as long as your account is active
• After cancellation: Retained for 90 days to allow reactivation, then permanently deleted
• Lead / customer data: Retained for 12 months after last activity, then deleted
• Legal obligations: Billing records and legal correspondence retained as required by Indian law

11. Children's Privacy

Inboxa is intended for users aged 18 and above. We do not knowingly collect information from minors. If you believe a minor has created an account, contact us at tejviq@gmail.com and we will delete it promptly.

12. International Data Transfers

Your data may be stored or processed by our infrastructure providers (Supabase, Make.com) on servers outside India. We ensure that appropriate contractual safeguards are in place for any such transfers, consistent with applicable Indian data protection requirements.

13. Grievance Officer

In accordance with the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023, we have appointed a Grievance Officer:

14. Changes to This Policy

We may update this Privacy Policy as Inboxa develops. We will notify you of significant changes via email or through your dashboard at least 14 days before changes take effect. The latest version, with its effective date, will always be available at inboxa.in/privacy. Continued use after the effective date constitutes acceptance.

15. Contact Us

For any questions about this Privacy Policy or your data, contact us at:

This Privacy Policy is governed by the laws of India, including the Information Technology Act, 2000, and the Digital Personal Data Protection Act, 2023.