Privacy Policy

1. Who we are #

AIO Automations is a brand of Innocreative Studios LLP, a limited liability partnership registered in India with its office at 43-L, 43, Kehri Gaon, Prem Nagar, Dehradun, Uttarakhand 248007 ("AIO Automations", "we", "us"). Our products, currently WhatsApp Messenger for Zoho CRM (the "Service"), are provided by Innocreative Studios LLP. This policy explains how we handle information when businesses install and use the Service, and when people exchange messages with those businesses through it. It also covers this website.

2. Our role #

The business that installs the Service (our "Customer") decides whom it messages and what it says. For message content and the contact details of the people a Customer communicates with ("End Users"), the Customer is the controller and we act as a processor or service provider on the Customer's instructions. For account, billing and support information about our Customers' staff, and for visitors to this website, we are the controller.

If you are an End User who has messaged a business that uses the Service, please contact that business first about your data. We will help them respond to your request.

3. Information we process #

We do not ask for, and Customers must not send through the Service, payment card numbers, government ID numbers, health information or other special categories of data unless the law and Meta's policies allow it.

4. How we use information #

• To send and receive WhatsApp messages on the Customer's behalf and record them in the Customer's CRM.
• To import, submit and track message templates for the Customer's WhatsApp Business Account.
• To record consent, honour opt-out requests and prevent messages to people who have opted out.
• To authenticate requests, keep the Service secure and detect abuse.
• To provide support, fix problems and improve reliability.
• To bill for the Service and meet legal and tax obligations.

Our legal bases, where the GDPR or similar laws apply, are performance of our contract with the Customer, our legitimate interests in running a secure and reliable service, and compliance with legal obligations. Where we act as a processor, the Customer is responsible for having a lawful basis and any consent needed to message End Users.

5. Data from the Meta WhatsApp Business Platform #

The Service uses Meta's WhatsApp Business Platform. For data we receive from Meta ("Platform Data"):

• We use it only to provide the Service features the Customer has enabled, as described above.
• We do not sell, license or rent Platform Data, and we do not use it for advertising, profiling, or to build or augment user profiles.
• We do not share it with third parties except the service providers listed below, who are bound to process it only for us, or where the law requires.
• We do not use it to make eligibility decisions about people, for example for credit, housing, employment or insurance.
• We delete Platform Data we hold when it is no longer needed for the Service, when the Customer disconnects or uninstalls, or when we receive a valid deletion request, as described in Retention.

We follow the Meta Platform Terms, the WhatsApp Business Terms of Service and the WhatsApp Business Messaging Policy.

6. How we share information #

We share information only with:

• Meta Platforms, Inc. and its affiliates, to deliver WhatsApp messages and manage templates.
• Zoho Corporation, which hosts the Customer's CRM data and our backend on Zoho Catalyst.
• RingCentral, Inc., only if and when a Customer enables SMS through RingCentral.
• Professional advisers, and authorities when the law requires it or to protect rights, safety and the integrity of the Service.
• A buyer or successor if our business is reorganized or sold, subject to this policy.

The current list of sub-processors is on our Security & Data Processing page.

7. Where data is stored and international transfers #

Messages, contacts and attachments are stored in the Customer's Zoho CRM organization, in the Zoho data center that serves that organization. Our backend runs on Zoho Catalyst. Meta processes messages on its own infrastructure under its terms. Where information moves between countries, we rely on the safeguards our providers offer, such as Standard Contractual Clauses.

8. Retention #

• Messages and attachments stay in the Customer's CRM until the Customer deletes them or uninstalls the Service. The Customer controls this.
• Access tokens are kept while the connection is active and deleted within 30 days after the Customer disconnects or uninstalls.
• Operational logs are kept for up to 30 days, then deleted, unless we need them longer to investigate a security incident.
• Billing and contract records are kept as long as tax and accounting laws require.

9. Security #

We encrypt data in transit with TLS, encrypt stored secrets, verify the signature of every incoming webhook, sign requests between the CRM and our backend, and limit staff access to what is needed for support. No system is perfectly secure, but we will notify affected Customers without undue delay if we become aware of a breach involving their data. More detail is on our Security page.

10. Your rights #

Depending on where you live, you may have the right to access, correct, delete or export your personal information, to object to or restrict processing, and to withdraw consent. In India, the Digital Personal Data Protection Act, 2023 gives you the right to access, correct and erase your data and to nominate another person to exercise your rights. Residents of California and other US states have the right to know, delete and correct information and not to be discriminated against for using these rights. We do not sell or share personal information for cross-context behavioural advertising.

To use these rights, email contact@aioautomations.com. We will respond within 30 days. If we process your data for a Customer, we will pass your request to that Customer. You may also complain to your local data protection authority.

Grievance Officer #

In line with the Information Technology Act, 2000 and the rules under it, our Grievance Officer is Priyanka Kakrey, reachable at contact@aioautomations.com or at the address below. We acknowledge grievances within 48 hours and resolve them within 30 days.

11. Deleting your data #

Customers can delete data at any time from their CRM, and can remove our access by disconnecting WhatsApp and uninstalling the Service. Anyone can request deletion of data we hold by following the steps on our Data Deletion page.

12. Children #

The Service is for businesses and is not directed to children under 16. We do not knowingly collect information from children.

13. Changes to this policy #

We will post updates on this page and change the effective date. If a change is material, we will notify Customers by email or in the Service before it takes effect.

14. Contact #

Innocreative Studios LLP (AIO Automations)
43-L, 43, Kehri Gaon, Prem Nagar, Dehradun, Uttarakhand 248007, India
Privacy: contact@aioautomations.com
Support: contact@aioautomations.com
Contact Us (book a meeting): https://aio-automations.zohobookings.in/182377000000030006