Privacy Policy

1. About this Policy

1.1. WaBizBox by AKASOFT is a shared team inbox for WhatsApp, built on Meta’s WhatsApp Cloud API. It is provided by AKACORP GLOBAL TECH LLC, a limited liability company registered under number 312414442 (TIN), with its registered address at Farg’ona viloyati, Farg’ona shahri, Mash’al MFY, Mustaqillik shoh ko’chasi, 3S-uy, Uzbekistan (“AKASOFT”, “we”, “us”).

1.2. This Policy covers:

• our website, wabizbox.com, including the Book a demo form and these legal pages;
• the WaBizBox desk at app.wabizbox.com, which businesses and their teams use;
• our staff Console at console.wabizbox.com, which only AKASOFT staff use;
• email sent to us.

1.3. It sits alongside our Terms (Public Offer) and our Data Processing Agreement (the “DPA”). The DPA sets out how we process a business’s customers’ data on that business’s behalf. Where this Policy and the DPA differ about that data, the DPA applies.

1.4. By using the website or the service, you confirm that you have read this Policy. Where we rely on your consent, we ask for it separately, for example with the tick box on the Book a demo form.

1.5. WhatsApp is a trademark of Meta Platforms, Inc. WaBizBox is not affiliated with, endorsed by or sponsored by Meta.

2. Who is responsible for your data

Our role depends on whose data it is. The party that decides why and how personal data is used is the controller. Uzbekistan’s law calls it the operator, and India’s Digital Personal Data Protection Act calls it the Data Fiduciary. The party that handles data only on someone else’s instructions is the processor (in India, the Data Processor).

2.1. The business decides about its customers’ data. The chats, files, form answers, contacts and notes a business keeps in WaBizBox belong to that business. We process them only to provide the service, on the business’s instructions, as the DPA sets out. We do not use one business’s data for another business.

2.2. The business needs its own lawful basis for processing its customers’ data, and must give its customers its own privacy notice. That includes recording customers’ agreement before sending them marketing messages. If you are a customer of a business that uses WaBizBox, read that business’s privacy notice, and send your questions to the business first (section 12).

2.3. Meta. WhatsApp messages and calls reach WaBizBox through Meta’s WhatsApp Business Platform. Each business has its own WhatsApp Business Account, accepts Meta’s terms itself and pays Meta directly. Meta processes a business’s messages, calls and their details under that business’s own agreement with Meta. Meta is the business’s own provider, not our sub-processor, and we are not responsible for what Meta does. We receive the business’s messages as its solution provider, in one of two ways the business chooses: with an access token the business gives us, which we store encrypted, or, where the business assigns AKASOFT as a partner on its WhatsApp Business Account, with AKASOFT’s own access token. Meta’s own terms and privacy policy describe what Meta does with data.

2.4. A business may connect other apps to its WhatsApp Business Account. Meta then sends the business’s messages to those apps too. That is the business’s choice, and those apps are outside this Policy.

2.5. When a business turns on alert emails, they go to the team address the business chooses. The provider of that mailbox is the business’s own, not ours.

3. What we collect

3.1. Visitors to wabizbox.com

• The website sets no cookies, uses no browser storage, and runs no analytics or advertising tools. Its fonts and images come from wabizbox.com itself, so no other company learns of your visit from loading them.
• Every request passes through Cloudflare first. Cloudflare receives your IP address, the page you asked for and the headers your browser sends. It also decrypts, at its edge, anything you send, such as the Book a demo form, and encrypts it again to our server (section 6).
• Our web server keeps an access log. Each line holds your IP address, the time, the page, the result, the page you came from and your browser’s user agent.

3.2. Book a demo

3.2.1. When you send the form on our Book a demo page, we collect:

• your full name, work email, WhatsApp number and company (required);
• what your business does, how many people will answer chats, how many WhatsApp numbers you have, and whether Meta has verified your business (optional);
• anything you write under “Anything we should know?” (optional);
• your tick in the consent box, the exact words of that box, the version of this Policy the page showed, and the time;
• the language of the page.

3.2.2. We store your request in our database on our server. We email it to our team through Resend, with your email address as the reply address, and we read that email in our mailbox at Google Workspace. The request is also listed in our staff Console, where staff can mark it as handled.

3.2.3. To stop automated spam, the form uses a hidden field, a minimum time to fill it in, and limits on how often one connection can send it. No outside service is involved. The limits use your IP address, held in memory for an hour at most. If your connection reaches one of the form’s limits, our application log records only that a limit was reached, never your IP address. We do not store your IP address or your browser’s user agent with your request. Our application log refers to a request only by its reference number, never by what you typed. When our staff mark a request as handled, or open it again, the Console log records its reference number and the company name you gave (3.8). Your IP address also reaches Cloudflare and our web server’s access log (3.1), and the form passes through Cloudflare, which decrypts it at its edge (section 6).

3.2.4. We use your request to reply within one working day, to arrange and give the demo (30 minutes) and to follow up with you about WaBizBox. We have no newsletter or mailing list. If we start one, we will ask for your consent first.

3.3. Email to us

3.3.1. When you email us, we receive your address and your message. Our address, info@akasoft.io, is a mailbox at Google Workspace, where we read your email. Email sent to an address at wabizbox.com, such as a reply to one of our automatic emails, is received by Resend, on Amazon Web Services’ mail servers in Tokyo, Japan. To reach us, write to info@akasoft.io.

3.4. Businesses and the people who use the desk

• The business: its name, the short name used in its links, its country, its team size, what it means to use WaBizBox for (sales, support, bookings or other), whether it signed up or was set up by us, and its label settings.
• The people (admins and agents): name, email, role, the WhatsApp numbers each person answers, interface language, preferences (theme, density, quiet hours and notification choices), a password hash made with scrypt (never the password), whether the person is active, and when they were last seen.
• Sessions: a session token, stored only as a SHA-256 hash; the names of your browser and operating system; and when the session started and ends. We do not store your IP address or your browser’s full user agent with a session.
• Password links for invitations and resets: a token stored only as a SHA-256 hash, usable once.
• The activity log: what an admin changed, with internal ids and the names of the fields changed. It never holds passwords or tokens, and never a customer’s name or words.
• Notifications and the emails we send each person.
• Connection requests: the WhatsApp number to connect, the business’s Meta business portfolio id, a note and the request’s status.
• WhatsApp number records: Meta’s id for the number, the number as displayed, the WhatsApp Business Account id, the business’s access token if it gave us one (encrypted with AES-256-GCM), the number’s settings, and the quality rating and messaging limit Meta reports.
• Calls answered in the desk: when a team member answers a customer’s WhatsApp call, their browser’s connection details for the call, which include their IP address, are sent to Meta through the desk, and the call’s audio then flows directly between their browser and Meta. Meta therefore receives that team member’s IP address (section 6).
• Usage: daily totals for each business (messages, templates, Meta’s charges by category, chats, calls and storage). These are counts only.

Most of this comes from the people themselves. For a team member an admin invites, the name, email address, role and numbers come from that admin; the rest comes from the person once they use the desk. For a business we set up ourselves, its first details and its first admin’s come from the business, through our staff.

3.5. Signing up

3.5.1. Public sign-up on app.wabizbox.com is built but not open yet. Today we set up each business together with it.

3.5.2. When sign-up opens, the form will collect your email, name and password (stored only as a hash), your business’s name, country and team size, what you mean to use WaBizBox for, your language, and the versions of the Terms and the DPA it showed you. We email a 6-digit code to confirm your address. We store the code only as a keyed hash, and it works for 15 minutes. The sign-up request is deleted 24 hours after you confirm it, or 24 hours after you made it if you never confirm it.

3.6. Contracts and billing

• Records of accepted documents: the business’s name, the email of the person who accepted, which document (the Terms or the DPA) and which version, the language, how it was accepted, and the time. This Policy is read, not accepted, so no acceptance of it is recorded.
• Billing details: legal name, tax number, address and invoice email.
• Subscription: the plan, monthly or yearly billing, how the business prefers to pay us, the date it is paid up to, its status, when access ends, the export and deletion dates after closing, and who asked to cancel. Plans and prices are on our Pricing page or in your order form.
• Invoices: the invoice number, the buyer’s and seller’s details as issued, the lines, the total, the currency, the due date, the date paid and the email it was sent to.
• Payments: for each payment we record against an invoice, the amount, the currency, how it was paid, its reference, the date paid, and which of our staff recorded it.

We take no payments online, so we never receive card details.

3.7. Customers of businesses that use WaBizBox

3.7.1. We process this data for the business, on its instructions (section 2). What it contains depends on what customers send and on how the business sets up WaBizBox:

• Identity: the customer’s WhatsApp number (Meta’s WhatsApp user id) and WhatsApp profile name.
• Messages: text, button and list replies, reactions, locations, shared contacts and stickers, with delivery status (sent, delivered, read or failed) and times.
• Files: pictures, voice notes, audio, video and documents sent by the customer or the team, including files chosen inside WhatsApp Flows forms. They are stored on our server’s disk, readable only by the desk’s own system account.
• Form answers: whatever the business’s forms ask.
• Automation progress: the step reached, unfinished form answers and the language chosen.
• Contact record: name, email, company, job title, language, labels, team notes, and where the contact came from (WhatsApp, added by hand or a CSV import).
• Marketing consent: each opt-in and opt-out, with the exact words asked, the language, the source and the time. A customer’s WhatsApp “stop” is kept separately.
• Calls (incoming only): when it rang, who answered, how long it lasted, how it ended and any error code from Meta. There is no audio and no recording. Meta’s technical connection details for a call are kept only while it can be answered, then removed.
• Broadcasts: which customers a template went to, and what happened to each send.
• Team activity: internal notes, mentions, assignments, take-overs, closed chats and alerts sent.
• Alert emails: when the business turns them on, an email to the business’s chosen team address with the customer’s name, why they are waiting, and their last message or form answers.

3.7.2. This data comes from the customer through Meta, from the business’s team (typed in or imported from a CSV file), and from Meta (delivery reports and template status).

3.7.3. The desk’s picture viewer can read text in a customer’s photo. This happens in the agent’s own browser. The picture is not sent to any other service to be read.

3.8. Logs and security records

• The desk’s application log never holds a customer’s name, number, message id or message text, or any password or token. It does hold: for a failed desk sign-in, the email typed (if it looks like one) and the IP address; for a password reset asked for an unknown address, the IP address (for IPv6, only its network part); when a connection reaches one of the desk’s or the Console’s rate limits, the limit and the IP address (for IPv6, only its network part); and for each email we send, its kind and the recipient addresses, but not the subject.
• The staff Console log records what AKASOFT staff do, including the IP address at each staff sign-in. When staff mark a demo request as handled, or open it again, it records the request’s reference number and the company name.
• The database log leaves out the contents of rows.
• The web server’s access log (3.1) also covers app.wabizbox.com, so it holds the IP addresses of people using the desk.
• Rate limits on the website’s form, the desk and the Console count requests per IP address in memory, and a restart forgets the counts. When a connection reaches one of the desk’s or the Console’s limits, the application log records it with the IP address, as above. The website form’s limits never write an IP address to the log.
• The erasure record and the opt-out record hold only internal ids, never a customer’s number or name. They exist so that restoring a backup cannot bring back erased data or undo a customer’s “no”.

3.9. What we do not collect

• We never receive payment card details.
• We do not build advertising or analytics profiles.
• WaBizBox is not meant for special categories of data, such as health, religious or political views, or biometric or genetic data. If a customer sends such data to a business, the business is responsible for it (see the DPA).

4. Why we use data, and on what basis

Where the law that applies to you requires your consent, we rely on it, and you can withdraw it at any time (section 12).

5. Automation and automated decisions

5.1. Automation in WaBizBox follows rules the business sets: menus, buttons, lists, questions, WhatsApp Flows forms, exact keywords, working hours and hand-over to a human agent.

5.2. There is no AI in WaBizBox. We do not use personal data to train AI models, and we do no profiling.

5.3. The automation makes no decisions with legal or similarly significant effects on anyone. The business decides how to use it, including when a chat is handed over to a person.

6. Who receives data

6.1. We do not sell personal data. We share it only with the providers below, and with authorities where the law requires it.

6.2. For a business’s own WhatsApp numbers, Meta is the business’s provider, not ours (2.3).

6.3. We do not use analytics, advertising or tracking services, AI services, outside text-recognition services, CAPTCHA services, third-party fonts or scripts on the website, SMS or payment providers, or call relay services. We add no bot-check service of our own; Cloudflare, which carries all traffic, may check for automated traffic as part of its protection (10.1).

6.4. The list of our sub-processors for businesses’ customers’ data, and how we tell businesses about changes to it, is in the DPA.

7. International transfers

7.1. Our server, with the database, stored files and backups, is in Mumbai, India.

7.2. Data is also handled in other countries:

• Cloudflare carries traffic over its global network;
• Resend sends and receives our email in Tokyo, Japan;
• Google holds the mailbox where our team reads email, in its global data centres;
• Meta carries the calls answered in the desk on its global infrastructure;
• our staff reach the server remotely from the countries where they work, which today include India.

7.3. Where the law requires a safeguard for these transfers, we rely on the grounds that law provides, such as the data protection terms of our providers, or your consent where the law requires it.

8. How long we keep data

8.1. Some of these periods are applied automatically, and some are not: demo requests, the staff Console log, records of accepted documents and invoices are not deleted automatically. Our staff review those records regularly, and delete by hand what has passed its period.

9. Closing an account, deletion and export

9.1. When a business closes its account, access ends on the date set under clause 15.2 of the Terms: the end of the calendar month in which it asked to cancel, or the end of a longer period it has already paid for. The business then has 30 days to export its data. We delete the business’s data within the following 30 days, so at the latest 60 days after access ended. We keep invoices, records of accepted documents, the erasure and opt-out records, and usage totals (section 8).

9.2. Today a business’s admins can export its contacts as a CSV file. Other exports: on the business’s written request, we provide other data we hold for it, as far as we reasonably can, in a common machine-readable format.

9.3. Deleted data stays in backups until they rotate out, after 30 days at most. We use backups only to recover from a failure, never to look anything up. If we ever restore a backup, erasures and opt-outs made since then still apply.

9.4. A business’s admin can deactivate a team member, which signs that person out everywhere at once. Deleting a team member’s record is done by us on request: the business’s admin, or the team member, writes to info@akasoft.io, and we delete the record, or remove the name and email address from it where the business’s records still need it, by hand within 15 working days.

9.5. You can ask us to delete your demo request at any time (section 12). We do this by hand. For a demo request, we delete it from our database and the email about it from our team mailbox, and remove the company name from the Console log’s lines about it. Copies stay for a time where we cannot delete them by hand: in backups for up to 30 days, and with Resend and Google for as long as their own deletion rules keep them.

10. Cookies and browser storage

10.1. wabizbox.com sets no cookies and uses no browser storage. Depending on Cloudflare’s protection settings, Cloudflare itself may set a strictly necessary security cookie, such as __cf_bm or cf_clearance, to tell people from automated traffic.

10.2. The desk (app.wabizbox.com) sets two cookies, only after you sign in:

Both are secure, HTTP-only cookies for this one site. They are not used for analytics or advertising.

10.3. The desk also keeps a few preferences in your browser’s storage: your display choices, interface language, recently used emoji, column widths, the automation editor’s layout, a microphone reminder and which of the business’s numbers you chose. It never keeps customer content there. Message drafts and the page cache stay in memory only, and are cleared when you sign out.

10.4. The staff Console sets __Host-console_session for AKASOFT staff only. It lasts 12 hours, and ends after 1 hour without use.

11. Security

11.1. These measures are in place:

• HTTPS only. Traffic passes through Cloudflare and is encrypted again from Cloudflare to our server, which has a verified certificate. Our server’s firewall accepts web traffic only from Cloudflare’s addresses. Access to the server over SSH uses keys. Security updates install daily.
• Access tokens a business gives us are encrypted with AES-256-GCM. The key is kept outside the database and never goes into a backup. AKASOFT’s own access token, used for numbers whose business assigns AKASOFT as a partner, is kept in the server’s settings file, which only the desk’s system account can read, and never goes into a backup either. So a backup alone cannot send messages as anyone.
• Passwords are hashed with scrypt, each with its own salt. Sign-in gives the same answer, in the same time, for an unknown email and a wrong password. Wrong guesses are limited per connection, never per account, so nobody can lock another person out.
• Session and link tokens are stored only as SHA-256 hashes. Session cookies are secure, HTTP-only and limited to their own site. A new password ends every other session. Deactivating a person signs them out everywhere at once. People can see their sessions and sign out other browsers, and admins can see and end their team’s.
• Businesses are kept apart. One business can never reach another’s chats. Every inbox query checks that the person answers that number. Roles are admin and agent.
• An activity log records every settings change.
• Requests from other sites are refused. Security headers and a Content Security Policy are in place. Customers’ files are served only to signed-in users, with protections that stop a file from running as a web page.
• Meta’s deliveries are accepted only with Meta’s valid signature.
• Logs leave out customers’ names, numbers, message ids and message text, and all passwords and tokens.
• Nightly backups of the database and stored files, with SHA-256 checksums. Each backup checks itself before it is kept, and is kept on the same server for 30 days at most. A failed backup sends an alert email. The restore procedure is written down and has been rehearsed on test copies.
• Erasures and opt-outs survive restores (3.8).
• Calls are not recorded. We never ask Meta for recordings or transcripts.
• Reading text from a customer’s picture happens on the agent’s own computer (3.7.3).
• The desk runs as its own unprivileged system account, and its files can be read only by that account.

11.2. Staff access. Our staff Console is on its own address. Staff sign in with a password and a six-digit code sent by email every time, and a staff session ends after 12 hours, or after 1 hour without use. The Console shows counts, and each business’s team and billing details. It never shows message text or customers’ names or numbers. There is no feature for our staff to sign in to a business’s desk as one of its users. Our server administrator can technically reach all data stored on the server. That access is limited to the staff who run the server, uses SSH keys, and is used only to run, secure, back up, restore and repair the service, to carry out a business’s instructions, or where the law requires. Staff who can reach personal data are bound to keep it confidential.

11.3. No system is completely secure. If a personal data breach affects data we control (section 2), we notify the competent data protection authority and the people affected where the law requires. If it affects a business’s customers’ data, we tell the business without undue delay, as the DPA sets out, and the business notifies its customers and its regulator.

12. Your rights

12.1. Depending on the law that applies to you, you have the right to:

• know what data we hold about you, and get a copy;
• receive the data you gave us in a common, machine-readable format, or have it sent to another provider, where the law gives that right (data portability);
• have wrong or out-of-date data corrected;
• have your data deleted;
• restrict or object to our use of it, where the law gives that right;
• withdraw your consent, where we rely on it;
• where India’s Digital Personal Data Protection Act applies, nominate another person to use these rights for you if you die or cannot use them yourself;
• complain to a data protection authority (section 15).

12.2. Where to ask. If you visited our website, sent the Book a demo form, emailed us, or use the desk, write to info@akasoft.io. This address also takes questions and complaints about how we handle your personal data; for India, it is our grievance contact, answered by the Personal Data Protection Officer of AKACORP GLOBAL TECH LLC. We answer within 15 working days. We may ask you to confirm who you are first.

12.3. If you use the desk, you can change your own name and password there, and see and end your sessions. Your business’s admin can deactivate your access. For anything else, write to us.

12.4. If you are a customer of a business that uses WaBizBox, the business controls your data, so send your request to the business. If your request reaches us, we pass it to the business and tell you we have done so. We help the business answer it, as the DPA sets out. For example, when the business asks us in writing to erase a customer’s data, we do it within 10 working days.

12.5. Withdrawing consent does not affect what we did before, and does not cover data the law requires us to keep.

13. Children

13.1. WaBizBox is a service for businesses. The website and the Book a demo form are for adults acting for a business, aged at least 18. We do not knowingly collect children’s data for our own purposes.

13.2. We do not check the age of the customers who write to a business. The business is responsible for any age rules and parental consent that apply to its own customers.

14. Changes to this Policy

14.1. We may change this Policy. The current version is always at wabizbox.com/legal/privacy, with its version number and date at the top.

14.2. We tell businesses about important changes at least 30 days in advance, by email or in the desk.

14.3. The Book a demo form records which version of this Policy you agreed to.

15. Law, complaints and language

15.1. This Policy is governed by the law of the Republic of Uzbekistan.

15.2. Depending on where you and the business are, other personal data laws may also apply, such as Uzbekistan’s Law “On Personal Data”, India’s Digital Personal Data Protection Act 2023, or the EU and UK General Data Protection Regulation. Nothing in this Policy takes away rights those laws give you.

15.3. If you have a complaint, please write to us first at info@akasoft.io. You can also complain to the authorised state body for personal data in the Republic of Uzbekistan, or to the data protection authority where you live or work.

15.4. Disputes about this Policy go to the competent economic court at AKASOFT’s location, unless the law gives you the right to go to another court.

15.5. This Policy is written in English. If we publish it in another language, the English version prevails where the two differ.

16. Contact us

• Provider: AKACORP GLOBAL TECH LLC, limited liability company
• Registration number: 312414442 (TIN)
• Registered address: Farg’ona viloyati, Farg’ona shahri, Mash’al MFY, Mustaqillik shoh ko’chasi, 3S-uy, Uzbekistan
• Personal data requests: info@akasoft.io
• Other questions: info@akasoft.io
• Phone: +998 50 744 41 31
• Person responsible for data protection: the Personal Data Protection Officer of AKACORP GLOBAL TECH LLC
• Website: wabizbox.com

See also our Terms (Public Offer) and Data Processing Agreement.