Privacy Policy

1. Introduction

Welcome to Connectly360(“Connectly360”, “we”, “our”, or “us”). Connectly360 is an enterprise multi-tenant Conversational Customer Relationship Management (“CRM”), team inbox, automated workflow, and marketing campaign platform designed to help businesses manage customer interactions through the official Meta WhatsApp Business Platform (Cloud API).

We value the privacy of our business customers (“Customers”, “Workspaces”, or “Users”) and their end-consumers (“Contacts” or “Recipients”). This Privacy Policy explains our practices regarding the collection, use, disclosure, storage, security, and deletion of personal data processed through our website (connectly360.com), our web applications, our APIs, and our WhatsApp integration services.

2. Who We Are

Connectly360 is operated as a software technology platform based in India:

3. Scope of this Policy

This Privacy Policy applies to all services offered by Connectly360, including:

• The public website accessible at connectly360.com and related landing pages.
• The Connectly360 SaaS web application, workspace dashboards, team inbox, workflow automation builder, campaign dispatcher, and analytics interfaces.
• Developer REST APIs, webhooks, and programmatic messaging integrations.
• The Meta WhatsApp Embedded Signup / Tech Provider onboarding process connecting customer WhatsApp Business Accounts (WABAs) to Connectly360.

4. Information We Collect

We collect information in three ways: information directly provided by customers during registration and configuration, information collected automatically during platform operation, and information received via authorized third-party APIs (principally Meta Platforms and payment gateways).

5. Information Provided by Customers

When you create an account, create a workspace, subscribe to a plan, or contact support, you provide us with:

• Identity & Contact Information: Full name, business email address, phone number, and physical or business address.
• Authentication Credentials: Securely salted and hashed passwords (via bcrypt) or OAuth identifier tokens if authenticating through Google Login.
• Company Profile: Business name, logo, industry vertical, business hours, and delivery information.
• Workspace Settings: Team member email addresses, assigned RBAC permissions, notification preferences, and internal notes.

6. WhatsApp & Meta Information

When a business connects its WhatsApp Business Account to Connectly360 using Meta’s official Embedded Signup or Tech Provider flow, we receive authorized metadata and programmatic access tokens via Meta Graph API:

• WABA Identifiers: WhatsApp Business Account ID (WABA ID), Meta Business Manager ID, and Phone Number ID.
• Phone Number Details: Verified business phone number, display phone number, verified business name, and code verification status.
• Account Quality & Limits: Quality rating (GREEN, YELLOW, RED), messaging tier limit (e.g., 250, 1K, 10K, 100K, or Unlimited daily conversations), and account status (CONNECTED, PENDING, or DISCONNECTED).
• WhatsApp Business Profile: About text, business address, description, email, website links, vertical, and profile picture URL.
• Access Tokens: OAuth authorization codes exchanged for system user or permanent system tokens, which are encrypted at rest with AES-256 before storage in our database.

7. How We Use Information

We use the collected information solely for legitimate business operations and fulfilling contracted services, specifically to:

• Authenticate accounts and secure workspace boundaries across multiple tenants.
• Connect, configure, and maintain your official WhatsApp Business Cloud API assets.
• Transmit outbound WhatsApp messages, campaign broadcasts, and auto-replies requested by you.
• Ingest inbound messages and status updates through Meta webhooks and display them in your live team inbox.
• Synchronize and submit WhatsApp message templates to Meta for review and catalog management.
• Deduct usage credits accurately based on WhatsApp conversation pricing tiers.
• Process subscription payments and credit topups via our licensed payment processor (Razorpay).
• Deliver real-time notifications of customer inquiries via WebSockets (Pusher).
• Provide customer support, address technical troubleshooting tickets, and maintain system reliability.

8. Legal Bases for Processing

Depending on your jurisdiction and role, we process your information under the following legal bases:

• Performance of a Contract: Providing CRM software, processing messages, maintaining WhatsApp connectivity, and managing subscriptions as agreed in our Terms of Service.
• Legitimate Interests: Securing our infrastructure against fraud, abuse, and cyber threats; monitoring system performance; and delivering customer assistance.
• Legal Compliance: Retaining financial transaction records, tax documentation, and responding to lawful requests by competent public authorities.
• Consent: When you or your end-users explicitly consent to optional features, such as optional marketing newsletters or third-party AI extensions.

9. WhatsApp Business Account (WABA) Data

When you link a WABA, Connectly360 acts as a software interface between your Meta Business Manager and your team. We interact with Meta Graph API endpoints on your behalf. We store your WABA configuration, verify phone registration through 6-digit registration PINs, subscribe to WhatsApp webhooks, and cache profile details. We never take ownership of your WABA or phone numbers; your business retains full ownership of its Meta assets.

10. Message & Conversation Data

Connectly360 processes incoming and outgoing WhatsApp messages:

• Message Content: Text strings, quick-reply responses, button payloads, interactive list responses, and media attachment references (images, audio notes, video clips, and documents).
• Message Metadata: WhatsApp Message IDs (WAMID), sender phone number, recipient phone number, timestamps, conversation category (SERVICE, MARKETING, UTILITY, AUTHENTICATION), and pricing tier.
• Delivery Telemetry: Real-time webhook events tracking message states (sent, delivered, read, failed), alongside failure error codes and rejection reasons returned by Meta.

11. Contact & Customer CRM Data

When end-consumers interact with your connected WhatsApp number, or when you import audience lists, Connectly360 maintains a workspace CRM record including:

• Contact phone number in international E.164 format.
• Customer name, email address, company name, and lead stage.
• Opt-in status, opt-in source timestamp, opt-out status, and marketing tags.
• Custom attributes and custom fields configured by your workspace administrators.

12. Campaign & Broadcast Data

For marketing and utility broadcasts initiated through our campaign module, we store:

• Campaign name, scheduled dispatch time, selected pre-approved WhatsApp template ID, and dynamic parameter mappings.
• Target segment definitions and recipient phone numbers validated against opt-in records.
• Aggregated batch execution statistics: total dispatched, successfully delivered, read, failed, and credits consumed.

13. Account & Workspace Data

Connectly360 isolates each customer’s organization into a distinct logical tenant. We record your workspace subscription tier (Starter, Growth, Business, Enterprise), credit balance ledger, transaction records, invoice history, and developer API keys.

14. Team Member & RBAC Data

When inviting team members, we store their email address, invitation expiration tokens, assigned roles (e.g., Administrator, Manager, Agent), and activity timestamps. Access permissions are enforced through granular Role-Based Access Controls (RBAC) to ensure agents only view data permitted by their workspace administrator.

15. Device & Technical Information

When accessing our web applications, our servers automatically log technical parameters for security, diagnostic, and rate-limiting purposes:

• Internet Protocol (IP) address and approximate geographic location derived from IP.
• Browser type, version, language settings, and operating system.
• HTTP request methods, request URIs, referring URLs, response status codes, and latency metrics.

16. Cookies & Tracking Technologies

We use cookies and storage technologies governed by our Cookie Consent & Preferences Management System:

• Authentication (Strictly Necessary): Secure JSON Web Tokens stored in browser localStorage ('auth_token') to authenticate session API requests.
• Consent State (Strictly Necessary): connectly360_cookie_consent cookie storing your chosen privacy preferences.
• Support Chat Continuity (Functional): First-party cookies (connectly360_active_visitor_id) that allow visitors to resume conversations with our support desk across pages, active only when Functional cookies are allowed.
• Gated Analytics & Marketing: Any performance or marketing analytics tools are strictly gated and will not initialize unless you explicitly grant consent.

You can adjust or withdraw your preferences at any time by clicking Cookie Settings in the website footer or viewing our dedicated Cookie Policy.

17. Analytics & Diagnostics

Analytics provided inside the Connectly360 dashboard (such as message volume per period, delivery rates, top customer intents, and response time metrics) are computed directly from your workspace’s internal transactional records. We do not transmit your CRM analytics to third-party data brokers.

18. Third-Party Services & Subprocessors

To deliver platform features, Connectly360 integrates with vetted third-party service providers acting as sub-processors:

In strict accordance with Meta Platform Terms, the WhatsApp Business Terms of Service, and developer policies:

• Connectly360 accesses WhatsApp assets and data solely through official, documented Meta Graph API and Cloud API endpoints authorized by the customer during Embedded Signup.
• Data accessed via Meta APIs is used exclusively to deliver legitimate functionality requested by the customer (such as displaying conversations, sending messages, routing chats, and monitoring delivery status).
• Connectly360 NEVER sells, rents, licenses, or exchanges WhatsApp data, customer contact lists, or message content to third-party data brokers, marketers, or advertisers.
• We never use customer WhatsApp data to target advertising to your customers across external platforms.
• We do not retain Meta user data longer than necessary to fulfill the operational requirements of your Connectly360 workspace.

20. Data Sharing & Disclosures

We do not share your data except in the following limited circumstances:

• With Sub-processors: To the trusted infrastructure, payment, and AI partners listed in Section 18, strictly bound by data protection obligations.
• For Legal & Regulatory Compliance: If required by valid court order, subpoena, or applicable statutory law, or to protect the vital rights, safety, and property of our users or the public.
• Business Transfers: In connection with any merger, sale of company assets, restructuring, or acquisition, subject to the acquiring party honoring this Privacy Policy.

21. Data Processing on Behalf of Business Customers

Depending on applicable privacy frameworks (including GDPR, UK GDPR, and the India Digital Personal Data Protection Act):

• Connectly360 as Data Processor / Service Provider: In relation to your customer contacts, imported phone numbers, chat logs, and campaign recipients, our customer (the business) is the Data Controller, and Connectly360 acts as a Data Processor processing such data on the customer’s documented instructions.
• Connectly360 as Data Controller: Connectly360 acts as an independent Controller regarding the account information, billing records, authentication credentials, and support interactions directly entered by our registered business users.
• Customer Responsibility: Business customers are solely responsible for ensuring they possess a lawful basis (including explicit opt-in consent where required by law) before importing contacts or dispatching WhatsApp messages through Connectly360.

22. Data Retention Schedule

We retain personal data only for as long as necessary to provide the services, comply with applicable legal obligations, resolve disputes, enforce agreements, and maintain security:

• Active Workspaces: Data is retained for the active duration of your subscription and workspace tenancy.
• Disconnection of WhatsApp: When you disconnect a WhatsApp account, access tokens are immediately cleared and status updated to disconnected. Historical chat logs are preserved in your CRM until explicitly deleted.
• Canceled Accounts: Workspace data is scheduled for permanent purge after 30 days following formal account termination, unless earlier deletion is requested.
• Financial & Audit Records: Payment transactions, invoices, and billing ledgers are retained for up to 7 years in compliance with statutory financial and taxation laws.

We respect your right to have personal data deleted. Connectly360 provides a transparent deletion framework:

• How to Submit a Deletion Request: You or your authorized representative can submit a deletion request via our public Data Deletion Instructions Page or by emailing our privacy desk at support@connectly360.com with the subject line “Data Deletion Request”.
• Verification: To protect accounts against unauthorized deletion, we verify workspace ownership via the registered primary administrator email address.
• Processing Timeline: Deletion requests are acknowledged within 48 hours and completed within 30 days.
• What Is Purged: Workspace CRM contacts, incoming/outgoing message records, media attachment files, custom templates, campaign history, and API keys are completely deleted from active databases.

24. Customer Data Export

Workspace administrators may export their contact databases, lead pipelines, and campaign recipient reports in standard CSV format directly from the Connectly360 dashboard prior to account closure or disconnection.

Connectly360 implements robust technical and organizational security measures designed to protect customer data:

• Encryption in Transit: All HTTP traffic to Connectly360 is enforced over HTTPS utilizing TLS 1.2 and TLS 1.3 encryption with modern cipher suites.
• Sensitive Secret Encryption: Meta Access Tokens, Meta App Secrets, and Webhook Secrets are encrypted at rest in our database using industry-standard AES-256-CBC cipher encryption.
• Tenant Isolation: Database queries and application controllers strictly scope record retrieval to the active tenant_id, preventing cross-tenant data leaks.
• Webhook Signature Verification: Inbound Meta webhooks are cryptographically authenticated using SHA-256 HMAC signatures (X-Hub-Signature-256) against your app secret before processing payloads.
• Access Controls & Password Hashing: User passwords are encrypted with bcrypt hashing. Administrative actions are restricted through granular RBAC permissions.
• Rate Limiting & Threat Monitoring: High-volume API routes are throttled to mitigate brute-force attempts and denial-of-service abuse.

26. International Data Transfers

Connectly360 utilizes cloud hosting and sub-processors with infrastructure distributed internationally (including India, the European Union, and the United States). By utilizing the services, you acknowledge that your data may be transferred to and processed in countries outside your residence, which may maintain different data protection standards. When transferring data internationally, we implement standard contractual clauses and technical safeguards.

27. Children’s Privacy

Connectly360 is exclusively a business-to-business (B2B) software suite intended for commercial use by individuals at least 18 years of age. We do not knowingly collect or solicit personal data from children under the age of 16. If we become aware that a minor has submitted personal data, we will take immediate steps to delete the information.

28. Marketing Communications

We may send essential transactional notices (such as password resets, billing receipts, or system downtime warnings) to your registered email address. We do not send unsolicited marketing emails. If you opt in to receive product update newsletters, you can unsubscribe at any time via the link provided in the email footer.

29. Your Privacy Rights

Subject to applicable law in your jurisdiction, you have the right to:

• Access: Request confirmation and copies of personal data held about you.
• Rectification: Request correction of inaccurate or incomplete personal records.
• Erasure: Request deletion of your personal data under conditions set out in applicable law.
• Restriction & Objection: Object to or request restriction of data processing where applicable.
• Data Portability: Obtain your data in a structured, commonly used, and machine-readable format.

To exercise any of these rights, please contact our privacy desk at support@connectly360.com.

Businesses using Connectly360 must comply with all relevant messaging regulations and Meta Platform policies:

• WhatsApp Business Policy: Customers must comply fully with Meta’s WhatsApp Business Messaging Policy and WhatsApp Commerce Policy.
• Mandatory Opt-In: You must obtain explicit opt-in consent from recipients before sending outbound marketing or notification messages on WhatsApp.
• Honoring Opt-Outs: You must promptly honor opt-out requests (e.g., STOP, CANCEL, UNSUBSCRIBE) and mark contacts as opted-out in your Connectly360 CRM.
• Approved Templates: Business-initiated messages sent outside the 24-hour customer service window must use approved WhatsApp Message Templates.
• Prohibited Content: You may not transmit spam, fraudulent schemes, deceptive offers, harassment, hate speech, or content promoting prohibited industries.

31. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our technical features, integrations, legal requirements, or Meta Platform guidelines. When we make changes, we will update the “Last Updated” date at the top of this document. Material changes will be communicated via notification in the dashboard or via your registered administrative email.

If you have questions, feedback, or requests regarding this Privacy Policy or our data practices, please reach out to our privacy and compliance desk: