Table of Contents
Welcome to Aavox ("Aavox", "we", "us", or "our"). We provide a multi-tenant business communication, appointment booking, CRM, and workflow automation platform (the "Service" or "Platform") accessible via web, mobile applications, and our APIs.
This Privacy Policy explains how we collect, use, disclose, and protect personal information when you:
- Visit our website or marketing pages;
- Create an account, workspace, or subscribe to our Services as a customer or business user ("Customer", "Tenant", or "Account Holder");
- Interact with our customers' chatbots, WhatsApp channels, or online booking pages as an end-customer ("End-User").
1Roles Under Data Protection Laws (Controller vs. Processor)
To understand our privacy practices, it is important to distinguish the two distinct roles Aavox operates under:
We act as a Data Controller for information related to our direct Customers and account holders (e.g., your login credentials, billing details, subscription choices, and website analytics).
When our Customers use the Platform to interact with their End-Users (such as sending WhatsApp campaigns, managing customer CRM contacts, generating AI chatbot responses, or accepting appointment bookings), our Customer is the Data Controller and Aavox is the Data Processor. We process this End-User data solely on behalf of and under the instructions of the Customer.
2Information We Collect
A. Information Provided Directly to Us (Account Holders & Administrators)
- Account & Profile Information: Full name, business email address, phone number, password (stored using one-way cryptographic hashing), job role, company name, department, and profile picture/avatar.
- Workspace & Tenant Information: Workspace/organization name, custom subdomain or slug, physical business address, city, state, country, and timezone.
- Billing & Transaction Data: Billing contact details, selected subscription tier, transaction histories, and tax identifiers.
- Support & Communications: Records of messages, support tickets, and feedback sent to us.
B. Customer Data Processed on Behalf of Our Tenants (End-User Data)
When Customers use Aavox, they store or transmit End-User data through our systems:
- Contact & CRM Records: Customer lists containing names, phone numbers, email addresses, street addresses, custom tags, and custom fields uploaded or synced by the Customer.
- Communication & Messaging Data: Inbound and outbound WhatsApp messages, message templates, delivery and read statuses (sent, delivered, read, failed), chat timestamps, and internal agent/telecaller conversation notes.
- Media & Attachments: Images, documents (PDFs), audio notes, and videos uploaded or transmitted through customer conversations.
- Appointment & Booking Records: Patient or customer names, booking requests, appointment times, provider assignments, departments, and one-time password (OTP) verification challenges.
- Knowledge Base & Grounding Data: Documents, text files, and FAQs uploaded by the Customer to train or ground AI chatbot flows.
C. Information Collected Automatically
- Log & Device Data: IP address, browser type, device operating system, referring URLs, API request logs, error traces, and timestamps.
- Session & Authentication Data: JSON Web Tokens (JWT) used to authenticate authenticated requests across our services.
3Third-Party Integrations & Specific Service Disclosures
Aavox integrates with specific third-party APIs to deliver messaging, AI, and cloud storage features.
A. WhatsApp Business API (Meta Platforms, Inc.)
- Aavox integrates with the Meta WhatsApp Business Cloud API (WABA).
- What We Process: Customers connect their WhatsApp Business phone numbers, credentials, and message templates. We process customer phone numbers, incoming customer inquiries, and bot/agent replies.
- Our Commitment: We do not sell WhatsApp message data, phone numbers, or conversation content to third parties. We process WhatsApp data solely to route, deliver, and display messages within the Customer's workspace.
B. Google API Services (Google Drive & Google Sheets Integration)
Aavox allows Customers to connect their Google account (via Google OAuth or Google Cloud Service Account) to sync lead data from Google Sheets into the Aavox CRM.
- Google User Data Accessed: When connected, Aavox requests read-only permission (
drive.readonlyorspreadsheets.readonly) to list spreadsheets and import contact rows designated by the user.
Google API Services User Data Policy Compliance
Aavox's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
- No Human Access / No Transfer: We do not transfer Google user data to third parties, advertising platforms, or data brokers. We do not use Google user data to train generalized AI/ML models.
C. Artificial Intelligence & LLM Providers (OpenAI & Anthropic)
- Custom AI Credentials: Customers can connect their own API keys (OpenAI, Anthropic) or use platform-provided AI models to power conversational bots.
- Processing Scope: Customer prompts, End-User inquiries, and contextual knowledge base excerpts are transmitted to the designated LLM provider to generate replies in real time.
- No Training on Your Data: Under enterprise API terms with providers such as OpenAI and Anthropic, your business data and chat messages transmitted via API endpoints are not used to train public foundation models. API keys are encrypted at rest.
4How We Use Information
We process personal information for the following legitimate business purposes:
- Service Delivery: Providing, hosting, and maintaining workspace instances, message routing, CRM tools, and scheduling engines.
- Authentication & Access Control: Verifying user identities, enforcing Role-Based Access Control (RBAC), and securing API communications.
- Billing & Subscription Management: Processing plan upgrades, renewals, invoicing, and webhook-driven account activations.
- Security & Platform Integrity: Detecting fraud, blocking malicious requests via our API gateway, and diagnosing technical issues.
- Customer Support & Communications: Responding to inquiries, sending system updates, welcome emails, and service notifications.
- Legal Compliance: Complying with applicable laws, tax regulations, and lawful requests from authorities.
6Data Architecture, Security & Storage Isolation
We implement rigorous technical and organizational measures designed to protect your data against unauthorized access, loss, or alteration:
1. Schema-Per-Tenant Isolation
Aavox utilizes PostgreSQL schema-level isolation (django-tenants). Each Customer workspace's data (contacts, chats, templates, internal notes, assignments) resides in its own isolated database schema, preventing cross-tenant data exposure.
2. Encryption in Transit & at Rest
- All external and internal service communication is encrypted using TLS / HTTPS.
- Sensitive third-party secrets (such as Google OAuth refresh tokens, service account keys, and LLM API keys) are stored using AES encryption-at-rest in the database.
3. Role-Based Access Control (RBAC)
Workspace access is governed by strict user roles and granular permissions.
4. Regular Backups
Encrypted database snapshots are performed nightly and stored with automated retention policies in secure object storage.
7Data Retention & Deletion
- Customer Account Data: Retained for as long as your workspace subscription is active and in good standing.
- Conversation & Message Logs: Retained in accordance with the Customer's configured workspace preferences or until deleted by workspace administrators.
- Account Termination: Upon termination of a workspace, Customer data stored within the dedicated tenant schema is queued for deletion and purged in accordance with our system backup retention cycles (typically within 30 days).
- End-User Inquiries: Because Aavox acts as a processor for End-User data, End-Users who wish to have their conversation history or CRM record deleted should direct their request directly to the Customer (the business) they communicated with.
8Your Data Protection Rights
Depending on your geographic location (including under GDPR, UK GDPR, California CCPA/CPRA, and relevant local data privacy laws), you may have the following rights:
- Access & Portability: Request a copy of the personal information we hold about you.
- Rectification: Request correction of inaccurate or incomplete personal data.
- Erasure ("Right to Be Forgotten"): Request deletion of your personal data, subject to legal and financial retention obligations.
- Restriction & Objection: Object to or restrict certain processing activities.
- Withdraw Consent: Withdraw consent at any time where processing was based on consent.
(If you are an End-User who interacted with an Aavox business customer, please contact that business directly; Aavox will assist the Customer in fulfilling legitimate data subject requests).
9International Data Transfers
Your information may be stored and processed on servers located in various cloud regions depending on our infrastructure deployment. When data is transferred internationally, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) and compliance with international data transfer frameworks where applicable.
10Children's Privacy
Aavox is a business-to-business (B2B) platform and is not directed to individuals under the age of 18 (or the age of majority in your jurisdiction). We do not knowingly collect personal information from children. If you become aware that a child has provided us with personal information, please contact us immediately.
11Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our legal obligations, features, or data processing practices. If we make material modifications, we will notify you by posting an updated version on our website, updating the "Last Updated" date, and, where appropriate, sending an in-app notice or email to registered administrators.
12Contact Us
If you have questions, comments, or requests regarding this Privacy Policy or our data protection practices, please contact our Data Privacy Team at: