Inbox privacy notice

1. What this notice covers

This notice covers Allied Inbox, our self-hosted shared inbox, and WhatsApp enquiries to Allied BizTech and its agency arm, Pleomatic. It also covers authorised staff using the Meta connection flow. The corporate website has a separate privacy policy, linked above.

The Inbox is being commissioned as an owner pilot. Live WhatsApp connection and downstream delivery are enabled only after their technical and approval checks. This notice describes the data involved when those functions are used; a deployed component does not mean every integration is already active.

2. Information involved

• WhatsApp phone numbers, profile names and identifiers, messages, timestamps, delivery information, conversation metadata, and files people voluntarily send.
• Enquiry details such as a name, company, contact information, service interest and project requirements. Job applicants may supply an email address, CV or portfolio link.
• For authorised administrators, the Meta identity and business-account information needed to connect and manage the company WhatsApp account. Integration credentials are used for that connection and kept in the private Oracle environment.
• Sign-in and operational information needed to protect access, diagnose failures and keep an audit trail. Cloudflare handles protected access and traffic delivery.

Please send only information needed for your enquiry. We do not ask you to send passwords, access tokens or identity documents in a WhatsApp message or an ordinary deletion request.

3. Why we use it

Authorised staff use the Inbox to read and reply to enquiries, provide support, assign work and follow up conversations. When enabled, the routing adapter distinguishes Allied engineering/AI enquiries, Pleomatic agency enquiries, support and job applications.

Relevant enquiry details may be recorded in our self-hosted Frappe CRM. Applicant details may be recorded in our self-hosted hiring system. Unclear enquiries and incomplete applications go to human review. Categorisation does not decide hiring eligibility, selection, rejection or employment outcomes.

Message content is not used to build advertising audiences or train AI models. The current routing rules do not send automated customer replies.

4. Services and people that handle the data

• Meta / WhatsApp: provides the messaging platform and the business-account connection.
• Oracle Cloud Infrastructure: hosts the self-managed Inbox, CRM/hiring components and their private operational state. The deployment region is Mumbai, India.
• Cloudflare: protects sign-in and delivers traffic through its network. Its processing is global; this notice does not promise India-only processing. See Cloudflare’s processing information.
• Authorised Allied staff: handle conversations and related business work according to their assigned access.

Chatwoot Community Edition and Frappe are software we self-host here. They are not additional hosted inbox providers for this deployment. If you email us, that correspondence is also handled by the email services described in our corporate website policy.

Data may be processed outside India by the messaging, network or support services involved. Vendor processing locations and the applicable service arrangements govern those transfers; the Oracle storage region alone does not restrict all other processing locations.

5. Access and protection

The production pilot uses Cloudflare’s owner access gate and authenticator MFA, private loopback origins and native application accounts. Integration identities are restricted to their intended functions. Staff access is assigned deliberately; passing the gateway does not itself grant a role in every application.

Operational credentials, raw event evidence and encrypted backups are kept in the private Oracle environment. This notice does not claim independently verified off-site recovery or additional certifications for the Inbox.

6. Retention during the pilot

The pilot has no automatic expiry or purge for WhatsApp conversations, linked CRM/hiring records or its audit receipts. Records can remain until an administrator reviews and removes them. We consider the purpose of the enquiry, follow-up needs, service records, applicable legal obligations and verified deletion requests when reviewing retention.

A deletion request is reviewed across the related systems rather than assumed to remove every copy immediately. Encrypted backups and records needed for legal or recovery purposes may require separate handling. We explain any applicable retention exception when responding. We do not promise an automatic deletion timetable that the system has not implemented.

7. Access, correction and deletion requests

Email hello@alliedbiz.tech to request access, correction or deletion, or to ask how information about you is being used. Identify the WhatsApp number or conversation involved and the action you want. We verify the request before disclosing or deleting records and explain the outcome or any applicable exception.

See the data-deletion instructions for the information to include. Disconnecting the Meta/WhatsApp integration stops that connection; it does not automatically erase retained business records or recall messages already delivered to other people.

8. Requests from public authorities

Our process requires reviewing the legality of requests, providing for challenges to requests considered unlawful, limiting any disclosure to the minimum information necessary, and documenting the request, response and legal reasoning.

9. Changes and contact

We update this notice when the Inbox’s data use or services materially change. The published notice will show its actual update date.