Privacy Policy

This policy explains how Squarebox Cloud ("Squarebox", "we", "us") handles personal data. It applies to visitors to squarebox.cloud, to people who submit an enquiry to us, and to the businesses that subscribe to the Squarebox platform and the staff who log in to use it.

It also explains, in section 4, how we handle the conversation data of your own customers when they message a WhatsApp number you run through Squarebox. That data is yours, and our handling of it is governed by your instructions and your agreement with us.

We have written this in plain language on purpose. If anything here is unclear or you need a formal version for a procurement or security review, write to us and we will provide it.

The Digital Personal Data Protection Act, 2023 distinguishes between a Data Fiduciary, who decides why and how personal data is processed, and a Data Processor, who processes it on a fiduciary's behalf. Squarebox operates in both roles depending on the data in question.

For our own website visitors, enquiries, subscriber accounts and billing records, we are the Data Fiduciary. We decide what we collect and why, and we are accountable for it directly to you.

For the conversations, contact lists and message content that flow through a WhatsApp number belonging to one of our customers, we act as a Data Processor on behalf of that customer. The customer is the Data Fiduciary for their end customers. We process that data only to provide the service, only on the customer's instructions, and we do not use it to build products, sell to their customers, or train general purpose models.

We keep collection deliberately narrow. From website visitors and prospective customers we collect only what a person chooses to send us, plus basic technical information needed to serve and secure the site.

When you run WhatsApp automation on Squarebox, the platform necessarily handles data about the people messaging you. This typically includes their WhatsApp phone number, WhatsApp profile name, the content and timestamps of messages in both directions, media they send, delivery and read status, any tags, notes or custom fields your team records against a contact, and any information the AI agent collects during a conversation because you configured it to ask.

We process this data to deliver, route, queue, retry, store and report on those messages, to run the automations you have configured, and to provide support when you ask for it. Access by our staff is limited to named personnel, is granted only for support and platform reliability work, and is logged.

You control retention, export and deletion of this data. If you cancel, you can export it, and we delete it on the schedule described in section 8.

We use personal data for a short and specific list of purposes.

Where we act as Data Fiduciary, we process personal data on the basis of the consent you give when you submit a form or create an account, and on the legitimate uses recognised by the DPDP Act 2023, such as complying with a legal obligation. Our notice at the point of collection tells you what we are collecting and why, and consent can be withdrawn at any time by writing to us.

Withdrawing consent does not require us to delete records we are legally required to keep, such as invoices and tax records, and it may mean we can no longer provide the service.

Where you are the Data Fiduciary, obtaining valid consent from your own customers before messaging them is your responsibility. WhatsApp requires opt-in before business-initiated messages, and the platform is built around that requirement, but the consent itself has to be collected by you.

We do not sell personal data and we do not share it for anyone else's advertising. We do rely on a small set of service providers, each engaged under contract terms that restrict them to processing data only for the service they provide to us.

Our platform data is hosted with reputable cloud providers, and we can host a customer's data in a specific region where a plan or contract requires it. Some of the providers listed in section 7 operate outside India, so certain processing may take place abroad. Where that happens we rely on contractual protections and process only what the service requires, consistent with the DPDP Act 2023 and any restrictions notified by the Government of India.

We keep enquiry data for up to 24 months from the last contact, unless you ask us to delete it sooner. Account and conversation data is retained for as long as your subscription is active. After cancellation we keep it for 30 days so you can export it or reactivate, then delete it from production systems, with backups expiring within a further 60 days. Invoices, tax records and statutory books are kept for the periods Indian law requires, which is currently eight years for certain accounting records.

Customers on plans that include custom retention policies can set shorter periods, and we will honour a documented deletion instruction ahead of these defaults.

Data is encrypted in transit using TLS and encrypted at rest. Access within the platform is role-based, so your team members see only what their role allows, and actions are recorded in an audit log. Internal access by our staff requires multi-factor authentication, is limited to the smallest number of people who can do the job, and is reviewed periodically.

We patch dependencies, monitor for anomalies, and keep backups so that data can be restored after a failure. We make no claim to hold any formal security certification, and we would rather tell you exactly what we do than imply an audit we have not undergone. Where a customer needs a security questionnaire completed or a data processing agreement signed, we do that.

If a personal data breach occurs, we will notify the Data Protection Board of India and affected persons as the DPDP Act 2023 requires, and we will tell affected customers what happened, what data was involved and what we are doing about it.

If we hold your personal data as Data Fiduciary, you have the right to ask us for a summary of the data we process and how, to have inaccurate data corrected or incomplete data completed, to have data erased where we no longer need it and no law requires us to keep it, to nominate someone to exercise your rights in the event of your death or incapacity, and to raise a grievance about how we have handled your data.

To exercise any of these, email us from the address on your account. We respond within 30 days. If we need more information to verify who you are, we will ask for the minimum necessary and nothing more.

If your data is held by a business that uses Squarebox rather than by us directly, we will point you to that business, because they decide what happens to it. We will help them action your request.

This website uses only the cookies and local storage it needs to function, such as remembering that you have dismissed a notice, along with aggregate analytics to understand which pages are useful. We do not run third-party advertising trackers or sell audience data.

You can block or clear cookies in your browser at any time. The site will continue to work.

Squarebox is a business tool and is not directed at children. We do not knowingly collect personal data of anyone under 18 through this website or the platform. Under the DPDP Act 2023, processing a child's data requires verifiable parental consent, and customers who message minors as part of their business, such as schools and coaching institutes, are responsible for obtaining that consent from the parent or guardian before messaging.

If you believe a child's data has reached us in error, tell us and we will delete it.

Questions, requests and complaints about privacy should go to hello@squarebox.cloud with "Privacy" in the subject line, and they will reach the person responsible for grievance redressal at Squarebox Cloud, Bengaluru, Karnataka, India.

We acknowledge within three working days and aim to resolve within 30 days. If you are not satisfied with our response, you may escalate to the Data Protection Board of India.

When this policy changes we update the date at the top of the page. For changes that materially affect how we handle your data, we notify account holders by email at least 14 days before they take effect, so nobody discovers a substantive change by re-reading a web page.

Older versions are available on request.