Privacy Policy

Last updated: 28 August 2026

1. What we collect

• Account data — your name, email, phone and company when you register.
• Business data — the records, contacts, documents and messages you store in the panel. This data is yours; we act only as its processor.
• Technical data — logs (IP, browser, timestamps) needed to keep the service secure and reliable.

2. How we use it

• To provide the service: storing your records, delivering your messages, running your automations.
• To secure the service: authentication, rate limiting, abuse prevention.
• We do not sell your data or use your business data for advertising.

3. Meta: WhatsApp, Facebook and Instagram

These only apply once you connect them yourself, from inside the panel.

• WhatsApp Business — we store your WhatsApp Business account id, phone number id and an access token (encrypted at rest), plus the messages you send and receive, so your team has an inbox and each customer has a history.
• Facebook / Instagram lead ads — we store the connected Page and ad account, their access tokens (encrypted at rest), the answers people give on your lead forms, which ad each lead came from, and daily spend figures for your own ads.
• We never post as you, never create or edit ads, and never read anything unrelated to the Page and number you connected.

The permissions requested and the exact fields stored are listed on the Meta & WhatsApp integration page. You can disconnect at any time from the panel, or revoke XetaX in Meta's Business Integrations — tokens are deleted immediately either way.

4. Third parties we rely on

• Meta (WhatsApp Business Platform) — when you connect WhatsApp, message content and phone numbers are shared with Meta to deliver messages, under Meta's own terms.
• Email delivery — emails are sent through the SMTP server you configure; its provider processes those emails.
• AI features — when you use the AI assistant or website agents, the relevant text is processed by our AI model provider solely to generate the response.

5. Storage & security

Data is stored on secured servers. Passwords are hashed; sensitive tokens (such as your WhatsApp access token and SMTP password) are stored encrypted. Access inside your organisation is controlled by the roles and permissions you configure.

6. Retention & deletion

Your data is kept while your account is active. Old notifications and email logs are purged automatically after 90 days. When you delete your account, your business data is deleted from live systems within 30 days.

7. Your rights

You can access, correct, export or delete your data from the panel, or write to us for help. If you are in a jurisdiction with specific data-protection rights (e.g. GDPR), we honour access, rectification, erasure and portability requests.

8. Deleting your data

You can delete any record, contact, document or chat yourself from the panel, and you can close the account entirely. Timings, what is kept for tax law, and how to remove data collected through WhatsApp or Facebook are on the Data deletion page.

9. Contact

Questions about this policy, or a request about your data: xetacrm@gmail.com or +91 85878 12664, Monday to Saturday, 10:00 – 19:00 IST.