Data Processing Agreement

This Data Processing Agreement ("DPA") describes how AAIDA Corp. Private Limited ("processor," operating Avox) processes personal data on behalf of your business ("controller") when you use Avox to run WhatsApp Coexistence for your own customers. It supplements our Terms of Service and applies automatically to every Avox account - no separate signature is required for the terms below to take effect, though enterprise customers may request a countersigned copy.

We process your customers' WhatsApp phone numbers, display names, and message content on your instructions, for as long as your Avox account remains active plus the limited retention period described in our Data Deletion page. Processing consists of storing, transmitting, and displaying this data back to you through the Avox dashboard, running any automations you've configured against it, and - when you turn on message forwarding - sending new customer messages to the endpoint you choose.

Data subjects: your business's own end-customers who message or call your WhatsApp number. Data categories: phone number (encrypted at rest), display name, any tags, categories, notes and fields you add to a contact, message content (including chat history and contacts synced from your WhatsApp Business app, if you share them), conversation metadata (timestamps, delivery/read status), WhatsApp Calling metadata (duration, direction, outcome) and calling permission requests, and whatever data your own WhatsApp Flow forms collect from them - which is entirely up to what you build into that Flow, and can include more than the categories listed above.

We use the following sub-processors to run Avox: Supabase (database and authentication, on Amazon Web Services in Mumbai, India), Meta (the WhatsApp Business Platform your messages travel over, via Cloud API, Coexistence, and Embedded Signup), PayPal (payment processing for your Avox plan), Vercel (hosting, in Mumbai, India), Cloudflare (network, security and delivery in front of our sites, at the location nearest each request), Fly.io (our background worker, in Mumbai, India, which sends messages, automations and emails), our email delivery provider (account, billing, and security emails to your team), Upstash (short-lived rate-limiting counters, which can include IP addresses), and ipapi.co with country.is as a backup (approximate country or location from an IP address, for sign-in devices and the currency shown on our pricing pages). Your customers' message content and phone numbers are not sent to PayPal, the email provider, Upstash, or ipapi.co. We'll notify customers of any new sub-processor before it starts processing your data, and you may object on reasonable data-protection grounds by contacting us at hello@theavoxai.com.

This DPA covers the data we process for you inside Avox. It doesn't cover how we run our own websites and dashboard (visit analytics, security and fraud checks, regional prices and our own marketing): for those we decide what is collected and why, so we act as controller, as described in our Privacy Policy. Our site analytics never records your customers' names, phone numbers or message content.

Access to the data covered by this DPA is limited to personnel who need it: AAIDA Corp.'s own support/engineering staff (role-restricted, enforced independently at both the application and database layer) and the sub-processors listed above, each bound by its own confidentiality and data-protection obligations.

Row-level security on every tenant-scoped table, encryption at rest for contact phone numbers, TLS in transit, httpOnly session cookies, signature verification on every inbound webhook, signed message forwarding, roles with per-member permissions, two-factor authentication and passkeys, and emailed one-time codes before sensitive actions. Full detail is on our Security page.

If we become aware of a personal data breach affecting your data, we'll notify you without undue delay after becoming aware of it, with the information available to us at the time, so you can meet your own regulatory notification obligations.

You may request information reasonably necessary to demonstrate our compliance with this DPA. For enterprise customers, we'll work with you to arrange a reasonable audit, subject to confidentiality and not disrupting service for other customers.

On account termination, your data is deleted as described on our Data Deletion page, except billing and payment records and records of agreement to our policies, which we keep as the law requires. Cancelling a plan on its own doesn't delete anything - your numbers pause and your data stays until you delete it. If you need an export, request one before deleting.

As described in our GDPR & EU Compliance page, our sub-processors operate outside the EU/EEA: your data is stored and processed mainly in Mumbai, India, while Cloudflare handles requests at locations around the world and Meta, PayPal and our email provider run their own global infrastructure. We rely on each provider's own published transfer safeguards.

This DPA is governed by the laws of India, consistent with our Terms of Service.

This is the public, self-serve version of our DPA. If your business needs a signed copy with its own entity details filled in, contact hello@theavoxai.com.