Privacy Policy

1. Introduction

Invollo (“we”, “our”, or “us”) operates the Invollo platform, a cloud-based invoicing and business management solution for Indian businesses. This Privacy Policy explains how we collect, use, share, and protect your personal information when you use our services, including features powered by the WhatsApp Business API.

By using Invollo, you agree to the practices described in this policy. If you do not agree, please discontinue use of our services.

2. Information We Collect

2.1 Account & Profile Data

• Name, email address, phone number, and password
• Business name, GST number, PAN, and registered address
• Bank account details for payment reconciliation

2.2 Business & Transaction Data

• Invoice and billing records, client contact details
• Payment history, due amounts, and transaction metadata
• GST filings, e-invoice, and e-way bill information

2.3 WhatsApp Business API Data

Invollo integrates with the WhatsApp Business API (provided by Meta Platforms, Inc.) to send invoice notifications, payment reminders, and business communications to your clients on your behalf. When this feature is used:

• We collect and store the recipient's WhatsApp-registered phone number
• Message content (invoice details, payment links, reminders) is transmitted through WhatsApp's infrastructure
• Delivery status, read receipts, and message timestamps are recorded
• Opt-in and opt-out preferences of message recipients are stored
• We do not store the full content of inbound messages beyond what is necessary to process automated replies

2.4 Usage & Technical Data

• IP address, browser type, device information
• Pages visited, features used, session duration
• Error logs and diagnostic data

3. How We Use Your Information

• Service delivery: To create invoices, manage clients, process payments, and generate GST reports
• WhatsApp communications: To send invoice PDFs, payment reminders, and status updates to your clients via WhatsApp on your behalf
• Account management: Authentication, billing, and customer support
• Product improvement: Analysing usage patterns to enhance features and fix bugs
• Compliance: Meeting legal obligations under Indian law (IT Act, GST law, etc.)
• Security: Detecting fraud, abuse, and unauthorized access

4. WhatsApp API – Additional Disclosures

Our use of the WhatsApp Business API is governed by Meta's WhatsApp Business Policy and Commerce Policy. By enabling WhatsApp features in Invollo, you acknowledge and agree that:

• Your clients' phone numbers and message content may be processed by Meta's servers, which may be located outside India.
• You are solely responsible for obtaining valid, documented consent from your clients before sending them WhatsApp messages through our platform.
• Messages sent must comply with WhatsApp's Acceptable Use Policy. Invollo reserves the right to disable WhatsApp messaging for accounts found in violation.
• You must provide clients with a clear and easy opt-out mechanism. Invollo automatically honours opt-out requests received via WhatsApp.
• Invollo acts as a data processor with respect to your clients' data shared for WhatsApp messaging; you are the data controller.

5. Data Sharing & Third Parties

We do not sell your personal data. We may share data with:

• Meta Platforms (WhatsApp): To deliver messages via the WhatsApp Business API
• Payment gateways: Razorpay or similar processors to handle subscription payments
• Cloud infrastructure: AWS / Google Cloud for hosting and storage
• Analytics providers: Aggregated, anonymised data only
• Legal authorities: When required by law, court order, or regulatory directive

All third-party processors are bound by data processing agreements that require them to protect your information.

6. Data Retention

We retain your account and business data for as long as your account is active or as required by Indian tax and accounting laws (typically 8 years for financial records). WhatsApp message logs are retained for up to 90 days for troubleshooting, then deleted. You may request earlier deletion, subject to legal retention obligations.

7. Data Security

We implement industry-standard safeguards including TLS encryption in transit, AES-256 encryption at rest, access controls, and regular security audits. However, no system is completely secure, and we cannot guarantee absolute security.

8. Your Rights

Under applicable law, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Request deletion of your data (subject to legal retention requirements)
• Withdraw consent for WhatsApp messaging at any time
• Lodge a complaint with India's data protection authority

To exercise these rights, email us at [email protected].

9. Children's Privacy

Invollo is intended for business use by adults (18+). We do not knowingly collect data from minors. If you believe a minor has provided us with personal data, contact us immediately.

10. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes via email or an in-app notice at least 14 days before the change takes effect. Continued use of Invollo after the effective date constitutes acceptance of the revised policy.

11. Contact Us

For privacy-related queries or requests: