Privacy

Privacy Policy

Last updated: August 12, 2026

Introduction

Inrevos ("Inrevos," "we," "us," or "our") is operated by Digi Aura360 ("Digi Aura360," "Company"), a company registered in Pakistan, with its registered address at Second Floor, Ovais Centre 3, Block A, Police Foundation, Islamabad, 46000, Pakistan ("we," "us," "our"). Inrevos is a multi-tenant SaaS platform that helps businesses and marketing agencies capture inbound leads from Meta Lead Ads and website forms, and communicate with customers over Facebook Messenger, Instagram Direct Messages and comments, Facebook comments, and WhatsApp, inside a unified inbox with sales pipeline and workflow tools.

This Privacy Policy explains what information we collect, why we collect it, how we use and protect it, who we share it with, how long we keep it, and the rights available to you. It applies to our customers (organizations and their authorized users, "Customers," "you") and, where relevant, to the end users/leads whose data our Customers process through Inrevos ("Data Subjects").

By creating an account or using Inrevos, you agree to the practices described in this Policy. If you do not agree, do not use the Service.

1. Roles: Controller and Processor

For Account and Usage Data (see §2), Digi Aura360 acts as the data controller: we decide why and how that data is processed, and you can exercise your rights (§9) directly with us.

For Lead Data and Conversation Data submitted, imported, or received into a Customer’s Inrevos workspace, the Customer is the data controller and Digi Aura360 acts as a data processor (or "service provider" under CCPA), processing that data only on the Customer’s instructions and for the purpose of operating the Service. If you are a lead or contact of one of our Customers and want to exercise a data right over that data, please contact the Customer (business) directly; we will assist them in fulfilling that request as described in §9.

2. Information We Collect

We collect the following categories of information: Account information (name, email address, phone number, and password, stored as a salted bcrypt hash, never in plaintext); Organization information (company name, industry, and organization/workspace details provided at signup); Meta / Facebook data (OAuth access tokens, encrypted at rest, connected Page and Instagram Business Account identifiers, Ad Account identifiers, and Lead Ads form data, retrieved when a Customer connects their Meta account); WhatsApp Business data (WhatsApp Business phone number ID, WhatsApp Business Account (WABA) ID, access tokens encrypted at rest, and the content and metadata of messages sent and received through a connected number, once WhatsApp is enabled on an account); Lead and conversation data (names, phone numbers, email addresses, message content, comments, ad/campaign attribution, and other details of leads and contacts managed in the CRM, whether entered manually, imported, or received automatically from a connected channel); Usage and device data (login activity, IP address, browser and device type, and similar technical data collected automatically); and Audit and security logs (records of who accessed or changed what data and when, retained for security and compliance purposes, with PII redacted where possible).

We only collect the data categories above; we do not collect data beyond what is needed to operate the features a Customer actively uses.

3. How We Use Information

We use the information we collect to: provide core CRM functionality (lead management, pipelines, tasks, and workflow automation); send and receive messages on a Customer’s behalf via the WhatsApp Business Platform, Facebook Messenger, and Instagram; import and synchronize leads from connected Meta Ads accounts and Lead Gen Forms, and from website forms via webhook; authenticate accounts, enforce role-based access, and keep data secure; send service-related notifications and respond to support requests; detect, investigate, and prevent fraud, abuse, and security incidents; and maintain, monitor, and improve the reliability, performance, and features of the platform, using aggregated and de-identified analytics only (no individual profiling, no use for advertising).

We do not sell personal data, use it for advertising or marketing to end users, or use it for profiling or discriminatory purposes. We do not share data with third parties beyond what is described in §5, and never without a lawful basis.

4. Lawful Basis for Processing

Where GDPR or an equivalent regime applies, our lawful bases are: lead data captured via Lead Ads / forms — legitimate interest of the Customer (business) in following up with its own prospects, as documented in the Customer’s own privacy notice to its leads; organization account data — performance of a contract (our Terms of Service) with the Customer; message/conversation data — legitimate interest plus consent, obtained by the Customer when it connects its Meta/WhatsApp account and communicates with its own contacts; usage/analytics data — consent, with an opt-out available in account settings, not used for third-party ad targeting; and security and audit logs — legitimate interest in securing the Service and complying with legal obligations.

5. Third Parties and Subprocessors

We share data only as needed to operate the Service, and never sell or rent personal data. Our subprocessors: Meta Platforms, Inc. — Graph API access for Pages, Ad Accounts, Lead Ads, Messenger, Instagram, and WhatsApp Business Platform messaging (OAuth tokens, Page/Ad Account IDs, lead and message data), governed by Meta’s Platform Terms and Data Policy. Amazon Web Services (AWS), eu-north-1 (Sweden) — backend application and database hosting (all application data), EU. Vercel Inc. — frontend hosting / CDN (data in transit only). Slack Technologies (optional) — Customer-enabled notification integration (organization name and lead summary only, never full conversation content). Zapier Inc. (optional) — Customer-configured workflow integration (only the fields the Customer explicitly maps into a Zap). Email/SMTP provider — transactional and notification email (organization/user email addresses only).

Optional integrations (Slack, Zapier) only receive data if a Customer explicitly enables them; they can be disabled at any time. We maintain signed data processing agreements with infrastructure subprocessors and will update this list if subprocessors change materially, with advance notice to Customers for any new subprocessor that will process Lead or Conversation Data.

6. International Data Transfers

Our infrastructure is hosted in the EU (AWS eu-north-1). Where data is transferred outside the jurisdiction it was collected in (for example, to our team or support staff located in Pakistan), we rely on appropriate safeguards such as Standard Contractual Clauses, Meta’s and our subprocessors’ own compliance certifications, and contractual confidentiality obligations.

7. Data Retention and Deletion

We apply tiered retention so data is not kept longer than necessary. Lead data: personally identifiable fields retained for 12 months of active retention from creation, then anonymized (name/email/phone/custom fields stripped) and kept anonymized for a further 12 months for aggregate reporting, then permanently deleted — 24 months total. Customers can delete any individual lead at any time. Conversation data (messages): retained 24 months from creation, then permanently deleted (no anonymization step, given message content is harder to safely anonymize). Customers can delete any conversation at any time. Webhook/API delivery logs: 90 days. Error/security logs: 6 months. Access/audit logs: 6 months, stripped of PII wherever possible. Database backups: encrypted, 7-day rolling retention. Account and profile data: retained until account closure or deletion request. Meta/WhatsApp access tokens: deleted immediately on disconnect of the corresponding integration.

Upon a verified deletion request (see our Data Deletion page), we complete deletion within 7 days, well inside the 30-day maximum required by Meta's Platform Terms, except for the limited records we are legally required to retain (e.g., financial/transaction records, and an audit log of the deletion event itself, which contains no personal data beyond what's needed to prove compliance). Backups are purged of deleted data on their normal rolling rotation.

8. How We Protect Your Data

Encryption in transit: TLS 1.2+ enforced on all endpoints; HSTS enabled. Encryption at rest: sensitive fields (Meta/WhatsApp tokens, phone numbers, emails) are encrypted with AES-256-GCM; encryption keys are managed separately from application data and rotated quarterly. Access control: role-based access control (Admin/Agent/Viewer); strict tenant isolation — every query is scoped by organization ID so Customers can never access another organization’s data. Authentication: JWT-based sessions with short-lived access tokens, bcrypt password hashing, brute-force lockout, and optional two-factor authentication (TOTP). Webhook integrity: every inbound Meta/WhatsApp webhook is verified against its cryptographic signature (X-Hub-Signature-256) before processing; unverified requests are rejected and logged. Infrastructure: private VPC, database not exposed to the public internet, restrictive firewall rules, automated daily encrypted backups. Monitoring: error and security monitoring with alerting; audit logs of data access and modification.

No casual internal access: our team does not browse Customer lead/conversation data outside of what’s needed to provide support or fix a reported issue, and such access is logged.

9. Your Rights

Depending on your location, you (or, where you are a Data Subject of one of our Customers, your request routed through that Customer) may have the right to: Access — request a copy of the personal data we hold about you. Correction — ask us to correct inaccurate or incomplete data. Deletion — request deletion of your account and associated personal data. Portability — request your data in a structured, machine-readable format. Restriction / objection — ask us to limit or stop certain processing. Withdraw consent — disconnect any Meta or WhatsApp integration at any time from account settings. Non-discrimination (CCPA) — you will not be denied service or charged differently for exercising your rights.

To exercise these rights, contact us at the address in §14. We will verify your identity, and respond within 30 days (or sooner where required by law). If you are a lead/contact of one of our business Customers rather than an Inrevos account holder, we will forward your request to the relevant Customer, who is the controller of that data, and support them in completing it.

10. Children's Privacy

Inrevos is a business tool and is not directed to, and may not knowingly be used by, individuals under 18. We do not knowingly collect personal data from children. If we learn that we have inadvertently collected such data, we will delete it promptly.

11. Cookies and Tracking

We use strictly necessary cookies (e.g., session authentication) and, where enabled, functional cookies to remember preferences. We do not use third-party advertising cookies or trackers. Where required by law, we will present a cookie consent banner allowing you to decline non-essential cookies.

12. Data Breach Notification

In the event of a data breach affecting personal data, we will notify affected Customers without undue delay and in any event within 72 hours of becoming aware, consistent with GDPR Article 33, and will provide the information needed for Customers to meet their own notification obligations to their end users and regulators.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected in the "Last updated" date above, and where changes are significant, we will notify Customers by email or in-app notice before they take effect.

14. Contact Us

Digi Aura360, Second Floor, Ovais Centre 3, Block A, Police Foundation, Islamabad, 46000, Pakistan.

Email: privacy@inrevos.com

For EU/UK data subjects: if you believe we have not resolved your concern, you have the right to lodge a complaint with your local data protection authority.