Who we are
InnovateX Media ("we", "us", or "our") is a performance marketing company based in New Delhi, India. This policy covers three properties: our website at innovatexmedia.com, the Performance Hub client dashboard at dashboard.innovatexmedia.com, and InnovateX CRM at chats.innovatexmedia.com.
Information we collect
When you contact us, book a discovery call, or use our services, we collect:
- Your name, email address, phone number, and business details
- Information about your business goals and ad accounts (if you grant us access)
- Aggregated, anonymized usage data from our website
How we use information
We use the information we collect to:
- Respond to your inquiries and deliver the services you've requested
- Operate ad accounts and reporting on your behalf
- Improve our website and services
- Comply with legal obligations
We do not sell your personal information to third parties.
Cookies
Our website uses minimal cookies for essential functionality and aggregated analytics. You can disable cookies in your browser settings without breaking the site.
Data sharing
We share data only with:
- Service providers who help us operate (hosting, email, analytics) — bound by confidentiality agreements
- Ad platforms (Meta, Google, etc.) when you instruct us to manage campaigns on your behalf
- Authorities when required by Indian law
InnovateX CRM
InnovateX CRM at chats.innovatexmedia.com is a subscription product, separate from our agency work. Customers sign up, get their own workspace, and connect their own WhatsApp Business Account to it. The sections below apply to that product.
We act in two different roles, and it matters which one applies to you:
- We are the controller for our own customers' account data — name, work email, phone number, company, workspace settings, subscription and billing records, login and audit logs. We decide how that data is used.
- We are a processor for everything inside a customer's workspace, including their WhatsApp conversations, contacts and leads. That data belongs to the customer. We process it on their instructions, to run the service they pay for, and for nothing else. If you messaged a business through our platform and want your data removed, ask that business — they decide. See our data deletion instructions.
Meta Platform Data
When a customer connects a WhatsApp Business Account through Meta's Embedded Signup, we receive and store:
- WhatsApp Business Account ID, phone number ID, display name and verification status
- Business and asset IDs returned by Embedded Signup, and the business access token issued for that connection
- Inbound and outbound message content, attached media and timestamps
- WhatsApp phone numbers and profile names of the people who message the business
- Delivery and read status received through webhooks
We ask Meta for three permissions, and no others:
- whatsapp_business_management — to read and manage the connected WhatsApp Business Account, its phone numbers and its message templates
- whatsapp_business_messaging — to send and receive messages on the customer's behalf
- business_management — to identify the business assets a customer selects during signup
We use Facebook Login for Business only inside WhatsApp Embedded Signup, so that a customer can connect their own WhatsApp Business Account. It is not a way to sign in to InnovateX CRM. We do not request email, public profile, or any user_ permission, and we do not read anything from a personal Facebook profile.
What we never do with Platform Data
Data we receive from Meta is used only to operate the WhatsApp panel for the customer it belongs to. We never:
- sell, rent or license it
- use it for advertising, ad targeting, or building ad or lookalike audiences
- pass it to data brokers, monetisation services or information resellers
- use it to decide anyone's eligibility for credit, insurance, employment, housing or education
- combine it across customer workspaces, or profile anyone across tenants
- use it to train general-purpose AI models
We comply with Meta's Platform Terms, the Meta Developer Policies and the WhatsApp Business Messaging Policy.
Sub-processors
We use a small number of outside services to run InnovateX CRM. Each is bound by contract to protect this data at least as well as we do, and to use it only to provide their service to us.
- Render — application and worker hosting
- MongoDB Atlas — primary database
- Redis — queues, caching and real-time delivery
- Cloudinary — storage and delivery of message media such as images, documents and voice notes
- Razorpay — subscription billing and payments
- [[EMAIL PROVIDER]] — transactional email: verification, password reset and notifications
- [[AI PROVIDER]] — drafting suggested replies in the AI Reply Assistant
The AI Reply Assistant is optional and does nothing unless a customer turns it on. When it is on, [[AI PROVIDER]] receives [[WHAT THE AI PROVIDER RECEIVES]] in order to draft a suggested reply. The draft is shown to the customer's team to send, edit or discard; it is not sent automatically.
Optional integrations
A customer can switch these on from their workspace. If they do not, no data reaches them.
- Shopify — orders and customer records are pulled in to create and update leads
- SendGrid — email delivery and engagement events are received back through a webhook
- Google Ads — campaign and conversion data is pulled in for attribution reporting
- Cal.com — booking events are received through a webhook to create bookings
A customer can also connect WhatsApp through a third-party provider instead of Meta directly — WATI, Interakt, AiSensy, Gallabox, Twilio, 360dialog or their own webhook. Where they do, their messages pass through that provider under its own terms and privacy policy, and Meta Platform Data does not reach us from Embedded Signup.
Where data is stored
Our application, database and media storage run in [[HOSTING REGIONS]]. Where that is outside India, your data is transferred and held there under our contracts with those providers, which require protection equivalent to this policy.
How long we keep data
- Message content and conversation history — [[RETENTION: MESSAGES]]
- Message media — [[RETENTION: MEDIA]]
- Delivery and read logs — [[RETENTION: DELIVERY LOGS]]
- WhatsApp access tokens — kept only while the account is connected, deleted when it is disconnected
- Account, workspace and billing records — [[RETENTION: ACCOUNT RECORDS]] after the account is closed, except records we are required to keep under Indian tax and accounting law
- Backups — [[RETENTION: BACKUPS]]
Disconnecting WhatsApp
A customer can disconnect their WhatsApp Business Account at any time from WhatsApp settings in their workspace. When they do, we revoke the access token, stop accepting webhooks for that account, and delete the Meta Platform Data held for it within [[RETENTION: AFTER DISCONNECT]].
Deleting your data
Full instructions are on our data deletion page. In short: a customer can delete their workspace from account settings, or email info@innovatexmedia.com from the address on the account. We complete deletion within [[RETENTION: AFTER DELETION REQUEST]] and confirm by email. Backups are purged within [[RETENTION: BACKUPS]].
If a subscription ends and the account is not deleted, we delete the workspace and its data [[RETENTION: AFTER TERMINATION]] after the subscription ends.
Security
- Data is encrypted in transit with TLS, and at rest by our hosting and database providers
- WhatsApp access tokens and provider credentials are encrypted before they are stored
- Passwords are hashed with argon2 and never stored in readable form
- Every workspace is isolated — queries are scoped to a single tenant, and no customer can reach another customer's data
- Access inside the product is role-based: owner, admin, sales user and read-only, each with its own permissions
- Staff access to production data is limited to the people who need it to support customers
Your rights
You can request access to, correction of, or deletion of your personal data at any time by emailing info@innovatexmedia.com. We respond within 30 days.
Grievance officer
Under India's Digital Personal Data Protection Act 2023 you can raise a complaint about how we handle your data with:
- [[GRIEVANCE OFFICER NAME]], Grievance Officer
- Email — [[GRIEVANCE OFFICER EMAIL]]
- Post — InnovateX Media, [[POSTAL ADDRESS]], New Delhi, India
We acknowledge complaints within 7 days and aim to resolve them within 30 days.
Age
InnovateX CRM is a business product. It is not intended for anyone under 18, and we do not knowingly collect data from children. If you believe a child's data has reached us, email info@innovatexmedia.com and we will delete it.
Changes to this policy
We may update this policy from time to time. The "last updated" date at the top will reflect the most recent change.
Contact us
Questions about this policy? Email info@innovatexmedia.com or WhatsApp +91 74288 55569.
