How AR Inbox handles your data

Last updated: August 18, 2026

AR Inbox ("we", "us", "the Service") is a multi-merchant team inbox for businesses that use the Meta WhatsApp Business Platform (the "WhatsApp Cloud API"). This Privacy Policy describes what information we collect, how we use it, how we store it, who we share it with, and the rights you have over your data. It applies to the web application hosted at wa.appringer.co.in and to any sub-domains that serve the same application.

1. Who is the data controller?

AR Inbox acts as a data processor for the WhatsApp conversations our merchant businesses route through us; the merchant business is the data controller for messages exchanged with their customers. We are the data controller for the account-level information described in section 2 below (operator emails, billing data, etc.).

2. What we collect

2.1 Account & operator data

Name and email address of every user (super-admin, merchant-admin, manager, agent).
Bcrypt-hashed passwords. We never see or store plaintext passwords.
Login timestamps, browser session identifiers, and IP addresses for security auditing.
Role assignment and the merchant a user belongs to.

2.2 Business / WhatsApp Business Account (WABA) data

When a merchant connects their WhatsApp Business Account via Meta's Embedded Signup flow (or the manual paste form), we receive and store:

WhatsApp Business Account ID (waba_id) and parent Meta business ID.
Phone number IDs, display numbers, verified names, and quality ratings.
A long-lived business access token issued by Meta for the merchant's WABA.
Webhook verify tokens generated for that WABA.

Access tokens and webhook verify tokens are encrypted at rest using AES-256-CBC keyed off the application's APP_KEY. Plain-text tokens never appear in our database dumps, logs, or API responses (they are excluded via the model's $hidden array).

2.3 Conversation & messaging data

Inbound and outbound WhatsApp messages (text, template, media references) routed through your WABA.
Customer contact records: WhatsApp ID (wa_id), display name where available, last-seen timestamp.
Conversation metadata: thread state (open/closed), assigned agent, unread counters.
Message delivery status events (sent / delivered / read / failed) received from Meta webhooks.
Audit log of which operator sent which message, when, and on whose behalf.

2.4 Billing & wallet data

Wallet balance, transaction ledger, and recharge request history per merchant.
Razorpay or other payment-gateway transaction identifiers (we do not store full card numbers, CVVs, or bank account details — these stay with the gateway).

2.5 Information we do not collect

We do not buy data from third parties to enrich your profile.
We do not run advertising trackers or third-party analytics that fingerprint individual visitors.
We do not sell your data to anyone, under any circumstances.

3. How we use it

To operate the Service: route WhatsApp messages to and from Meta's Cloud API on behalf of the merchant business.
To enforce merchant isolation: every row in our database is scoped by merchant_id; queries are filtered automatically by Laravel global scopes so merchant A can never read merchant B's data.
To bill and meter usage: each outbound message is debited from the merchant's prepaid wallet via an atomic ledger entry.
To debug: we keep server logs of API calls, webhook deliveries, and queued job runs for up to 30 days.
To secure the platform: rate-limit logins, detect abuse, revoke compromised sessions.

4. Where data is stored

Application data lives in our managed PostgreSQL or MySQL database hosted in the region we have configured for production. Encrypted access tokens never leave that database. Server logs are streamed to our logging provider with a retention window of 30 days. Backups are encrypted in transit and at rest.

5. Sharing with third parties

We share the minimum data necessary with the following processors, only in the course of operating the Service:

Meta Platforms, Inc. — every WhatsApp message you send or receive necessarily transits the WhatsApp Cloud API. Meta's own privacy policy applies to that leg.
Payment gateway (Razorpay) — wallet recharges. We send the gateway the amount and order metadata; we never touch the cardholder data.
Transactional email provider — password reset, billing notifications, low-balance alerts. Operator email addresses only.
Object storage — if S3-compatible storage is configured, inbound WhatsApp media (images, documents) is fetched and stored encrypted in your configured bucket.

We do not share data with advertisers, data brokers, or for any marketing purpose.

6. Retention

Account data: kept while the merchant is active. Deleted within 30 days of account termination.
Conversation & message data: kept for the full lifetime of the merchant's subscription. Merchants may request earlier deletion via the Data Deletion process (see section 8 below).
Server logs: 30 days, then purged.
Billing & ledger records: retained for the duration required by applicable tax law (typically 7 years).

7. Your rights

Under GDPR, the Indian DPDP Act, and similar laws you have the right to:

Access a copy of the personal data we hold about you.
Correct inaccurate or incomplete data.
Request deletion of your account and associated data (see section 8).
Export your data in a machine-readable format.
Withdraw consent at any time without affecting the lawfulness of prior processing.
Lodge a complaint with your local data protection authority.

8. Account & data deletion

To delete a merchant or individual user account, follow the steps at https://wa.appringer.co.in/data-deletion. Deletion is irreversible and is processed within 30 days of request.

9. Children

The Service is built for business operators, not consumers. We do not knowingly collect data from anyone under 16. If you believe a minor has signed up, contact us and we will delete the account.

10. Security

All traffic is served over TLS 1.2+ (HTTPS).
Passwords are hashed with bcrypt.
Sensitive credentials (WhatsApp access tokens, webhook secrets, SMTP passwords, SES secrets) are encrypted at rest with AES-256-CBC.
Database queries are scoped per merchant; cross-merchant reads are blocked at the ORM layer and verified by automated tests.
Webhook signatures from Meta are verified with HMAC-SHA256 against the App Secret on every inbound request.
API tokens (Laravel Sanctum) are hashed in the database; we cannot recover a token once issued.

11. Changes to this policy

We may update this policy from time to time. When we do, we will post the new version at this URL and update the "Last updated" date at the top. Material changes will be communicated via email to the merchant's billing contact.

Questions? Contact us at hello@appringer.com.