Who we are
Digiboffins ("we", "us") provides a platform that lets businesses manage WhatsApp Business conversations with their own customers. This policy explains what data we handle and why. For any questions, contact info@signalaiso.com.
Our role
Businesses that use our platform decide what messages to send and to whom. For that message content we act as a processor on their behalf; they are the controller and their own privacy policy governs their use. We are the controller for the account data of the users who log in to our platform.
What we collect
- Account data — name, email address, and password hash for each user of the platform, plus the workspace they belong to and their role.
- WhatsApp connection data — the WhatsApp Business Account ID, business phone number ID, and access token issued by Meta when a business connects its account. Access tokens are encrypted at rest.
- Message data — messages sent and received through connected WhatsApp Business numbers, including the contact's phone number, profile name, message content, delivery status, and timestamps.
- Booking data — when a business uses in-chat bookings: the meetings booked with its customers (time, meeting type, place or video link, status), and the customer's email address if the business enters one for a calendar invite.
- Google Calendar data — if a business connects a Google Calendar. The section below explains exactly what we access.
- Operational data — audit logs of significant actions, error reports, and technical logs used to run and secure the service.
How we use it
- To deliver messages to and from WhatsApp via Meta's WhatsApp Business Platform.
- To display conversations, contacts, and templates inside the platform.
- To authenticate users and enforce access controls between workspaces.
- To measure usage against plan limits and to bill for subscriptions.
- To detect, investigate, and fix faults and abuse.
We do not sell personal data, and we do not use message content for advertising.
Sharing
We share data only with providers needed to operate the service:
- Meta Platforms — to send and receive WhatsApp messages.
- Google — when a business connects Google Calendar, to read its free/busy times and create, move and cancel the events for bookings it makes.
- Our hosting and database providers — to store and serve the application.
- Our payment processor — to handle subscription billing.
- Error monitoring — to capture diagnostics when something fails.
We may also disclose data where required by law.
Google Calendar data
A business can connect one Google Calendar so its team can offer customers free times in a WhatsApp chat and have each booking added to that calendar. Connecting is optional, is done by a workspace administrator, and can be undone at any time.
When a calendar is connected, SignalAiso asks Google for these permissions only:
- Your Google account's email address (
openid,email) — to show which account is connected. - Free/busy information (
calendar.freebusy) — the times the calendar is busy, so we only offer times that are free. We see that a time is busy, not what the event is: no titles, descriptions or attendees of your other events. - Events on calendars you own (
calendar.events.owned) — to create the event for a booking (with a Google Meet link when the meeting is online), move it when the time changes, and delete it when the booking is cancelled. We only change events that SignalAiso created. - Your calendar list, read-only (
calendar.calendarlist.readonly) — to find your primary calendar and whether it can create Google Meet links.
What we store:
- The connected account's email address, the calendar's ID, the permissions granted, and the connection's health.
- The refresh token Google issues, encrypted at rest. Short-lived access tokens are cached, encrypted, for under an hour.
- For each booking: the Google event ID and the Meet link, so the booking can be moved or cancelled and the link shared with the customer.
We do not store free/busy results: they are read when times are offered and discarded. Events we create carry the meeting type, the customer's first name, the time and the place or Meet link — never the customer's phone number or the content of the chat. If the business enters the customer's email address, the customer is added as the event's guest and Google sends them the invitation and any later change; guests cannot see other guests or edit the event.
Google Calendar data is used only to provide the booking feature to the business that connected it. We do not sell it, use it for advertising, share it with anyone other than as described here, or use it to train or improve artificial intelligence or machine learning models. Our staff do not read it, except with the business's permission to resolve a support request, where needed for security, or to comply with the law.
SignalAiso's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Disconnecting. A workspace administrator can disconnect the calendar in Settings → Bookings. We then revoke our access with Google and delete the stored token and connection details straight away. Events already created stay on your calendar, as they are your appointments. You can also remove SignalAiso's access at any time from your Google Account at myaccount.google.com/permissions. When a workspace is closed, its calendar connection is deleted along with its other data, within 90 days.
Separation between businesses
Every record is tagged with the workspace that owns it, and access is checked on every request. One business cannot read another business's conversations, contacts, or templates.
Retention
We keep message and contact data for as long as the business's account is active, because those are the business's own records of its customer conversations. When an account is closed, its data is deleted within 90 days, except where we must retain records to meet a legal or accounting obligation.
Some data is removed on a shorter, automatic schedule:
- Raw delivery data — the unprocessed copy of each message as it arrives from WhatsApp, which we keep briefly to diagnose delivery problems — is erased after 30 days. The message itself remains in the conversation; only the duplicate raw copy is removed.
- Delivery records — the sent, delivered and read timestamps behind each message — are removed after 90 days.
- Backups roll off within 7 days. Deleted data is gone from those too, and we do not restore deleted data from a backup.
We keep records of significant actions taken in the platform — who changed what, and when — for security and dispute resolution. These identify the account holder who acted, not the content of any message.
Your rights
Depending on where you live, you may have the right to access, correct, export, or delete your personal data, or to object to certain processing. If you were messaged by a business using our platform, please contact that business first, as they control those conversations. You can also write to us at info@signalaiso.com and we will assist.
Deleting your data
To request deletion of data we hold about you, email info@signalaiso.com with the subject "Data deletion request" and the phone number or email address concerned. We will confirm the request and complete it within 30 days.
Full instructions — including what we delete, what we are required to keep, and what to do if you do not know which business holds your data — are on our Data Deletion Instructions page.
Security
Access tokens and other credentials are encrypted at rest. Traffic is served over HTTPS. Access to production systems is limited to staff who need it. No system is perfectly secure, but we work to protect data in line with industry practice.
Changes
If we make a material change to this policy we will update the date above and, where appropriate, notify account administrators.