Privacy Policy | Trixloop

1. Introduction

Trixloop ("we," "us," or "our") provides a customer relationship management (CRM) platform built for WhatsApp Business ("the Service"). This Privacy Policy explains what information we collect, how we use it, how we store it, and what choices you have. By using the Service, you agree to the practices described in this policy.

This policy applies to our website, our CRM platform, and any dedicated installations we host or help set up on behalf of a business client.

2. Information We Collect

This policy covers two categories of data. It is important to understand the difference between them.

Account and Website Data (covered fully by this policy)

This is data we collect directly about you as a user of our website or as an authorized user of a business account, such as business name, contact person name, email address, phone number, billing address, payment details, and general website usage data (browser type, IP address, pages visited).

Client Service Data (processed on our clients' behalf, not owned by us)

When a business signs up for the Service, they may upload or generate contact lists, WhatsApp conversation content, and customer data through the platform in the course of running their own business ("Service Data"). This data belongs to that business client, not to Trixloop. Our client determines what data is collected from their customers, how it is used, and how long it is kept. If you are a customer of one of our business clients and have questions about how your data is used, please contact that business directly rather than us, since we act only as their service provider for this data.

WhatsApp Business Data

To provide the Service, we process data connected to your WhatsApp Business account, including your WhatsApp Business phone number, message templates submitted for approval, conversation content between your team and your customers, contact lists you upload or collect through WhatsApp, and delivery and read status of messages. Note that WhatsApp's own Cloud API temporarily stores message content to relay it to the recipient, and automatically removes it from Meta's systems after a limited retention window set by Meta, separate from how long we retain it on our side.

Usage Data

We collect information about how you use the platform, such as login times, features used, and general activity logs, to help us maintain and improve the Service.

Cookies and Website Data

Our website may use cookies and similar technologies to understand visitor behavior and improve the website experience. See Section 10 for details.

Third-Party Sign-In and Integrations

If you sign in or connect the Service using a third-party account (such as Google or Facebook/Meta), that provider may separately collect information as part of that sign-in process, governed by their own privacy policy, not ours.

3. How We Use Information

We use the information we collect to:

Provide, operate, and maintain the CRM platform and its features, including the shared inbox, contact management, sales pipeline, analytics, message templates, and broadcast campaigns
Set up and manage your WhatsApp Business API connection, including template submissions to Meta for approval
Communicate with you about your account, billing, and support requests
Improve and develop new features for the Service
Detect, prevent, and address technical issues, fraud, or misuse of the Service
Meet legal and regulatory obligations

With Meta / WhatsApp

Because the Service operates through the WhatsApp Business API, relevant data (such as your business phone number, message templates, and message content) is shared with Meta/WhatsApp as required to deliver messaging functionality. Meta's own privacy policy governs how Meta processes this data on its platform.

With Service Providers

We may share information with trusted third-party vendors who help us operate the Service, such as hosting providers, payment processors, and customer support tools. These providers are only permitted to use your information to perform services on our behalf.

For Dedicated Installations

If you have requested a dedicated installation (private subdomain, custom domain, or your own server), your data is kept in that separate installation and is not mixed with data from other clients, except where you have installed the Service on your own infrastructure, in which case you are responsible for your own server's security and data handling.

Business Transfers

If we are involved in a merger, acquisition, financing, or sale of all or part of our business, your information may be transferred as part of that transaction. We will notify affected clients if this results in a change to how their data is handled.

We do not sell your personal information or your customers' information to third parties.

5. Data Storage and Hosting

Depending on the plan and setup you choose, your data may be hosted:

On a shared multi-tenant environment with logical separation between clients
On a dedicated subdomain or subfolder specific to your business
On a custom domain configured for your business
On your own server, if you have chosen a self-hosted installation

Where we host your installation, we apply reasonable technical and organizational measures to keep client data separated and secure. Where the installation is on your own server, data storage and security are your responsibility.

6. Security Measures

We implement reasonable administrative, technical, and organizational safeguards designed to protect your information against unauthorized access, disclosure, alteration, or destruction. These measures include access controls limiting who can view or handle your data, encryption of data in transit, and regular review of our security practices. For dedicated installations we host, these safeguards apply to the environment we manage. Where the Service is installed on your own server, you are responsible for securing that environment. No method of storage or transmission over the internet is completely secure, so while we work to protect your information, we cannot guarantee absolute security.

7. Data Retention

We retain account and business information for as long as your account is active, and for a reasonable period afterward to comply with legal, accounting, or reporting obligations. Conversation and contact data is retained according to your plan settings and applicable law, and you may request deletion of your data as described in Section 8A.

Meta's Data Retention

Message delivery is facilitated through the WhatsApp Business Platform operated by Meta. The processing and retention of data by Meta are governed by Meta's own policies.

8. Your Rights and Choices

Depending on your location, you may have rights to:

Access the personal information we hold about you
Request correction of inaccurate information
Request deletion of your information, subject to legal or contractual retention requirements
Object to or restrict certain processing of your information
Request a copy of your data in a portable format

To exercise any of these rights, contact us using the details in Section 14. We may need to verify your identity before completing certain requests.

8A. How to Request Deletion of Your Data

You can request deletion of your personal data, your business account data, or your WhatsApp conversation data at any time by:

Emailing us with the subject line "Data Deletion Request," or
Using the in-app data deletion option under Account Settings (if available)

Once we receive a valid request, we will verify your identity, delete or anonymize your data within 30 days, and confirm completion by email. Some information may be retained for a limited period where required by law.

If you are located in the European Union, the European Economic Area, or the United Kingdom, the following additional information applies to you under the GDPR and UK GDPR.

Legal Basis for Processing

We process your personal data on one or more of the following legal bases: performance of a contract with you (for example, to provide the Service you signed up for), our legitimate interests (for example, improving the Service or preventing fraud), your consent (for example, for certain cookies or marketing communications), or compliance with a legal obligation.

International Data Transfers

Where your data is transferred outside the EU/EEA or UK (for example, to hosting providers or team members located elsewhere), we take steps intended to ensure an adequate level of protection, such as relying on Standard Contractual Clauses or an equivalent safeguard recognized under GDPR.

Data Controller and Processor Roles

For Account and Website Data, Trixloop acts as the data controller. For Client Service Data (the contact and conversation data our business clients collect through the Service), Trixloop acts as a data processor, and our business client acts as the data controller responsible for that data.

Your Right to Complain

If you believe we have not handled your personal data in accordance with GDPR or UK GDPR, you have the right to lodge a complaint with your local data protection supervisory authority, in addition to contacting us directly.

EU/UK Representative and Data Protection Officer

[Insert EU/UK representative name and contact details, if appointed] / [Insert Data Protection Officer name and contact details, if appointed]. If neither has been appointed yet, use the general contact details in Section 14 for any GDPR-related request.

10. Cookies and Tracking

Our website may use cookies and similar tracking technologies to:

Remember your preferences
Understand how visitors use our website
Support advertising and retargeting campaigns on platforms such as Google and Meta

You can control cookies through your browser settings. Disabling cookies may affect some website functionality.

11. Third-Party Links and Services

Our website and platform may contain links to third-party websites or integrate with third-party services (such as Meta/WhatsApp, payment processors, or analytics tools). We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies separately.

12. Children's Privacy

The Service is intended for business use and is not directed at individuals under the age of 18. We do not knowingly collect personal information from children.

13. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by updating the "Last Updated" date above, and where appropriate, through direct notice (such as email or an in-app notice).