Privacy Policy

This policy explains how Infinitus Automations ("Infinitus", "we") handles personal data on this website and in the Infinitus Automations platform, available at https://app.infinitusautomations.tech. Contact: vjs.sreenivas@gmail.com, Kerala, India.

1. Our role

Infinitus provides software and managed automation to businesses such as gyms and real estate agencies ("business customers"). For messages exchanged between a business customer and its own customers or leads, the business customer decides why and how the data is used and we process it on its behalf. For our website visitors and our own business customers' account details, we decide and act as the controller.

2. Data we process

• Website visitors: if you contact us by email or WhatsApp, we receive your message and contact details. The website does not use advertising cookies.
• Business customer accounts: staff names, email addresses, roles, sign-in security data (hashed passwords, optional two-factor settings) and an audit log of important actions.
• End-customer and lead data entered by or received for our business customers: name, phone number, email, Instagram or Facebook identifiers, message content and timestamps, goals and preferences given in chat, trial bookings, membership and payment records, consent records (including wording and method), and notes added by staff.
• Platform data from Meta: messages, comments and related identifiers received through the WhatsApp Business Platform, Instagram and Facebook Pages APIs, for the accounts a business customer connects to us.

3. Why we use it

• To show conversations in a shared inbox, reply, send approved templates and automated replies, book trials and visits, send reminders and follow-ups, and report results to the business customer.
• To keep the service secure, prevent abuse, fix problems and meet legal obligations.
• To respond to enquiries made to us.

We do not sell personal data, and we do not use one business customer's data for another. We do not use Meta platform data for advertising or to build profiles for unrelated purposes.

4. Messaging and consent

Business customers are responsible for having a lawful basis to message their contacts. The platform records consent with its wording and method, does not treat imported or typed phone numbers as consent, applies WhatsApp's 24-hour reply window and approved-template rules, and stops messages when a person opts out.

5. Who we share data with

• Meta Platforms (WhatsApp, Instagram, Facebook), because messages are delivered through their services.
• Infrastructure providers that host the platform and website, for example our server and hosting providers.
• Authorities, where the law requires it.

Each business customer's data is separated from other business customers' data inside the platform.

6. Security

• Passwords are stored hashed; sessions use secure cookies; sign-in attempts are rate limited and optional two-factor sign-in is available.
• Meta access tokens are encrypted at rest and are not shown in the interface or logs.
• Access is controlled by roles and permissions, and is restricted to each business customer's own data. Important actions are written to an audit log.
• Incoming Meta webhooks are verified with signatures before they are accepted.

No system is perfectly secure, but we work to protect the data we hold.

7. Retention

• Raw webhook payloads are deleted after they are processed, and unroutable ones after 7 days. Imported CSV contents are deleted after import.
• Conversation, lead and booking records are kept while the business customer's account is active, so the business can serve its customers, unless they are erased as described below.
• Encrypted database backups are kept for a limited period and then replaced.
• Records we must keep for accounts or legal reasons may be kept longer, without unnecessary personal details.

8. Your rights

You can ask to access, correct, export or delete personal data we hold about you, and to stop receiving messages at any time (for example by replying to opt out). Because we usually process data for a business customer, we may refer your request to that business, and we will help them fulfil it. See how to request deletion.

9. International transfers

Our providers and Meta may process data in other countries. Where required, we rely on appropriate safeguards.

10. Children

Our services are for businesses and are not directed at children.

11. Changes

We will update this page when our practices change and revise the date above.

12. Contact

Privacy questions and requests: vjs.sreenivas@gmail.com.