WBM
Privacy
Last updated: November 4, 2025

Privacy Policy

This Privacy Policy explains how WBM by Gravbox collects, uses, and protects your information. By using the Service, you agree to this Policy.

Data minimization
We collect only what we need to run the Service.
Security first
Administrative and technical safeguards are in place.
You control your data
Access, update, or request deletion anytime.

1) Overview

WBM ("Service") is provided by Gravbox ("we", "us", "our"). This Policy describes what we collect, why we collect it, and how we handle it.

2) Data We Collect

  • Account data: business name, contact details, team members, and authentication data.
  • WhatsApp data: messages, media, metadata, templates, contacts, tags, and attributes you manage within the Service.
  • Usage data: logs of actions, device information, approximate location from IP, timestamps, and diagnostics.
  • Billing data: plan, invoices, payment status, and relevant tax details.
  • Support data: conversations with our team, attachments, and issue descriptions.

3) How We Use Data

  • Provide and operate the Service, including shared inbox, automation, broadcasts, and API.
  • Authenticate users, secure accounts, detect abuse, and enforce policies.
  • Improve reliability, performance, and user experience.
  • Communicate with you about updates, billing, and support.
  • Comply with legal obligations and protect our rights.

4) Legal Bases

  • Contract: processing necessary to provide the Service you requested.
  • Legitimate interests: security, product improvement, and service analytics balanced with your rights.
  • Consent: where required, e.g., certain marketing communications or optional cookies.
  • Legal obligation: record keeping and compliance with applicable laws.

5) Sharing & Disclosure

  • Vendors: infrastructure, storage, analytics, and support tools under contracts that protect your data.
  • WhatsApp/Meta: when you connect your Business number and send/receive messages through the official APIs.
  • Legal: as required by law, court order, or to protect users, the public, or our rights.
  • Business transfers: in the event of a merger, acquisition, or asset sale, with appropriate safeguards.

6) Retention

  • Message history and media are retained within your plan’s storage and retention settings.
  • Administrative records may be retained for longer where required by law or to resolve disputes.
  • You may request deletion of data subject to legal and operational limits.

7) Security

  • We implement administrative and technical safeguards to protect data.
  • No system is perfectly secure; maintain good security on your devices, users, and API credentials.

8) International Transfers

  • Your data may be processed in regions where our vendors or infrastructure are located.
  • Where required, we use standard contractual clauses or similar safeguards.

9) Your Rights

  • Access: request a copy of your personal data.
  • Correction: update inaccurate or incomplete data.
  • Deletion: request deletion where applicable.
  • Restriction/objection: limit or object to certain processing.
  • Portability: request data in a portable format where feasible.
  • Consent withdrawal: where processing relies on consent.
  • To exercise rights, contact support@gravbox.com.

10) WhatsApp-Specific Notes

  • The Service works only with the official WhatsApp Business Platform.
  • Message delivery, template approvals, quality ratings, and number status are controlled by Meta.
  • Ensure you have opt-in consent for broadcasts and follow WhatsApp policies.

11) Cookies & Tracking

  • Necessary: required for login and core functionality.
  • Functional/analytics: help us understand usage and improve the Service.
  • Where required, we will request consent for optional cookies.
  • Browser settings may allow you to block or delete cookies; some features may not work without them.

12) Children’s Privacy

The Service is intended for business use and is not directed to children. Do not use the Service if you are not legally able to enter into contracts.

13) Processor vs Controller

  • For WhatsApp messages and related content you send or receive, you are generally the controller and we act as a processor.
  • For account administration, billing, and Service security, we act as a controller.

14) Third-Party Services

The Service may link to third-party sites or services. Their privacy practices are governed by their own policies.

15) Changes to this Policy

We may update this Policy to reflect operational, legal, or regulatory changes. If changes are material, we may notify you in-app or by email. Continued use after the effective date means you accept the changes.

16) Contact

Questions or requests can be sent to support@gravbox.com.