Privacy Policy

1. Two roles: your workspace data and your leads' data

• For workspace account data - the names, emails, and phone numbers of you and your staff who use Vaalo - Vertex Loop is the data fiduciary: we decide why and how that data is processed, as described in this policy.
• For your leads' and customers' data - the people your business captures and contacts through Vaalo - you (the tenant) are the data fiduciary and Vertex Loop is the data processor. We process that data only on your instructions, to run the CRM for you: capturing, storing, displaying, and acting on it through the features you configure.

2. What data Vaalo processes

• Account data: names, email addresses, phone numbers, roles, and login activity of workspace staff.
• Lead and customer data (yours, as fiduciary): names, phone numbers, email addresses, cities, enquiry details, conversation history (including WhatsApp and Instagram messages), call logs and recordings you enable, notes, and payment records you create or collect.
• Consent records: when and how consent was captured, its purpose and status, and any withdrawals - kept in an append-only consent ledger.
• Operational data: audit logs, security events, delivery logs for messages and webhooks, and usage counters needed to run and meter the service.

3. Tenant isolation

Vaalo is a multi-tenant platform with strict isolation between workspaces. Every record belongs to exactly one workspace; access is scoped by the signed-in user's workspace and enforced in the application and at the database layer with row-level security. One workspace can never see another workspace's data - requests for another workspace's records return "not found". Workspace data is never sold, and it is never shared across tenants, including for advertising or model training.

4. Consent, withdrawal, and data principal rights

Vaalo is built consent-first, in line with the DPDP Act. The platform maintains a tamper-evident, append-only consent ledger for every lead. If a person withdraws consent, Vaalo propagates that withdrawal across the workspace: the lead is marked do-not-contact, pending automated follow-ups and agent outreach stop, and agents check consent before any new outreach. Enrolment in marketing audiences is gated on consent, and identifiers are hashed before any audience sync.

Data principals can ask for access to their data, correction, or erasure. Vaalo provides data-principal-request workflows so tenants can receive, verify, and fulfil those requests and keep a record of the outcome. Whether a request is granted is the tenant's decision as fiduciary; we provide the tooling and the audit trail.

5. Breach handling

Vaalo keeps a breach register. When a personal-data breach is confirmed, the incident is recorded and tracked against the DPDP notification deadline of 72 hours, so the responsible parties can notify the Data Protection Board of India and affected data principals as the law requires. Security events across the platform are written to a chained, tamper-evident security log.

6. Sub-processors

We use a small set of sub-processors, each engaged only for the function named:

• Meta platforms - delivering Lead Ads, WhatsApp Business messaging, and Instagram messaging that you connect to your workspace;
• Google - Google Ads lead forms and Google Sheets connections you authorise, and cloud AI services used for agent features (see the AI Policy);
• Razorpay - payment processing for payments you collect from your customers through your own Razorpay account, and for Vaalo subscription payments;
• Cloud infrastructure providers - hosting, database, email delivery, and telephony/recording providers required to operate features you enable.

Sub-processors receive only the data needed for their function. Where a connection is yours (for example your WhatsApp number or your Razorpay account), the provider also processes data under its own terms with you.

7. Payments data

When your customers pay you through a Vaalo Salesform, the payment runs on your own Razorpay account. Card and bank details are handled by Razorpay; they never pass through or rest on Vaalo's servers. Vaalo stores only the payment record (amount, status, method, reference) against the lead so your team can reconcile it. Vertex Loop never holds your customers' funds.

8. Security measures

• Passwords are stored only as strong one-way hashes; login is rate-limited and accounts lock after repeated failures.
• API access uses short-lived access tokens with rotating refresh tokens; integration secrets and API keys are stored hashed or encrypted, and shown in full only once at creation.
• Access inside a workspace is role-based and checked on every request; a tamper-evident audit log records significant actions.
• Platform-level controls include a security event log, automated threat detection, an incident response process, and the ability to pause agents or integrations in an emergency.

9. Retention and deletion

Workspace data is retained while your workspace is active, so your team can work with its full history. When a workspace closes, its data is scheduled for deletion from production systems after a short recovery window, except records the law requires us to keep (such as consent history and financial records) and data already anonymised into aggregate statistics that cannot identify any person or workspace. Backups age out on their normal rotation.

10. Your choices and contact

If you are a workspace user, you can raise privacy questions or requests through your workspace admin or the in-product support desk. If you are a lead or customer of a business that uses Vaalo, please contact that business first - as fiduciary, it decides on requests about your data; we support it through the workflows described above. Data protection queries for Vertex Loop Pvt Ltd, Chennai, Tamil Nadu, India, can also be raised through the contact options on this website.