Privacy Policy

This Privacy Policy outlines how Universal-Social-CRM ("we", "our", or "us") collects, uses, processes, and safeguards personal data when you use our platform, APIs, social integrations, and services.

We are committed to maintaining high standards of data security and transparency in compliance with global data protection laws, including the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and the developer policies of Meta Platforms, Inc. and Google LLC.

1. Information We Collect

We collect information in three main categories to provide our omnichannel CRM and compliance services:

A. Account & Staff Information

• Registration Information: Full name, username, business email address, and encrypted credentials.
• Authentication Data: Multi-Factor Authentication (MFA) TOTP secrets, session cookies, and login audit trails.
• Google OAuth Data: When signing in via Google, we collect your Google user ID, name, email address, and avatar image as permitted by your Google account consent.

B. Know Your Customer (KYC) Verification Data

To prevent fraud and enforce strict staff accountability on sensitive communication channels, we collect verification materials from platform operators:

• Government-issued identification cards or passports.
• Facial verification selfies and liveness capture photos.
• Proof of address or authorized organizational affiliation documents.
• Reviewer audit logs (approval, rejection, or resubmission timestamps).

C. Social Platform & Messaging Data

When you connect third-party communication channels (such as Meta Facebook Pages, WhatsApp Business Accounts, Instagram Direct, X, or TikTok), our systems receive data transmitted via authorized APIs and webhooks:

• Contact Profiles: Social user IDs, platform usernames/handles, phone numbers (for WhatsApp), and profile pictures.
• Message Content: Inbound and outbound message text, delivery timestamps, read receipts, and status updates.
• Media & Attachments: Images, audio notes, video clips, and document attachments sent or received in conversations.
• Channel Metadata: Page IDs, WhatsApp Business Account (WABA) IDs, phone number IDs, and app-scoped user IDs (ASUID).

2. How We Use Your Information

We process personal data strictly for legitimate operational purposes:

• To provide, operate, and maintain the multi-channel CRM workspace.
• To synchronize and route messages between your agents and your customers across Meta, WhatsApp, Instagram, and other social channels.
• To verify staff identity through mandatory KYC procedures before granting access to customer communications.
• To provide AI-assisted summarization, intent detection, and automated routing rules when activated by your administrator.
• To maintain security audit trails and investigate fraudulent or unauthorized activities.

3. Third-Party Integrations & Sub-Processors

We integrate with trusted third-party providers to deliver our services. We only share information with these parties as necessary:

• Meta Platforms, Inc. (Facebook, Instagram, WhatsApp): We use official Meta Graph APIs and WhatsApp Cloud APIs to send and receive customer communications. Data exchanged complies with Meta's Developer Platform Terms.
• 360dialog: We interface with 360dialog as an authorized WhatsApp Business Solution Provider (BSP) for message routing and phone number onboarding.
• Google LLC: Used strictly for OAuth authentication services.
• Infrastructure & Storage Providers: Encrypted databases and secure cloud servers hosting our application instances.

4. Data Storage, Security & Encryption

We implement stringent technical and organizational measures to safeguard your information:

• Encryption in Transit: All data transmitted between clients, servers, and external APIs is encrypted using Transport Layer Security (TLS 1.2 / TLS 1.3).
• Encrypted Storage: Sensitive KYC identification files and API tokens are encrypted at rest using industry-standard AES-256 encryption.
• Access Controls: Role-based access control (RBAC) ensures only verified administrators and supervisors can inspect KYC records or audit logs.

5. Data Retention

We retain your information only as long as necessary to fulfill the purposes set out in this policy:

• Account Data: Retained while your workspace account remains active.
• KYC Documents: Retained during the active period of employment or contract, and securely archived or deleted in accordance with legal compliance obligations.
• Customer Messages: Retained in accordance with your organization's configured data retention schedule or until a deletion request is initiated.

6. Your Rights & Data Deletion (GDPR & CCPA)

Depending on your jurisdiction, you have specific rights regarding your personal data:

• Right to Access: You can request a copy of the personal data we hold about you.
• Right to Rectification: You can request that inaccurate or incomplete data be corrected.
• Right to Erasure ("Right to be Forgotten"): You can request the deletion of your account and associated personal data.
• User Data Deletion Instructions: To view instructions on how to request the deletion of your data or revoke Meta/social platform access, visit our User Data Deletion Instructions.

7. Contact & Data Protection Officer

For any inquiries regarding this Privacy Policy, your personal data, or to exercise your privacy rights, please contact our Data Protection Office:

• Email: [email protected]
• Support Desk: [email protected]
• Data Protection Inquiries: Submit Deletion / Privacy Request