Privacy Policy

1. Who we are & scope

This Privacy Policy is issued by CloudOWS (SMC) Private Limited (“CloudOWS”, “we”, “us”, “our”), Commercial Zone 1, Building II, 2nd Floor, Gujranwala, Punjab, Pakistan. It applies to:

• Website visitors of www.cloudows.com;
• Customers and their team members who sign up for and use the CloudOWS platform at app.cloudows.com (“Platform”);
• End customers — the people our Customers communicate with or keep records about using the Platform (for example a shopper who receives a WhatsApp order confirmation); and
• People who connect Meta accounts (Facebook, WhatsApp Business, Instagram, Messenger) to the Platform, including through Meta's Embedded Signup or Facebook Login for Business.

Our services include WhatsApp Automation, WhatsApp Inbox, Omnichannel Communication (Instagram, Messenger, web chat, email, SMS), E-commerce Automation (including COD confirmation), Customer CRM, Marketing Automation, AI Customer Support, AI Sales Assistant, Workflow Automation, Delivery & Logistics Automation, Appointment & Booking Automation, Payment & Invoice Automation, Business Analytics and Integrations & API (together, the “Services”). This policy covers all of them, including features released after the date above.

This policy should be read together with our Terms of Service.

2. Our role: controller or processor

3. Information we collect

3.1 Information you give us

• Enquiries & sign-up: name, mobile / WhatsApp number, email, business name, business type, team size, city, chosen plan or product, and messages you send through our forms.
• Account & business profile: names, email addresses, phone numbers and roles of the account owner and team members; business name, address, city, website and tax number (NTN); password (stored only as a one-way hash).
• Billing: plan, invoices, payment method chosen, transaction reference numbers, payment dates and receipt images or PDFs you upload. We do not collect or store card numbers or bank login details.
• Support: support tickets, replies, attachments (such as screenshots) and call or chat notes.
• Sign in with Google: if you choose “Continue with Google”, Google shares your name, email address, profile picture and a Google account ID with us. We use them only to create your account, sign you in and show your name — we do not access your Gmail, contacts, Drive or other Google data. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
• Sign in with Facebook: if you choose “Continue with Facebook”, Meta shares your name, email address, profile picture and an app-scoped Facebook user ID with us (the public_profile and email permissions only). We use them only to create your account, sign you in and show your name. We do not post to Facebook, read your friends, Pages or messages, or use this data for advertising. You can remove CloudOWS at any time in Facebook → Settings & privacy → Settings → Apps and websites; see our Data Deletion Instructions.
• Two-factor authentication: if you turn it on, we store an encrypted secret key and hashed one-time recovery codes. The codes are generated by the authenticator app on your phone; we never see your phone or its other data.
• Communications preferences, and any feedback or survey answers you give.

3.2 Data from platforms you connect

When a Customer connects a third-party account, we receive the data needed to run the connected feature:

• Meta (WhatsApp Business Platform, Messenger, Instagram): see section 4.
• E-commerce stores (for example Shopify or WooCommerce): store name and URL, products, orders, order status, order value, cash-on-delivery amount, and the end customer's name, phone number, email and delivery address.
• Courier and logistics partners (for example TCS, Leopards, PostEx and others): booking and tracking numbers, consignee name, phone and address, parcel status, COD collection and return status.
• Payment providers (for example JazzCash, Easypaisa, banks and payment-link providers): payment links, amounts, references and payment status. Card and wallet credentials are entered directly with the provider and are never received by us.
• Calendars, spreadsheets, email and SMS services, and other integrations or webhooks you enable through Integrations & API: only the data that integration is configured to send or receive.
• Access credentials for connected accounts (access tokens, API keys, webhook secrets). These are stored encrypted and used only to operate the connection.

3.3 Customer Data processed in the Platform

Contacts and their details (name, phone, email, address, tags, notes, custom fields), conversation history and media, opt-in and opt-out records, orders, deliveries, appointments, invoices and payment status, campaign and automation results, and anything else Customers or their end customers send through the Platform.

3.4 Information collected automatically

• Technical & log data: IP address, browser and device type, operating system, pages and features used, date and time of requests, referring page, and error logs.
• Security & audit records: sign-ins, important changes made in an account (who did what and when), and administrative actions by our staff, kept to protect accounts and investigate misuse.
• Marketing & ad attribution: the campaign that brought you to our website (for example UTM tags, the Facebook / Instagram or Google ad click ID, the page you landed on), saved with your enquiry or sign-up so we can tell which of our ads work.
• Cookies and similar technologies, including the Meta Pixel — see section 13.

4. Meta & WhatsApp data

CloudOWS is a technology provider for the Meta platforms. When a Customer connects WhatsApp Business, Messenger or Instagram (for example through Meta's Embedded Signup), we receive and process, with the Customer's authorisation:

• Business identifiers: Meta Business Manager / portfolio ID, WhatsApp Business Account (WABA) ID, phone number ID and display phone number, verified business name, Facebook Page and Instagram account IDs;
• The connecting person's name, Meta user ID and email address, where Meta provides them;
• Access tokens and the permissions granted (such as whatsapp_business_messaging and whatsapp_business_management);
• Message templates and their approval status, phone number quality rating and messaging limits;
• Messages, media, reactions and interactive replies sent and received through the connected accounts, together with sender and recipient phone numbers or IDs, profile names and delivery / read statuses delivered to us by Meta's webhooks;
• Conversation and pricing information needed to show usage and charges.

How we use and protect this data (“Platform Data”):

• We use it only to provide the Services to the Customer who connected the account: sending and receiving messages, running automations and inboxes, managing templates and showing reports.
• We do not sell, license or rent it; we do not use it for advertising, ad targeting, profiling or building audiences; and we do not share it with anyone except the sub-processors needed to run the Services (section 7) or where the law requires.
• We do not use it to train AI models (section 6).
• We comply with the Meta Platform Terms, Meta Developer Policies and the WhatsApp Business Solution Terms.
• When a Customer disconnects a Meta account, removes CloudOWS from their Meta Business settings or closes their CloudOWS account, we stop collecting new data and delete the access tokens. Platform Data is deleted as described in section 9 and in our Data Deletion Instructions.

Meta processes messages as part of its own service, under the WhatsApp Privacy Policy and Meta Privacy Policy. Messages exchanged with a business through the WhatsApp Business Platform are delivered to Meta's Cloud API and to CloudOWS on the business's behalf, so that the business and its authorised team can read and reply to them.

5. How we use information

We do not make decisions that produce legal or similarly significant effects about individuals based solely on automated processing.

6. AI features

AI Customer Support, AI Sales Assistant and other AI features use third-party large language model providers to draft or send replies, classify messages, summarise conversations and recommend products. When a Customer enables an AI feature:

• The relevant message content, conversation context and the Customer's knowledge sources (such as FAQs, product catalogue and policies) are sent to the AI provider only to generate the response;
• We use AI providers whose terms do not allow them to use this data to train their models, and we do not use Customer Data to train our own models without the Customer's written permission;
• AI output can be inaccurate. Customers control whether replies are sent automatically or reviewed by a person, and must tell their end customers when they are talking to an automated assistant where required.

7. Sharing & sub-processors

We do not sell personal data. We share it only as follows:

Sub-processors are bound by written obligations of confidentiality and security and may use the data only to provide their service to us. Customers may ask for the current list of sub-processors by writing to privacy@cloudows.com.

8. International transfers

We are based in Pakistan. Some providers (for example Meta, cloud and AI providers) process data in other countries. Where data is transferred internationally we rely on the provider's contractual and security commitments and take reasonable steps to make sure the data stays protected as described in this policy.

9. Data retention

Customers can delete individual records (for example contacts or conversations) at any time where the feature allows, or ask us to delete their data — see Data Deletion Instructions. We may keep data longer where the law requires it or to resolve disputes and enforce our agreements.

10. Security

• Encrypted connections (HTTPS/TLS) everywhere; access tokens and secrets encrypted at rest; passwords stored as one-way hashes.
• Strict separation of each Customer's data; role-based access for Customer team members and for our staff, who access Customer Data only when needed to provide support or keep the Platform secure.
• Payment receipts and attachments are stored privately and never published at public URLs.
• Audit logs, rate limits, regular backups and monitoring.
• Staff are bound by confidentiality.

No system is perfectly secure. If we become aware of a security incident affecting personal data, we will notify affected Customers without undue delay (and aim to do so within 72 hours) with the information they need, and cooperate with them and with authorities as required.

11. Your rights & choices

Subject to applicable law, you can ask us to:

• access the personal data we hold about you, or receive a copy (portability);
• correct inaccurate data — most account data can be edited in the Platform under My profile and Business settings;
• delete your data (see Data Deletion Instructions);
• object to or restrict certain processing, and withdraw consent where we rely on it;
• stop marketing — use the unsubscribe link, reply “STOP”, or contact us.

Email privacy@cloudows.com. We will verify your identity and reply within 30 days. You may also complain to the relevant authority in your country.

12. Customers of our customers

If you received a message from a business that uses CloudOWS, that business decides how your data is used and is responsible for having your consent to message you. To access, correct or delete your data, or to stop messages, please contact that business directly (on WhatsApp you can also block the business or reply “STOP”). If you contact us instead, we will pass your request to the business and help it respond.

Our Customers agree to: obtain the opt-ins required by WhatsApp and the law before messaging people; give their customers a privacy notice; honour opt-outs; and use the Platform only for lawful purposes.

13. Cookies & advertising

13.1 Meta Pixel and Conversions API

Our website uses the Meta Pixel, and our servers use Meta's Conversions API, to measure our own advertising. When you visit our website, Meta may receive the page you viewed, your IP address, browser information and its cookie identifiers. When you send an enquiry, sign up, start a trial, subscribe or pay an invoice with us, we send Meta an event (for example Lead, CompleteRegistration, StartTrial, Subscribe or Purchase, with the plan and amount) together with your email, phone number, name and city hashed (SHA-256) before they leave our servers, so Meta can match the event to an ad you saw without us sharing readable contact details.

• This applies only to people who visit our website or become our own leads and customers. We never send Meta Customer Data, end-customer data or any Platform Data received from WhatsApp, Messenger or Instagram for advertising (section 4), and the pixel never runs inside Customer workspaces.
• Meta uses this information under its own Privacy Policy and the Meta Business Tools Terms.
• Your choices: decline the cookie banner where we show one; block or delete cookies in your browser; manage ads in your Facebook / Instagram Ad preferences and turn off "Activity information from ad partners"; or email privacy@cloudows.com and we will stop sending your events to Meta.

You can block or delete cookies in your browser settings. Blocking essential cookies will stop sign-in from working.

14. Children

The Services are for businesses and are not directed to anyone under 18. We do not knowingly collect personal data from children for our own purposes. Customers must not use the Platform to target children in breach of the law or platform policies.

15. Changes to this policy

We may update this policy as our Services or the law change. The effective date at the top shows the latest version. If changes are significant, we will notify Customers by email or in the Platform before they take effect.

16. Contact

For privacy questions, requests or complaints, contact our privacy team at privacy@cloudows.com, or write to CloudOWS (SMC) Private Limited, Commercial Zone 1, Building II, 2nd Floor, Gujranwala, Punjab, Pakistan. Existing Customers can also open a ticket from Help & support in the Platform.