Privacy Policy

1. Introduction & Scope

ScaleOne is a CPaaS (Communications Platform as a Service) product developed and operated by iOnOne Technologies. Our platform enables businesses to send WhatsApp Business messages, SMS, emails, and other communications through a unified dashboard.

This Privacy Policy explains how we collect, use, store, and protect your information when you use ScaleOne. By registering an account and using our services, you agree to the practices described in this policy.

2. Information We Collect

2.1 Account Information

• Full Name – for account identification
• Email Address – for login, notifications, and communication
• Phone Number – for account verification and support
• Password – stored using industry-standard bcrypt hashing (one-way encryption, never stored in plain text)

2.2 Business Information

• Company name and contact details (if provided)
• WhatsApp Business API credentials (Phone Number ID, WABA ID, API tokens) – stored encrypted in our database
• SMS gateway credentials (API keys, sender IDs)
• Payment and billing information (processed via secure payment gateways; we do not store full card details)

2.3 Usage Data

• Login timestamps and session activity logs
• Message sending logs (campaign name, recipient count, delivery status)
• API usage and feature utilization metrics
• IP address and browser information (for security and fraud prevention)

3. Information Shared with Meta (WhatsApp)

When you use ScaleOne to send WhatsApp messages, the following data is transmitted to Meta's WhatsApp Business API:

• Recipient phone numbers – required to deliver messages
• Message content – the text, media, and template data you send
• Template messages – submitted to Meta for approval
• Business display name and profile – as configured in your WhatsApp Business Account
• Phone Number ID and WABA ID – identifiers for your WhatsApp Business account

This data sharing is essential for the functioning of WhatsApp Business messaging and is governed by Meta's own Privacy Policy and Business Terms of Service.

4. No Third-Party Sharing Guarantee

• We do not sell your data to any third party
• We do not share your contact lists with other ScaleOne users or external companies
• We do not use your data for advertising or marketing purposes beyond our own service communications
• We do not share your business information with competitors or data brokers
• We do not transfer your data to any entity except Meta (WhatsApp) as required for service delivery

The only exception is where required by law enforcement or legal proceedings, in which case we will comply with applicable Indian legal requirements.

5. Server & Data Security

• SSL/TLS Encryption – All data transmitted between your browser and our servers is encrypted using industry-standard SSL/TLS protocols
• Firewall Protection – Server-level firewalls restrict unauthorized access
• Encrypted Credential Storage – API tokens, passwords, and sensitive credentials are stored using encryption (bcrypt for passwords, AES-256 for API keys)
• Regular Security Updates – Server OS, PHP, and database software are kept up to date with security patches
• Database Security – MySQL database access is restricted to application-level connections only; remote access is disabled
• Session Security – Session tokens are generated using cryptographically secure methods and are protected against session fixation attacks
• Access Control – Admin access is restricted and authenticated; all admin actions are logged
• Regular Backups – Database backups are taken periodically and stored securely

Customers can trust that their data is protected on our secured infrastructure. We take security seriously and continuously monitor for potential threats.

6. Message Privacy & End-to-End Delivery

Here's how message privacy works on ScaleOne:

• No Human Reading: Our team does not read, review, or monitor any customer's message content. Messages flow through our system automatically without human intervention.
• Direct Delivery: Messages are sent directly from your account through the WhatsApp Business API to the end recipient. The delivery path is: Your Dashboard → ScaleOne API → WhatsApp Business API → Recipient.
• Automated Processing: Message routing, delivery status tracking, and billing are all handled by automated systems. No human reviews individual messages.
• No Content Filtering: We do not filter, block, or modify your message content (except where Meta's own policies require template approval).

7. Business Message Storage

The following message-related data is stored in our database:

• Message logs – Campaign name, recipient phone number, message type (template/session), delivery status, timestamp
• Template content – Approved WhatsApp message templates (name, body, language, category) as submitted by you
• Delivery receipts – Status updates (sent, delivered, read, failed) received from Meta webhooks
• Billing records – Message counts and charges for invoice generation and wallet deduction

What we store vs. what we don't:

• We DO store: Business messages (template messages, campaign messages) as they are essential for: delivery tracking, billing accuracy, campaign reports, dispute resolution, and compliance audit trails.
• We DO NOT store: The content of session/free-text messages beyond what is necessary for delivery confirmation. Once delivery status is confirmed, session message content is not retained long-term.
• We DO NOT read: Stored message data is accessed only by automated systems for the purposes listed above. No human reads your message content.

Message logs are retained for a period of 90 days for operational purposes, after which they are automatically purged. Template content is retained as long as your account is active.

8. Cookies & Session Management

ScaleOne uses essential cookies for:

• Session authentication – to keep you logged in securely
• Remember me functionality – if you choose to stay logged in (30-day token)
• Security – to prevent CSRF and session fixation attacks

We do not use tracking cookies, advertising cookies, or third-party analytics cookies. We do not track your browsing behavior across other websites.

9. Your Rights

As a ScaleOne user, you have the following rights regarding your data:

• Access: You can view your account information and message logs from your dashboard at any time
• Correction: You can update your profile information (name, email, phone) from your account settings
• Export: You can request an export of your account data by contacting support
• Deletion: You can request account deletion, which will remove your personal data from our system (message logs may be retained for 90 days for compliance purposes)
• Credential Management: You can update or revoke your WhatsApp Business API credentials at any time from your settings

10. Data Retention Policy

• Account data – Retained as long as your account is active. Deleted within 30 days of account deletion request.
• Message logs – Retained for 90 days, then automatically purged.
• Template content – Retained as long as account is active.
• Billing records – Retained for 7 years as per Indian tax compliance requirements.
• Activity logs – Retained for 180 days for security audit purposes.

11. Children's Privacy

ScaleOne is a business-to-business (B2B) platform. We do not knowingly collect information from children under 18 years of age. If you believe a minor has registered on our platform, please contact us immediately so we can remove their account.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or Meta's policies. We will notify all registered users via email of any significant changes. The updated policy will be effective immediately upon posting on this page.

We encourage you to review this page periodically to stay informed about how we protect your data.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your data, please contact us:

• Email: support@scaleone.org
• Website: www.ionone.in
• Phone: +91 89583 00509