Privacy Policy

1. Who we are

InvigoSol ("InvigoSol", "we", "us") is a technology company that builds AI, software and messaging solutions for businesses and operates its own software products, including BizAgent. For the personal data described in this policy, InvigoSol is the data controller unless section 2 says otherwise.

InvigoSol
Email: hello@invigosol.com
Website: www.invigosol.com

2. Scope of this policy

This policy covers:

this website, www.invigosol.com, and enquiries you send us;
apps and integrations we operate as a Meta Tech Provider, which use the WhatsApp Business Platform (Cloud API), Embedded Signup and Facebook Login for Business;
personal data we handle when we deliver services to our business clients.

BizAgent has its own, more detailed privacy policy at bizagent.pk/privacy, which applies to anyone who uses BizAgent. Both policies are issued by InvigoSol.

When we build or run systems for a client, the client usually decides why and how its customers' data is processed. In that case the client is the controller and InvigoSol acts as its processor (service provider), following the client's written instructions and our agreement with them.

3. Website and enquiries

Contact form and email. Your name, work email, company, phone number (optional), the service you are interested in and your message. We use it only to answer you and, if you become a client, to manage the relationship.
Technical data. Our hosting provider records standard server logs (IP address, browser type, pages requested, time) to keep the site secure and working. Fonts are loaded from Google Fonts, which receives your IP address when a page loads.
Cookies. This website does not use advertising or tracking cookies and does not run third-party analytics.

4. Data we receive from Meta

Some of our apps let a business connect its WhatsApp Business Account and Meta business portfolio. When you connect one of these apps, you sign in with Facebook Login for Business and choose what to share. Depending on the app and the permissions you grant, we receive:

Facebook Login for Business

your name, email address and app-scoped Facebook user ID;
the business portfolio (Business Manager account) you select and its ID.

WhatsApp Business Platform (Cloud API) and Embedded Signup

WhatsApp Business Account (WABA) ID, phone number ID, display name, verified name and business profile;
the content of messages and media sent to and from the connected business number, the sender's and recipient's WhatsApp phone number and profile name, and timestamps;
message status updates (sent, delivered, read, failed) delivered to us by webhook;
message templates and their approval status, phone number quality rating and messaging limits;
access tokens (business integration system user tokens) that let the app act for your business.

Permissions we request and why

Permission	Why we need it
`whatsapp_business_messaging`	Receive messages on the connected business number and send the replies and templates the business approves.
`whatsapp_business_management`	Read the WhatsApp Business Account, phone numbers and templates, and subscribe the app to message webhooks.
`business_management`	See the business portfolio you choose during Embedded Signup so the correct WhatsApp Business Account is connected.
`public_profile`	Identify the person who connected the account (name and app-scoped user ID).
`email`	Create the account and send service and security notices to the person who connected it.

We request only the permissions an app needs for features the business has asked for. We use data received from Meta ("Platform Data") in line with the Meta Platform Terms, the Meta Developer Policies and the WhatsApp Business Messaging and Business Policies.

5. How we use data

to provide, secure and support the services and apps you or your business asked for;
to answer enquiries and manage client relationships;
to send service, billing and security messages;
to detect abuse, fraud and security incidents;
to meet legal, tax and accounting obligations.

Where data protection law requires a legal basis, we rely on performing a contract with you or your business, our legitimate interest in running and securing our services, your consent where we ask for it, and legal obligations.

6. What we never do

We do not sell personal data or Platform Data.
We do not use Platform Data or message content for advertising, ad targeting or building marketing profiles.
We do not use Platform Data to make decisions about eligibility for credit, employment, housing or insurance.
We do not share Platform Data with data brokers or use it to train general-purpose AI models.
We do not send WhatsApp messages on a business's behalf without that business's instruction or approval.

We share personal data only as needed to run our services, with:

Meta Platforms, which provides the WhatsApp Business Platform and Facebook Login;
cloud hosting and infrastructure providers that store and process data for us;
AI model providers, where an app uses AI features, under terms that do not allow them to train on the data;
email and form providers (such as Formspree for the contact form) that deliver messages to us;
professional advisers and authorities where the law requires it or to protect our legal rights.

Each provider is bound by a contract that limits its use of the data to providing its service to us. If InvigoSol is involved in a merger or acquisition, data may be transferred under this policy, and we will tell you first.

8. International transfers

Our providers may process data in countries other than yours. When we transfer personal data internationally, we use providers that offer appropriate safeguards, such as standard contractual clauses, and protect the data as this policy describes.

9. How long we keep data

Enquiries: up to 24 months after our last contact, unless you become a client.
Platform Data and app data: while the business account is active. When an app is disconnected or the account is closed, we delete it within 30 days, except where we must keep limited records by law.
Access tokens: deleted as soon as the connection is removed.
Billing and contract records: as long as tax and accounting law requires.

10. Security

We encrypt data in transit (TLS) and encrypt access tokens and secrets at rest. Access to production data is limited to staff who need it, protected by multi-factor authentication and logged. We keep data from different businesses separate, and we will notify affected customers and authorities of a personal data breach as the law requires.

11. Deleting your data

You can ask us to delete your data at any time. Step-by-step instructions, including how to remove our apps from your Facebook account, are on our data deletion page. For BizAgent, see bizagent.pk/data-deletion.

12. Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict its processing, and to withdraw consent. To use these rights, email hello@invigosol.com. We reply within 30 days. If your data was shared with us by a business that uses our services, we will pass your request to that business and help it respond. You may also complain to your local data protection authority.

13. Children

Our website, services and apps are for businesses and are not directed at anyone under 18.

14. Changes

We may update this policy. The date at the top shows the latest version. If a change materially affects how we use your data, we will tell affected customers by email or in the app before it takes effect.

15. Contact

For any privacy question or request, contact: