Privacy Policy

Vizvox ("Vizvox", "we", "us", "our") operates the SaaS platform at https://vizvox.io that enables businesses ("Merchants") to receive AI-generated responses on their own WhatsApp Business Account.

Data Controller: Mahmood Nawaz, sole proprietor operating as Vizvox, based in Ismail Khel, District Bannu, Khyber Pakhtunkhwa, Pakistan.
Contact: mahmood@vizvox.io

This Privacy Policy describes how we collect, use, share, and protect information about (a) Merchants who subscribe to Vizvox and (b) the end customers of Merchants whose WhatsApp conversations pass through the Vizvox platform.

• Deliver the service: transcribe voice notes, extract intent, search Merchant inventory, generate replies, deliver via Meta WhatsApp Cloud API
• Merchant billing: process subscriptions via Lemon Squeezy (Merchant of Record)
• Quality assurance: monitor STT/LLM confidence signals; trigger human takeover when thresholds not met
• Fraud prevention and security: detect abuse, verify Meta webhook signatures, prevent unauthorized access
• Compounding voice corpus (optional, consent-gated): Merchants may opt in via TOS to allow anonymized voice-note storage for fine-tuning Vizvox's speech-recognition models (per BLUEPRINT §6.2). End customers may opt out per conversation.
• Legal compliance: respond to legal requests, maintain audit logs

• Merchants: contractual necessity (delivering the SaaS you subscribed to) + legitimate interest (fraud prevention, security)
• End customers of Merchants: processing occurs on behalf of the Merchant, who acts as Data Controller for their customer conversations. Vizvox acts as a Data Processor. The Merchant is responsible for obtaining lawful basis (typically WhatsApp opt-in) from their own customers.

• Merchant account data: retained while subscription is active + 90 days after cancellation (for reactivation), then deleted
• Voice-note audio: retained 30 days by default; longer if Merchant enables the fine-tuning corpus opt-in
• Message text + transcriptions: retained while subscription is active + 90 days after cancellation
• Customer consent logs: retained 7 years (legal protection for Merchants against Meta spam complaints)
• Audit logs: retained 7 years (compliance)
• Payment records: retained per Lemon Squeezy's policy + Pakistani tax law requirements (7 years)

We share data with the following sub-processors, each bound by data protection agreements:

We do not sell personal information to third parties. We do not use end-customer messages for advertising or profiling.

Vizvox is based in Pakistan. Data may be transferred to and processed in the United States (Vercel, Supabase, OpenAI, Lemon Squeezy), India (AWS Mumbai region), and other countries where our sub-processors operate. Where required, transfers rely on Standard Contractual Clauses or equivalent safeguards.

For Merchants operating in the UAE, transfers comply with the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021 — "PDPL").
For Merchants operating in the EU/UK (Phase 4+), transfers rely on GDPR-compliant safeguards.

Depending on your jurisdiction, you may have the following rights over your personal information:

• Access: request a copy of the personal data we hold about you
• Correction: ask us to correct inaccurate data
• Deletion: request deletion (subject to legal retention requirements)
• Portability: receive your data in a machine-readable format
• Objection: object to processing based on legitimate interest
• Withdraw consent: for consent-based processing (e.g., voice corpus opt-in)
• Complaint: lodge a complaint with your local supervisory authority (e.g., Pakistan PDPA regulator once formed, UAE Data Office, EU DPAs)

To exercise any right, email mahmood@vizvox.io with sufficient information to verify your identity. We aim to respond within 30 days.

• All data in transit is encrypted via TLS 1.2+
• Merchant Meta credentials (app secret, access token) are encrypted at rest with AES-256-GCM; the key is held only in server environment configuration, never in the database or source code
• Access to production systems is restricted to the founder and audited via Supabase audit logs
• Three-layer authorization defense: request-level session guard → server-side capability guards → Postgres row-level security on every table and on file storage (see BLUEPRINT §3.9, §8.5)
• Meta webhook signatures verified on every inbound request (X-Hub-Signature-256); rate limits on login and link exchange; per-merchant usage caps
• Security headers (HSTS, content-security-policy, frame denial) on every page; dependencies audited before each release

Despite these controls, no system is 100% secure. We will notify affected Merchants and, where required, regulators within 72 hours of discovering a breach.

Vizvox is a B2B SaaS product for businesses. We do not knowingly collect information from individuals under 18. If you believe a child's data has been collected, contact us for immediate deletion.

We may update this Privacy Policy from time to time. Material changes will be notified to Merchants by email at least 14 days before taking effect. The "Last updated" date at the top reflects the most recent revision.

Vizvox (sole proprietor: Mahmood Nawaz)
Email: mahmood@vizvox.io
Phone: +92 3035406862
Address: Ismail Khel, District Bannu, Khyber Pakhtunkhwa, Pakistan
Website: https://vizvox.io