Privacy Policy

Last updated: 24 October 2026

XOARO CRM is operated by MAVENNEXUS LABS PRIVATE LIMITED (CIN U62011KA2026PTC221134), a company incorporated in India with its registered office at 11th Floor, No. 32/2, 34/1, Kadabisanahalli, Gunjur, Bangalore North, Bangalore – 560087, Karnataka, India. This Privacy Policy explains how MAVENNEXUS LABS PRIVATE LIMITED (“XOARO”, “we”, “us”) collects, uses, discloses, and protects information when a business (a “Customer”) and its authorized users use our customer relationship management (CRM) platform, and when the Customer’s own contacts (“End Users”) communicate with the Customer through channels the platform supports, including WhatsApp.

Xoaro CRM is business-to-business software: our direct relationship is with the Customer organization that subscribes to the platform. Where this policy describes data about an End User (for example, a WhatsApp contact of a Customer), that data is collected and controlled by the Customer for its own business purposes, and Xoaro CRM processes it on the Customer’s behalf and instruction.

1. Information We Collect

We collect the following categories of information:

  • Account, company, and user information — when a Customer creates an account, we collect company details (name, contact information) and information about individual users (name, email address, phone number, role, and login credentials).
  • CRM/customer data — records a Customer creates or imports into the platform about its own contacts (names, phone numbers, email addresses, and other business-relevant details the Customer chooses to store), along with the sales, communication, and activity history the Customer’s users create while working those records.
  • Communications data — the content and metadata of messages sent and received through channels the platform supports on the Customer’s behalf, including WhatsApp messages, email, and call/activity logs a Customer’s users choose to record.
  • WhatsApp / Meta data — when a Customer connects a WhatsApp Business Account to the platform, we receive and store, for that Customer, the WhatsApp Business Account and phone number identifiers the Customer configures, message content and delivery/read status for messages sent and received through that connection, and the End User’s WhatsApp phone number and any information the End User sends in a message. We only receive WhatsApp data for Customers who have explicitly connected their own WhatsApp Business Account.
  • Integration data — when a Customer connects an optional third-party integration (for example, a calendar or a spreadsheet import source), we receive the data that integration is configured to share, described further in Section 3.
  • Technical and usage information — standard web-server request logs (such as IP address, timestamp, and requested path) generated as a normal part of operating the service.

2. How We Use Information

  • To provide, operate, and maintain the platform for Customers and their authorized users.
  • To send messages (including WhatsApp messages and emails) that a Customer’s user initiates or that a Customer has configured an automated workflow to send.
  • To authenticate users and enforce each Customer’s own access controls.
  • To maintain security, detect and prevent abuse, and troubleshoot technical issues.
  • To communicate with Customers about their account, including service and security notices.
  • To comply with legal obligations.

We do not sell personal information, and we do not use Customer or End User data to serve third-party advertising.

3. Integrations and Third-Party Services

Xoaro CRM supports optional integrations a Customer may choose to connect. Each integration only receives the data necessary for the feature it provides, and only for Customers who have actively connected it:

  • WhatsApp (Meta) — sending and receiving WhatsApp messages on a connected Customer’s behalf, as described in Section 1.
  • Calendar providers (e.g. Google Calendar, Microsoft Calendar) — syncing appointment/meeting data a Customer’s user schedules.
  • Spreadsheet import sources (e.g. Google Sheets) — importing contact records a Customer selects for import into their own CRM data.
  • Email delivery providers — sending transactional and business emails on a Customer’s behalf.
  • Payment processing — processing a Customer’s own subscription payment to Xoaro CRM (this does not apply to a Customer’s own End Users).

Each integration is governed by that provider’s own privacy policy and terms in addition to this one. Connecting an integration is always a Customer’s own choice; disconnecting it stops further data exchange with that provider going forward.

4. Cookies and Analytics

Xoaro CRM does not currently use cookies for authentication or tracking, and does not currently use third-party analytics or advertising tracking services. Signed-in sessions are maintained using your browser’s local storage, not cookies. If this changes in the future, this Privacy Policy will be updated accordingly before any such use begins.

5. Sharing and Disclosure

We share information only in the following circumstances:

  • With the third-party integrations described in Section 3, strictly to provide the connected feature a Customer has enabled.
  • With service providers who process data on our behalf (for example, hosting and infrastructure providers), under contractual confidentiality obligations.
  • Within a Customer’s own organization, according to the access controls that Customer’s administrators configure.
  • If required to comply with a legal obligation, enforce our terms, or protect the rights, safety, or property of Xoaro CRM, our Customers, or others.
  • In connection with a merger, acquisition, or sale of assets, subject to this policy continuing to apply to the transferred information.

We do not sell personal information to third parties.

6. Data Security

We apply industry-standard technical and organizational safeguards appropriate to the sensitivity of the data we hold, including encryption of sensitive credentials at rest, encrypted connections in transit, role-based access controls, and audit logging of significant account actions. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

7. Data Retention

We keep Customer and End User data for as long as the Customer’s account is active, because the Customer needs it to use the service.

  • When we receive a verified deletion request, or when a Customer closes its account, we delete or anonymise the data concerned within 90 days, unless a law requires us to keep it longer.
  • Records we must keep by law — for example invoices and payment records under Indian tax law — are kept only for the period that law requires, and only for that purpose.
  • Copies in our backups are overwritten in the normal backup cycle, which also completes within 90 days.

A Customer may request deletion of specific records or of its whole account at any time — see Section 8 and our Data Deletion page.

8. Deletion

Customers can delete specific CRM records they manage directly within the platform, subject to their own account permissions. For a full account or End User data-deletion request, email info@xoaro.com. The steps and timelines are on our Data Deletion page.

9. Your Rights

Depending on your location and applicable law, you may have rights to access, correct, export, or delete personal information we hold about you, and to object to or restrict certain processing. A Customer’s own end users should generally direct such requests to the Customer organization they interacted with, as that organization controls its own CRM data; the Customer may in turn work with Xoaro CRM as described on our Data Deletion page. Customer organizations and their authorized users may contact us directly using the details in Section 13.

10. Account Termination

A Customer may close their account at any time. Upon closure, access to the platform ends, and data is handled according to Section 7 (Data Retention) and Section 8 (Deletion) above. We may also suspend or terminate an account that violates our Terms of Service.

11. Children’s Information

Xoaro CRM is a business tool intended for use by adults acting on behalf of a Customer organization. We do not knowingly collect personal information directly from children.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will update the “Last updated” date at the top of this page when we do, and for material changes we will provide a more prominent notice where appropriate.

13. Contact Us

Questions about this Privacy Policy, or requests relating to your personal information, can be sent to info@xoaro.com.

MAVENNEXUS LABS PRIVATE LIMITED
CIN: U62011KA2026PTC221134
Registered office: 11th Floor, No. 32/2, 34/1, Kadabisanahalli, Gunjur, Bangalore North, Bangalore – 560087, Karnataka, India