Avyrro Privacy Policy

1. Introduction & Scope

Avyrro is developed and operated by Byte Stream ("we", "us", or "our"), based in Kolkata, West Bengal, India.

Avyrro is a business software platform designed to help commercial organizations and business users manage contacts, organize audience groups, segment customer lists, and communicate with their customers via the Meta WhatsApp Business Platform.

This Privacy Policy explains how Byte Stream collects, uses, processes, stores, and protects information in connection with Avyrro, its web interfaces, campaign management tools, WhatsApp integration endpoints, and associated software services. For general corporate website browsing and software engineering consulting engagements with Byte Stream, please refer to our general Corporate Privacy Policy.

2. Information We Collect

Avyrro collects and processes information necessary to provide, maintain, and secure our contact management and messaging services. We categorize collected information as follows:

A. Account & Administrative Information

When a business or authorized representative registers for an Avyrro account or manages administrative settings, we may collect:

• User Details: Full name, professional job title, and business role.
• Organization Details: Business name, company website, registered jurisdiction, and business address.
• Contact Details: Corporate email address, business phone number, and billing contact information where applicable.
• Account Identifiers: Secure login credentials, user identifiers, and administrative configuration settings.

B. Contact Information Uploaded or Synchronized by Customers

Avyrro enables business customers to upload, import, or synchronize contact records into their private account workspace. Such information may include:

• Contact names and display identifiers.
• Phone numbers formatted for WhatsApp communication.
• Important dates intentionally recorded by the business (such as birthday or anniversary dates).
• Custom tags, categories, audience groups, and customer attributes intentionally designated by the business.
• Business-related contact notes or custom fields provided directly by the customer.

Customer Responsibility Notice: Businesses using Avyrro act as the independent data controllers for all contact data they upload, import, or synchronize. Customers are solely responsible for ensuring they possess the necessary legal basis, valid consent, and regulatory authority under applicable privacy and telecommunications laws to store and message their contacts.

C. Meta & WhatsApp Business Platform Data

When a customer authorizes and connects their Meta WhatsApp Business Platform assets to Avyrro, Avyrro receives and processes data made available through authorized Meta APIs and webhooks, where applicable, including:

• Account Identifiers: WhatsApp Business Account (WABA) ID, Meta Business Manager ID, and Phone Number ID.
• Phone & Profile Metadata: Display phone number, verified business display name, messaging tier limits, and quality rating status where provided by Meta.
• Message Templates: Submitted template structures, template names, languages, categories, variable components, and Meta review/approval statuses.
• Messaging Event Webhooks: Webhook telemetry dispatched by Meta where provided, including message delivery status (sent, delivered, read, failed), timestamps, error codes, and message identifiers.

Avyrro processes only the Meta platform data that customers authorize through official Meta API permissions and webhooks as necessary to provide requested functionality.

D. Message & Communication Data

Where necessary to provide campaign dispatching, inbox management, and customer communication functionality, Avyrro may process:

• Outbound broadcast message payloads, template parameters, dynamic variable substitutions, and dispatch logs.
• Inbound message content and replies sent by end-users to the customer's connected WhatsApp Business number, displayed within the customer's Avyrro inbox.
• Communication metadata, including message timestamps, conversation categories, delivery receipts, and routing tags.

E. Campaign Data & Analytics

Information generated during campaign creation and execution, including campaign names, audience selection filters, scheduled dispatch dates/times, template associations, credit/usage consumption logs, and aggregate performance metrics (such as total dispatched, delivered, read, and failure statistics).

F. Technical & Diagnostic Telemetry

When users access Avyrro, technical telemetry may be recorded as appropriate to maintain system integrity:

• IP addresses and approximate geographical region based on IP.
• Browser type, operating system, and device information.
• Session tokens, authentication timestamps, and security logs.
• Application performance metrics and system error traces.

3. How Information Is Used

Byte Stream uses data processed through Avyrro for legitimate business, operational, and software service purposes, including:

• Delivering Platform Functionality: Operating the Avyrro web application, user interface, campaign scheduler, and shared communication inbox.
• WhatsApp Integration: Facilitating the secure connection between the customer's Meta WhatsApp Business Account and the Avyrro platform.
• Audience & Contact Management: Organizing contacts, managing custom tags, building audience segments, and managing opt-in/opt-out preferences.
• Campaign Execution: Formatting, queuing, dispatching, and tracking authorized WhatsApp broadcast campaigns through Meta APIs.
• Two-Way Communication: Receiving, displaying, and managing inbound customer replies in the shared inbox interface.
• Webhook & Delivery Processing: Ingesting real-time Meta webhooks to display message status receipts (sent, delivered, read, failed).
• Usage & Credit Tracking: Monitoring platform resource utilization, messaging volume, credit balance consumption, and subscription quotas.
• AI-Assisted Features: Facilitating optional, user-initiated AI drafting, template suggestions, or content formatting tools when explicitly invoked by the user.
• Authentication & Security: Verifying authorized user credentials, managing user sessions, and enforcing appropriate access controls.
• System Reliability & Diagnostics: Investigating errors, debugging technical anomalies, analyzing system performance, and providing customer support.
• Fraud & Abuse Prevention: Detecting and mitigating spam, unauthorized API access, brute-force attempts, and platform policy violations.
• Compliance & Legal Governance: Adhering to statutory, accounting, tax, regulatory, and legal dispute resolution requirements.

4. Meta & WhatsApp Business Platform Integration

Avyrro integrates directly with Meta's WhatsApp Business Platform via official Meta APIs and Webhook infrastructure to provide business messaging capabilities.

• Customer Authorization: When a business connects its WhatsApp Business Account to Avyrro through Meta's authorized onboarding mechanisms, including Embedded Signup where applicable, Avyrro receives the identifiers, permissions, and credentials necessary to provide the requested WhatsApp Business functionality. Customers retain administrative control over their Meta assets.
• Scope of Access: Avyrro requests and utilizes only the specific API permissions and access scopes necessary to manage templates, send approved broadcast messages, display inbound replies, and process webhook status updates.
• Governing Terms: Customer use of WhatsApp Business Platform features is governed by Meta's applicable contractual terms, including the WhatsApp Business Terms of Service, WhatsApp Business Policy, and the Meta Privacy Policy.
• Platform Independence: Avyrro is an independent SaaS platform developed and operated by Byte Stream. Avyrro integrates with Meta's WhatsApp Business Platform. Avyrro and Byte Stream are not owned by, endorsed by, or affiliated with Meta Platforms, Inc.

5. Contact Synchronization & Customer Responsibilities

Avyrro allows customers to upload, import (such as via CSV/spreadsheet files), or synchronize contact directories into their Avyrro workspace to enable audience segmentation and WhatsApp communication.

Role of Avyrro: Avyrro processes contact information on behalf of the customer as a data processor / service provider to fulfill the customer's instructions.

Customer Compliance Obligation: The customer remains the data controller for all contact records and is solely responsible for:

• Ensuring lawful authority, legitimate interest, or explicit opt-in consent to upload contact details, store records, and send WhatsApp communications.
• Respecting end-user opt-out requests, stop keywords, and unsubscribe preferences.
• Complying with applicable telecommunications laws, electronic marketing rules, anti-spam legislation, and WhatsApp messaging policies.

6. Data Sharing & Third-Party Service Providers

Avyrro does not sell personal information or customer contact data as part of its business model.

To deliver the Avyrro service, we share data only with third-party service providers and subprocessors where necessary to operate the platform:

• Meta Platforms, Inc. / WhatsApp: Message payloads, template definitions, and recipient phone numbers are transmitted to Meta's WhatsApp Business Platform infrastructure to execute message delivery. WhatsApp messaging fees may be billed directly by Meta to the customer's Meta payment account.
• Cloud & Managed Infrastructure Providers: Cloud hosting, database, and infrastructure providers used to host application services, databases, and message queues under appropriate security controls.
• Authentication & Security Services: Services utilized for secure user authentication, credential validation, and session management.
• Payment Processors: Payment gateways utilized to process Avyrro subscription plans when paid software tiers are activated.
• AI Service Providers: Third-party artificial intelligence providers, engaged strictly when an authorized user explicitly invokes an optional AI-assisted feature.

We may also disclose information where required by law, subpoena, regulatory inquiry, court order, or to protect the vital security and legal rights of Byte Stream, our customers, or the public.

7. AI-Assisted Features & Data Handling

Certain Avyrro features may provide AI-assisted functionality. AI processing occurs only when a customer chooses to use an applicable AI-assisted feature.

When such a feature is used, information necessary to perform the requested operation may be transmitted to an AI service provider.

Avyrro intends to use AI service providers and configurations appropriate for business use and data protection. Avyrro does not intentionally use customer contact or messaging data to train its own public artificial-intelligence models.

Where an AI-assisted feature requires customer data (such as optimizing contact attributes, templates, or draft campaign messages) to perform the requested operation, Avyrro will process or transmit only the information reasonably necessary for that operation.

AI-related data handling may vary depending on the feature and service provider used.

8. Data Retention Policies

Byte Stream retains information for as long as reasonably necessary to provide the service, maintain the applicable account, comply with legal obligations, resolve disputes, enforce agreements, and maintain security.

• Active Accounts: Contact lists, template configurations, campaign logs, and message histories are retained while the customer's account remains active to enable continuous platform access.
• Account Closure & Deletion: When an account is terminated or a formal deletion request is processed, associated active data is purged or permanently anonymized in accordance with our deletion procedures.
• Legal & Operational Exceptions: Certain telemetry, billing records, and audit logs may be retained for longer periods where required by statutory tax obligations, legal compliance, dispute resolution, or system backup lifecycles.

9. Data Security Safeguards

We use appropriate technical and organizational safeguards designed to protect information handled by Avyrro against unauthorized access, loss, misuse, or alteration:

• Encryption in Transit: Transport Layer Security (TLS 1.3 / TLS 1.2) is used for data in transit between users, the Avyrro platform, and external APIs.
• Credential Protection: Sensitive credentials and authentication information are protected using appropriate security controls, and encryption is used where supported and appropriate.
• Access Control: Administrative and operational access to production systems and data is restricted to authorized personnel and protected using appropriate authentication, authorization, and access-control mechanisms.
• Infrastructure Safeguards: Avyrro uses cloud infrastructure and managed service providers to host and operate the platform. Access to production systems and data is restricted using appropriate authentication, authorization, and infrastructure security controls.

Note: While we maintain reasonable and appropriate security safeguards, no electronic transmission over the internet or computer storage technology can be guaranteed to be completely secure or impenetrable. We encourage all users to maintain strong passwords and safeguard their account credentials.

10. Data Deletion & Account Erasure

Avyrro provides a clear procedure for business customers to request the deletion or erasure of their Avyrro-controlled account records, contact lists, audience tags, campaign history, and WhatsApp integration information.

For detailed step-by-step instructions on how to request data deletion, please review our dedicated instruction page:

11. Your Privacy Rights & Choices

Depending on your geographic jurisdiction and applicable data protection legislation (such as India's Digital Personal Data Protection Act, GDPR, or equivalent regulations), you and your authorized representatives may have rights regarding your personal information, including:

• Right of Access: Request confirmation of whether we process your personal data and obtain a copy of such data.
• Right to Rectification: Request correction of inaccurate, outdated, or incomplete personal data.
• Right to Erasure: Request the deletion or removal of personal data where no compelling legal reason for continued processing exists.
• Right to Restrict or Object: Object to or request restriction of certain processing activities under specific conditions.
• Right to Withdraw Consent: Withdraw previously granted consent for processing, subject to contractual and legal limitations.

To exercise any of these rights, please contact our data governance team at anup@bytestream.co.in.

12. Children's Privacy

Avyrro is strictly a business-to-business (B2B) communications platform designed for commercial organizations and professional enterprise use. The platform is not intended for, marketed to, or designed for use by children. We do not knowingly collect or solicit personal data from individuals who do not meet the minimum age requirements under applicable laws.

13. International Data Processing & Transfers

Byte Stream operates from India. In delivering the Avyrro platform, data may be processed, stored, or transmitted through cloud hosting infrastructure and Meta API endpoints located in various international regions. Where cross-border data transfers occur, we implement appropriate contractual and technical safeguards to ensure data protection standards consistent with this Privacy Policy.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our platform functionality, Meta API requirements, operational practices, or applicable laws. When changes are published, the "Last Updated" date at the top of this document will be revised. We encourage users to periodically review this page to remain informed of our privacy governance practices.

15. Contact & Privacy Governance

For inquiries, compliance questions, or data protection requests concerning Avyrro or this Privacy Policy, please reach out to our team: