Privacy Policy

This Privacy Policy explains how ArQonnect (operating the ArQonnect service, "ArQonnect", "we", "us") collects, uses, shares and protects personal information of (a) business customers who subscribe to ArQonnect and (b) end-users who interact with our customers' WhatsApp, Instagram and Messenger accounts via ArQonnect.

It applies to https://arqonnect.io, all subdomains (including https://app.arqonnect.io and https://api.arqonnect.io), our APIs, webhooks, and any messaging service we provide on behalf of a customer business.

1. Who we are

• Legal entity: ArQonnect (operating from Lahore, Pakistan)
• Country of operation: Pakistan
• Registered address: 4A, R Block Johar Town, Lahore, Pakistan
• Website: https://arqonnect.io
• App: https://app.arqonnect.io
• API: https://api.arqonnect.io
• Demo & sales: demo@arqonnect.io
• Product support: support@arqonnect.io
• General contact: info@arqonnect.io
• Privacy / compliance: Compliance@arqonnect.io

2. Data we collect

2.1 From business customers (account holders)

• Account data: name, work email, organization name, job title, phone number (optional).
• Authentication data: handled by our authentication provider. We store only the resulting user ID and email; passwords are never sent to our servers.
• Billing data: handled by Paddle (our PCI-DSS-compliant Merchant of Record). We store limited metadata such as the last 4 digits of the card (if provided), the billing country, and the subscription status only. Full card numbers are not stored on ArQonnect servers.
• Usage data: login timestamps, dashboard pages visited, features toggled, conversation volume, AI token spend.
• Integration credentials: Channel-provider API keys and Meta Business credentials you paste into the dashboard. These are encrypted at rest with AES-256-GCM and decrypted only at the moment of an outbound API call.
• Knowledge-base content: documents, FAQs and policies you upload to ground your AI agent.

2.2 From end-users (your customers' customers)

• Conversation data: the messages, media (images, voice notes, documents) and metadata exchanged on WhatsApp / Instagram / Messenger between an end-user and the business they contacted.
• Messaging account data: phone number (E.164), display name and channel-specific user ID.
• Technical data: IP address of the channel webhook callback, provider message IDs, timestamps.

2.3 From visitors to our website

Functional cookies for sign-in and theme preference. Where enabled in production, optional website analytics may load for aggregated traffic measurement. See our Cookie Policy for current categories and how to opt out.

3. Why we collect it (purpose & legal basis)

For each category we identify a purpose and the GDPR Art. 6 legal basis we rely on.

4. How we use Meta Platform data

This section governs all data we obtain from the Meta APIs (WhatsApp Business API, Instagram Messaging API, Messenger Platform).

ArQonnect uses data obtained from Meta platforms solely to provide the services described in our Terms. We do not use Meta Platform Data to:

• train consumer AI models;
• serve advertisements;
• build user profiles for advertising;
• share with third parties for marketing purposes.

Meta Platform Data is used only to: (1) route messages between businesses and their customers, (2) power customer-authorized AI-assisted replies grounded in that business's knowledge base, (3) provide conversation analytics to the business account holder, and (4) enable human-agent handoff when the AI cannot resolve a query or escalation is requested. The WhatsApp customer-care 24-hour messaging window is WhatsApp-specific; Instagram and Messenger follow their own entry points and messaging windows. Data obtained from Meta APIs is not combined with data from other sources for advertising or profiling purposes. Meta is an independent platform provider, not an ArQonnect sub-processor.

5. AI disclosure

ArQonnect provides AI-powered messaging agents that interact with end-users on behalf of businesses. These agents use large-language-model (LLM) inference and retrieval-augmented generation (RAG) over customer-provided FAQs and documents. End-users may therefore be communicating with an AI rather than a human representative. Where EU AI Act transparency rules apply (and as a product default), the first AI reply in a conversation includes a clear notice that the assistant is automated, unless the AI nature is already obvious from the channel context. Human support agents are available and will take over when the AI cannot resolve a query or when escalation is requested. See /legal/ai-transparency for limitations and data handling. ArQonnect does not offer voice cloning of real people or deceptive impersonation tools.

6. Data retention

We tie every retention period to a specific purpose, in line with GDPR Art. 5(1)(e) (storage limitation). When the purpose ends or the limit is reached, data is deleted.

• Account data: retained for the duration of your active subscription. Deleted within 30 days of account closure, cancellation, or a verified deletion request — whichever comes first.
• Conversation data: retained for the duration of your active subscription so the AI agent has the context it needs to reply. Upon account closure or cancellation, all conversation data is permanently deleted within 30 days. You can request earlier deletion at any time by emailing Compliance@arqonnect.io. Inactive conversations within an active account may be moved to cold storage after 90 days of no activity.
• Platform logs (technical): up to 90 days, then deleted.
• Backups: encrypted database backups are retained for 30 days, then overwritten.

7. Storage & security

• Managed cloud database hosting in Asia-Pacific by default.
• Encrypted object storage for media (private access, signed URLs only).
• TLS 1.2+ in transit everywhere.
• AES-256-GCM at rest for all integration credentials and model API keys.
• Role-based access control with separation between platform staff and business users; enforced 2FA for staff.
• Per-tenant data isolation enforced in every database query.
• Regular vulnerability scans; responsible disclosure at Compliance@arqonnect.io.

8. Sub-processors

We share the minimum personal information necessary with carefully selected service providers that help us operate ArQonnect. The table below is our current public list of sub-processors (legal entity names and typical data). Meta Platforms (WhatsApp, Instagram, Messenger) is an independent platform provider for customer messaging — not an ArQonnect sub-processor; see section 4. We notify customers in writing before adding or replacing a sub-processor that materially changes how their data is handled.

WhatsApp, Instagram, and Messenger message routing uses Meta's Business Messaging APIs under your Meta account. Meta processes message content as an independent platform provider; it is not listed as an ArQonnect sub-processor in the table above.

9. International transfers

Where personal data is transferred outside your country (for example from the EU/UK to the United States), we rely on the European Commission's Standard Contractual Clauses (SCCs) or equivalent safeguards offered by our sub-processors.

10. Your rights (GDPR)

Subject to applicable law you have the following rights. To exercise any of them, email Compliance@arqonnect.io. We respond within 30 days.

• Access: request a copy of the personal data we hold about you.
• Rectification: ask us to correct inaccurate data.
• Erasure (right to be forgotten): request deletion of your personal data. See also Data Deletion.
• Portability: receive your data in a machine-readable format.
• Restriction / objection: object to processing based on legitimate interest.
• Withdraw consent: at any time, with effect for the future. Use the unsubscribe link in any marketing email.
• Lodge a complaint with the data protection authority in your jurisdiction.

11. California residents (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act gives you the right to know what personal information we collect about you, the right to delete it, the right to correct inaccurate information, and the right to opt out of the "sale" or "sharing" of personal information. ArQonnect does not sell personal information and does not share personal information for cross-context behavioural advertising. To exercise these rights, contact Compliance@arqonnect.io.

12. WhatsApp opt-in & messaging consent

ArQonnect requires its business customers to obtain explicit opt-in consent from end-users before sending business-initiated WhatsApp template messages on their behalf. Acceptable opt-in mechanisms include website forms, WhatsApp keyword reply, and in-person consent. End-users can opt out at any time by replying STOP to any WhatsApp message; opt-out records are kept for at least 5 years. After a valid opt-out, further business-initiated sends are blocked immediately at the send gate, and suppression is propagated to queued campaigns and audience syncs within one business day. ArQonnect does not send unsolicited messages.

13. Children

ArQonnect is a B2B service and is not directed to children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us so we can delete it.

14. Changes to this policy

We may update this policy from time to time. Material changes will be announced on this page and notified to account owners by email at least 30 days in advance.

15. Contact

Privacy questions, data subject requests, and DPA requests: Compliance@arqonnect.io. General inquiries: info@arqonnect.io. Product support: support@arqonnect.io. Postal mail: ArQonnect, 4A, R Block Johar Town, Lahore, Pakistan.