1. Who we are and our role
FrontLoop (https://frontloop.online) is operated from Calicut, Kerala, India. We provide an AI WhatsApp front desk to businesses (“customers”). This policy follows India's Digital Personal Data Protection Act, 2023 (“DPDP Act”).
- For business account data (your login email, business name and billing records), FrontLoop decides how the data is used and acts as the Data Fiduciary.
- For end-customer data (people who message your business on WhatsApp), your business is the Data Fiduciary and FrontLoop processes that data on your behalf, as a Data Processor, only to provide the service.
2. Data we collect
- Account data: business name, business category, owner email address, and a salted bcrypt hash of your password (we never store the password itself).
- WhatsApp connection data: your WhatsApp Business Account ID, Phone Number ID, display number, and your Meta access token, which is encrypted at rest with AES-256-GCM.
- Knowledge base: the services, prices, hours, FAQs and business context you enter.
- End-customer data: the WhatsApp phone number and profile name of people who message your business, the text of their messages and of replies sent by the AI or your staff, delivery statuses, and details the AI extracts from the chat (name, requirement, intent). Media such as images or voice notes is not downloaded or stored; only the message type is recorded.
- Billing data: plan, amount, Cashfree order ID and payment dates. Card, UPI and bank details are entered on Cashfree's checkout and never reach our servers.
- Technical data: IP addresses used briefly for rate limiting and security, and server logs.
3. How end-customer messages flow
When someone messages a connected business, Meta delivers the message to FrontLoop. We store it in the business's isolated workspace and send the recent conversation together with that business's knowledge base to an AI model to draft a reply. The customer's phone number is not sent to AI providers. The reply is sent back through Meta's WhatsApp Cloud API. Staff replies typed in the dashboard go directly to Meta and are not sent to AI providers.
4. Purposes of processing
- Answering WhatsApp inquiries on the business's behalf and capturing leads in its dashboard.
- Operating, securing and troubleshooting the service, including fraud and abuse prevention.
- Billing, tax and accounting obligations.
We do not sell personal data, use it for advertising, or send marketing broadcasts to end customers.
5. Processors we share data with
We share data only with the service providers below, only as needed to run FrontLoop. Some of them process data on servers outside India.
| Processor | Purpose |
|---|---|
| MongoDB Atlas (MongoDB, Inc.) | Primary database for workspaces, leads, messages and knowledge bases. |
| Vercel Inc. | Application hosting and request processing. |
| Meta Platforms (WhatsApp Cloud API) | Receiving customer WhatsApp messages and delivering replies. |
| Google (Gemini API) | Primary AI model that drafts replies from the conversation and your knowledge base. |
| Groq, Inc. | Backup AI model, used only when the primary model is unavailable. |
| Cerebras Systems | Second backup AI model, used only when the first two are unavailable. |
| Cashfree Payments | Processing subscription payments in INR. |
6. Retention
- Workspace data, leads and conversations are kept while your workspace is active.
- When a business asks us to close its workspace, we delete its workspace data within 30 days, except billing records.
- Billing records are kept for 8 years to meet Indian tax and accounting law.
- Rate-limiting records expire automatically within one hour.
7. Security
Every workspace's data is isolated by a tenant check enforced on every database query. WhatsApp access tokens are encrypted with AES-256-GCM, passwords are hashed with bcrypt, webhooks are verified with signatures, and all traffic uses HTTPS.
8. Your rights
Under the DPDP Act you may ask to access, correct or erase your personal data, withdraw consent, and nominate another person to exercise these rights. Businesses can export their leads as CSV from the dashboard at any time. If you messaged a business that uses FrontLoop, please contact that business first; we will help it respond to your request.
9. Grievance contact
For privacy questions, requests or complaints, email trueattendly@gmail.com or call +91 9400160928 (Mon - Sat: 9:00 AM - 7:00 PM IST). We acknowledge grievances within 7 days. If you are not satisfied with our response, you may approach the Data Protection Board of India.
10. Changes
We will update the date above when this policy changes and notify active workspaces of material changes by email.