This Privacy Policy explains how msgboxx limited ("msgboxx", "we", "us" or "our") collects, uses, stores and shares your information when you use the msgboxx platform, including our website at https://www.msgboxx.io, our web and mobile applications, our public API, and the msgboxx browser (Chrome) extension (together, the "Services"). It applies to all user data handled by the Services and should be read together with any disclosures shown to you inside the products themselves.
msgboxx is a team WhatsApp platform that lets businesses manage their WhatsApp customer conversations, contacts, templates and automations from a shared inbox. To provide this, our Services — including the browser extension — necessarily process the messages, contacts and account information you and your team choose to manage in msgboxx.
1. Who we are
The data controller is msgboxx limited, a company registered in England & Wales (Company Reg. #13111356), whose registered office is Mercury Hub, 2 Linden Road, Clevedon, UK, BS21 7SN. You can contact us at any time at support@msgboxx.io.
2. Information we collect
Depending on which parts of the Services you use, we collect the following categories of user data:
- Account & identity information — your name, business name, email address, telephone number, job role, and the login credentials or authentication tokens used to sign in to msgboxx.
- Authentication & session data — when you use the browser extension, we store authentication tokens and session identifiers (for example in the browser's local/extension storage and cookies) so the extension can securely connect to your msgboxx account. The extension does not read your WhatsApp login credentials.
- WhatsApp messages & conversation content — the content of the WhatsApp messages your business sends and receives through msgboxx, including message text, timestamps, delivery/read status, and any images, documents or other media attached to those messages.
- Contact information — details of the customers and contacts you manage in msgboxx, such as names, WhatsApp/telephone numbers, email addresses, tags and free-text notes that you or your team add.
- Configuration data — templates, automations, team-member assignments, integration settings and other preferences you create within msgboxx.
- Technical & usage data — information generated automatically when you use the Services, such as IP address, browser and device type, extension version, log data, error reports and product usage/analytics events. This is used to operate, secure and improve the Services.
We do not collect special-category personal data, and we do not use any of the data above for advertising, to build advertising profiles, to determine creditworthiness, or for any purpose unrelated to providing and improving the Services.
3. How we collect it
We collect user data (a) directly from you when you register, sign in, configure your account or contact us; (b) automatically through the browser extension, web app, mobile app and API as you use msgboxx to send, receive and manage WhatsApp conversations; and (c) from third parties you choose to connect, such as the WhatsApp Business Platform and any CRM or automation tools you integrate.
4. How we use your data
- To provide, operate and maintain the msgboxx Services, including sending and receiving your WhatsApp messages and syncing them across your team's devices.
- To authenticate you and keep your account secure.
- To store and organise your contacts, conversations, templates and automations.
- To run the integrations and automations you enable.
- To provide customer support and respond to your enquiries.
- To monitor, troubleshoot, secure and improve the Services, including analytics and error diagnostics.
- To comply with our legal and regulatory obligations.
5. How we store and protect your data
User data is hosted centrally on our platform on infrastructure located in the United Kingdom, with data kept resident within the UK/European Economic Area. We protect your data using industry-standard safeguards, including encryption of data in transit (TLS), access controls, and restricting staff access to a need-to-know basis. Data held locally by the browser extension (such as session tokens) is stored in the browser's protected extension storage and is cleared when you sign out or remove the extension.
6. How and with whom we share your data
We do not sell your data, and we do not share it with third parties except as described below. We share user data with the following categories of recipients, strictly to provide the Services:
- Meta Platforms, Inc. (WhatsApp Business Platform) — to send and receive your WhatsApp messages, we exchange message content and contact phone numbers with WhatsApp/Meta, which processes them under its own terms and privacy policy.
- Cloud hosting & infrastructure providers — we use reputable cloud providers (including Amazon Web Services) in the UK/EEA to host the platform and store your data.
- Integrations you choose to enable — if you connect a third-party service, we share the relevant data with that service at your direction. These may include CRM platforms, Zapier (and the apps you connect through it), email systems, and any application you build against our public API. Each such third party processes your data under its own privacy policy.
- Service providers / sub-processors — vendors who help us operate the Services, including Google Analytics (usage analytics for the browser extension), Bugsnag (crash and error monitoring), and communications/email delivery providers. They may only process your data on our instructions and for these purposes.
- Your own organisation — because msgboxx is a team product, conversations, contacts and notes may be shared with other members of your business account, and with resellers or administrators who manage your account on your behalf.
- Legal, safety and corporate transactions — where required by law, regulation or legal process, to protect our rights or users' safety, or in connection with a merger, acquisition or sale of assets.
We do not otherwise transfer, sell or disclose your data to third parties. Where data is transferred outside the UK/EEA (for example to WhatsApp/Meta), we rely on appropriate safeguards such as Standard Contractual Clauses.
7. Data retention
We retain user data only for as long as necessary to provide the Services to you and to meet our legal obligations. You can delete contacts, conversations and other content from within msgboxx, and you may ask us to delete your account and associated data — once deleted, the data is removed from our systems and connected devices, subject to any retention we are legally required to keep.
8. Your rights
Because we host in the UK/EEA, we handle personal data in line with the UK GDPR and EU GDPR. Subject to applicable law, you have the right to access, correct, delete or export your personal data, to restrict or object to certain processing, and to withdraw consent. To exercise these rights, contact us at support@msgboxx.io. You also have the right to lodge a complaint with your local data protection authority (in the UK, the Information Commissioner's Office).
9. Third-party links
Our website and products may link to external sites we do not operate. We are not responsible for the content or privacy practices of those sites, and we encourage you to review their privacy policies.
10. Children
The Services are intended for business use and are not directed to children under 16. We do not knowingly collect data from children.
11. Changes to this policy
We may update this Privacy Policy from time to time. When we do, we will revise the effective date below and, where appropriate, notify you within the Services.
12. Contact us
If you have any questions about this Privacy Policy or how we handle your data, contact us at support@msgboxx.io or by post at msgboxx limited, Mercury Hub, 2 Linden Road, Clevedon, UK, BS21 7SN.
This Policy Is Effective As Of 10th July 2026