Client agreement

Last updated: 29 October 2026

This agreement is between Billiton Services Private Limited (“Qubox”, “we”) and each business that uses Qubox with its own WhatsApp Business account (“you”). It forms part of the Terms of service and applies to the personal data of the people you message through Qubox.

Our roles

For the people you message, you are the Data Fiduciary under India’s Digital Personal Data Protection Act, 2023: you decide whom you message and why. Qubox is your Data Processor: we handle that data only on your instructions and only to run Qubox for you.

What we process

• Data: your contacts’ WhatsApp numbers or user IDs, names and profile names, the labels you add, the messages, photos and files sent and received, delivery and read status, and consent records.
• Purpose: sending and receiving your WhatsApp messages, your shared inbox, campaigns and chatbot, consent tracking, reports, and keeping the service secure.
• Never: we do not sell your data, use it for our own marketing, share it with another business on Qubox, or use it to train AI.

Your part

• You have a lawful basis, usually consent, for every person you message, and for offers a separate consent. You give the notice the law requires.
• You follow WhatsApp’s Business and Commerce policies and Meta’s terms, and you pay Meta for your messages through your own WhatsApp account.
• You answer your contacts’ requests about their data; we help you (see below).

Our part

• Confidentiality: only people who need it to run or support Qubox can see your data, and they are bound to keep it confidential.
• Security: HTTPS for all traffic, encrypted access keys and passwords, sign-in codes by email, each business separated from the others, access logs, and checks that WhatsApp messages really come from WhatsApp.
• Sub-processors: Meta (WhatsApp’s business service) and Hostinger (hosting and email). We tell you before adding another, and you may object.
• Requests from people: when someone asks us about their data in your account, we pass it to you and help you answer, including deleting it.
• Breaches: if a breach affects your data, we tell you without delay and within 72 hours of learning of it, with what we know, so you can meet your duties to the people affected and the Data Protection Board of India.
• Retention: messages 24 months, photos and files 12 months, then deleted automatically.
• Data outside India: Meta may process WhatsApp messages outside India under its own terms; Qubox’s own copy stays with our hosting provider.

When you leave

When you close your Qubox account, you can first download your contacts with their consent choices (a CSV file). We then delete your contacts, messages and files within 30 days, except what the law asks us to keep, and remove our access to your WhatsApp account.

Contact

Questions about this agreement: support@qubox.in. Complaints: see Grievance redressal.

This page explains our terms in plain words. It is not legal advice.