Privacy policy

Last updated: 29 October 2026

Qubox is a WhatsApp messaging platform of Billiton Services Private Limited (CIN U51909KA2016PTC097521), a company in India. Businesses use Qubox to send and receive WhatsApp messages with their customers through WhatsApp’s business service, run by Meta. This policy explains what personal data Qubox handles, why, how long we keep it, and the choices you have.

Who uses Qubox, and who is responsible

• Billiton’s own platforms, Arraay (online shops for small sellers) and BeBadge (event badges and passes). For their messages, Billiton Services Private Limited decides why and how the data is used: under the Digital Personal Data Protection Act, 2023 we are the Data Fiduciary.
• Client businesses that connect their own WhatsApp Business account to Qubox. For their messages, the client business is the Data Fiduciary: it decides whom it messages and why. Qubox is its Data Processor and handles that data only to run the service for that business, under our Client agreement. If a business messaged you, its own privacy policy applies too, and you can ask it directly about your data.

Each platform and each client business is kept separate inside Qubox: one business’s contacts, consents and messages are never shown to or used by another.

Shopify stores using the Qubox app

A Shopify store that installs the Qubox app is a client business: the store is the Data Fiduciary for its customers and Qubox is its Data Processor. With the store’s permission, Qubox reads from Shopify only what the app needs:

• Orders: the order number, the customer’s first name and phone number, the order total, and the courier and tracking link of each shipment, to send the store’s order updates on WhatsApp.
• Checkouts left without paying: the checkout link, first name and phone number, to send a reminder, and only to people who said yes to offers on WhatsApp.
• Customers, if the store chooses to bring them into Qubox: name, phone number and the store’s tags. No consent comes with them from Shopify.
• The store: its name, email and country, and the Shopify plan it pays Qubox through.

The “Qubox WhatsApp” block on the store’s thank-you and order status pages lets customers tick, themselves, whether they want order updates and offers on WhatsApp; the tick is kept with the order as proof. When a store removes the app, its Qubox business is closed and its data is deleted within 30 days, or sooner when Shopify asks us to delete the store’s data. When Shopify passes on a customer’s request to delete their data, Qubox deletes that customer’s contact, messages and files for that store; a request to see the data is answered to the store.

Whose data

People who message, or get messages from, a business on Qubox: for Arraay, sellers, their team and shoppers; for BeBadge, members, organisers, exhibitors and visitors; for client businesses, their customers and leads. And the people who sign in to Qubox (Billiton’s team and the teams of client businesses).

What we collect

• Who you are on WhatsApp: your WhatsApp phone number, or the WhatsApp user ID WhatsApp gives people who use a username; your WhatsApp username if you use one; your WhatsApp profile name. If you use a username, we see your number only when you share it (for example with the “Share Contact Info” button).
• What the business tells us about you: your name, whether you are a customer, seller, visitor and so on, your account reference with that business, and simple labels (tags, lists).
• Messages: the messages sent to you (for example an order update, a pass or a login code) and the messages, photos and files you send, with their time and whether they were delivered and read.
• Your choices: whether you agreed to updates and to offers, when, how (for example a tick at checkout or a reply “STOP”), and who recorded it; and whether you turned off promotions in WhatsApp.
• People who sign in to Qubox: name, email, the business they work for, and sign-in records. When a client business connects its WhatsApp account, Meta gives Qubox an access key for that account (stored encrypted) and the account’s details (name, numbers, templates).
• People who ask for a demo on qubox.in: name, work email, phone or WhatsApp number, business name and website, country, what they want to use Qubox for, which WhatsApp tool they use now, anything else they write, and the IP address the request came from. We use it only to reply and arrange the demo.
• Visits to qubox.in: which pages are opened, on which day, and where the visit came from (the site that linked here, or a campaign link). We count them ourselves, with no cookies of our own and without storing IP addresses.
• Technical records: logs of the system’s activity, including IP addresses of people who sign in and of the systems that call Qubox.

We do not collect card or bank details, your contacts list, or your location. Client businesses pay Meta for their WhatsApp messages directly; Qubox never sees their card.

Why we use it

• To send you the messages you asked for or need: order and delivery updates, passes, login codes, and answers to your questions.
• To send offers and news only if you agreed to them.
• To pass your replies to the business you were talking to, so it can help you.
• To respect your choices: if you send STOP, or turn off promotions in WhatsApp, we stop those messages.
• To keep the service safe and working, and to meet the law (for example security logs).

We do not sell personal data, we don’t build advertising profiles, we don’t use one business’s data for another, and we don’t use your messages to train AI.

Consent

Updates need your agreement with the business (for example a tick at checkout or when registering for an event); offers need a separate agreement. Login codes you ask for, and replies within 24 hours of your own message, need only that you haven’t asked to stop. You can withdraw consent at any time, as easily as you gave it: reply STOP to the WhatsApp number (START brings messages back), use the business’s own settings, or write to support@qubox.in. Stopping one business doesn’t stop another: each keeps its own choice. Client businesses must have your agreement before they message you; Qubox records and respects it.

Who we share it with

• Meta (WhatsApp): every WhatsApp message travels through WhatsApp’s business service, run by Meta, which handles it under its own terms. Meta may process messages on servers outside India. WhatsApp also keeps a “contact book” for each business (your number and WhatsApp user ID after you have talked to one of its numbers).
• Hostinger: our hosting provider, which stores Qubox’s data and sends its emails.
• Shopify: for stores using the Qubox app, Qubox reads the data listed above from Shopify, and Shopify bills the store for its Qubox plan.
• The business you talk to gets your replies and your choices, and only for that business.

Each gets only what it needs. We share data with authorities only when the law requires it.

How long we keep it

• Messages: 24 months. Photos and files: 12 months. Then they are deleted automatically.
• Technical logs: at least one year, as the law requires.
• Website visit counts: 13 months, then deleted automatically.
• Demo requests: until we no longer need them to reply to you. Write to us and we delete yours.
• Records of your consent and of your choice to stop: as long as we may need to show what you agreed to.
• When a client business leaves Qubox, its contacts, messages and files are deleted within 30 days, except what the law asks us to keep.

When you ask for deletion, see Data deletion.

Your rights

You can ask what data we have about you, ask us to correct or complete it, ask us to delete it, withdraw consent, and nominate someone to act for you if you can’t. Write to support@qubox.in from the number or email concerned, or use the Data deletion page. If the request is about a client business, we pass it to that business and help it answer. We may ask you to confirm it’s you. We reply within 30 days.

Security

Data travels over HTTPS. Access keys and passwords are stored encrypted, sign-ins to Qubox need a code sent by email (except a time-limited test login we give Meta’s reviewers, which can open only a test business), each business sees only its own data, and only people who need it can open the system. Messages from WhatsApp are checked to make sure they really come from WhatsApp. If a breach affecting your data happens, we will tell the business concerned, you and the Data Protection Board of India as the law requires.

Children

Qubox is meant for businesses messaging adults. We don’t knowingly message children. If you think we have a child’s number, write to support@qubox.in and we will delete it.

Changes and complaints

We’ll post changes on this page and update the date at the top. Questions: support@qubox.in. Complaints: our Grievance Officer, Srikanth, at info@qubox.in (see Grievance redressal). You may also complain to the Data Protection Board of India.

This page explains our practices in plain words. It is not legal advice.