Skip to content
Xoaro
Request Access

Privacy Policy

Last updated: 25 October 2026

This Privacy Policy explains how Xoaro (“we”, “us”) collects, uses, discloses, and protects information when a business (a “Customer”) and its authorized users use the Xoaro customer relationship management (CRM) platform, and when the Customer’s own contacts (“End Users”) communicate with the Customer through channels the platform supports, including WhatsApp.

Xoaro is business-to-business software: our direct relationship is with the Customer organization that subscribes to the platform. Where this policy describes data about an End User, that data is collected and controlled by the Customer for its own business purposes, and Xoaro processes it on the Customer’s behalf and instruction.

XOARO is the product and brand name. The service is operated by MAVENNEXUS LABS PRIVATE LIMITED, a company incorporated in India.

1. Information We Collect

  • Account, company, and user information — company details and individual user information (name, email, phone, role, login credentials).
  • CRM/customer data — records a Customer creates or imports about its own contacts, plus related sales and activity history.
  • Communications data — content and metadata of messages sent and received through supported channels, including WhatsApp and email.
  • WhatsApp / Meta data — when a Customer connects a WhatsApp Business Account, we receive and store the account/phone identifiers configured, message content and delivery/read status, and an End User’s WhatsApp number and message content.
  • Integration data — data an optional connected integration (e.g. a calendar or spreadsheet source) is configured to share.
  • Technical and usage information — standard web-server request logs generated as a normal part of operating the service.

2. Xoaro Caller Mobile App

Xoaro Caller is an Android app a Customer’s employees install on the phone they use for work calls. It is used only after the employee connects the phone to their organization with a connect code and a manager approves it. With the employee’s permission, the app:

  • Reads call history for the work SIM only — the phone number, date and time, duration, direction (incoming, outgoing, missed) and SIM of calls made or received on the SIM the employee selects as their work line. Once you have selected your work SIM, calls on any other SIM are not read or sent. If no work SIM has been selected, the app shows this on screen and the employee can choose one in Settings.
  • Detects when a call ends (phone state) so it can show a screen to record the call outcome, a note and a follow-up.
  • Uploads call recordings — only audio files saved by the phone’s own call recorder, from the folder the employee chooses, matched to work calls. The app does not record calls itself and does not use the microphone for recording.
  • Shows reminders (notifications) for follow-ups and missed calls from the Customer’s contacts, and may display its after-call screen over other apps when the employee allows it.
  • Device information — the phone model and the Android device identifier (Android ID — not the IMEI or serial number), used to link the phone to the organization. Android version and app version may be included when an employee chooses to share a troubleshooting report.

The app does not read SMS messages, photos, other files, or data from other apps. Call data, notes and recordings are sent over encrypted connections to the Customer’s Xoaro account, where they are controlled by the Customer as described in this policy. An employee can stop collection at any time by disconnecting the phone in the app or uninstalling it; the Customer can also remove the device from Xoaro.

3. How We Use Information

  • To provide, operate, and maintain the platform.
  • To send messages a Customer’s user initiates or an automated workflow has been configured to send.
  • To authenticate users and enforce each Customer’s own access controls.
  • To maintain security and troubleshoot technical issues.
  • To communicate with Customers about their account.
  • To comply with legal obligations.

We do not sell personal information, and we do not use Customer or End User data to serve third-party advertising.

4. Integrations and Third-Party Services

Xoaro supports optional integrations a Customer may choose to connect, each receiving only the data necessary for the feature it provides:

  • WhatsApp (Meta) — sending and receiving WhatsApp messages on a connected Customer’s behalf.
  • Calendar providers — syncing appointment/meeting data.
  • Spreadsheet import sources — importing contact records a Customer selects.
  • Email delivery providers — sending business email on a Customer’s behalf.
  • Payment processing — where a paid subscription is in place, processing a Customer’s own subscription payment to Xoaro. Xoaro does not process payments made by a Customer’s own contacts.

Each integration is also governed by that provider’s own privacy policy and terms. Connecting or disconnecting an integration is always the Customer’s own choice.

5. Cookies and Analytics

This website does not currently use cookies for tracking and does not currently use third-party analytics or advertising tracking services. If this changes, this Privacy Policy will be updated before any such use begins.

6. Sharing and Disclosure

  • With the integrations described in Section 4, strictly to provide the connected feature.
  • With service providers who process data on our behalf, under confidentiality obligations.
  • Within a Customer’s own organization, per that Customer’s own access controls.
  • If required to comply with law, enforce our terms, or protect rights, safety, or property.
  • In connection with a merger, acquisition, or sale of assets, with this policy continuing to apply.

We do not sell personal information to third parties.

7. Data Security

We apply technical and organizational safeguards appropriate to the sensitivity of the data we hold, including encryption of sensitive credentials at rest, encrypted connections in transit, role-based access controls, and audit logging. No method of transmission or storage is completely secure.

8. Data Retention

We retain Customer and End User data for as long as the Customer’s account remains active, or as needed to provide, maintain, and secure the Service.

When a Customer requests deletion, or when the Customer’s account is terminated, we handle the applicable data manually, in accordance with our Data Deletion process and applicable legal, regulatory, contractual and legitimate business requirements. Xoaro does not operate an automated account-teardown process, and deletion within the product withdraws a record from use rather than erasing it field by field — the Data Deletion page explains what that means and what cannot be removed.

Certain information may be retained where necessary to comply with legal obligations, resolve disputes, enforce agreements, prevent fraud or abuse, maintain security, or satisfy other legitimate business requirements.

We do not specify fixed retention periods for every category of data because retention may depend on the type of information, how it is used, the Customer’s instructions, and applicable legal or regulatory requirements.

9. Your Rights

Depending on your location and applicable law, you may have rights to access, correct, export, or delete personal information we hold, and to object to or restrict certain processing. End Users should generally contact the Customer organization they interacted with first. See our Data Deletion page.

10. Children’s Information

Xoaro is a business tool intended for use by adults acting on behalf of a Customer organization. We do not knowingly collect information directly from children.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will update the “Last updated” date above when we do.

12. Company Information

XOARO is operated by MAVENNEXUS LABS PRIVATE LIMITED, a company incorporated in India.

13. Contact Us

Questions about this Privacy Policy can be sent to: no-reply@xoaro.com.