Contents
- Who we are and who this policy covers
- Who is responsible for your information
- Information we process
- How we use information and on what legal basis
- Artificial intelligence
- Who we share information with
- Where information is processed
- How long we keep information
- Security
- Your rights and how to exercise them
- Security incidents
- Cookies
- Minors
- Changes to this policy
- Contact
1. Who we are and who this policy covers
In short
Softshop S.A., a company based in Asunción, Paraguay, provides Inbox 360 to businesses. This policy covers the staff of those businesses who use the service and the people who communicate with those businesses through WhatsApp.
Inbox 360 is provided by Softshop S.A., España esquina Brasilia, Edificio España, Asunción, Paraguay ("Softshop", "we", "us"). It is a service for businesses, not for consumers. It works exclusively with the official WhatsApp Business Platform provided by Meta, and this policy covers only that channel.
This policy applies to two groups of people:
- Platform users: the staff of our business customers who use Inbox 360 on their behalf.
- End customers: the people who communicate with a business through Inbox 360.
This policy describes what Softshop does with information. Each business customer remains responsible for informing its own customers about how it treats their information.
2. Who is responsible for your information
In short
Each business customer is responsible for its customers' information and decides how it is used; Softshop processes it on the business's behalf. Softshop is responsible for the account information of platform users.
Each business customer is the controller of the personal information of its end customers: it decides why and how that information is used. Softshop processes it on the business's behalf and only under its instructions, as a processor.
For the account and security information of platform users, Softshop is the controller.
Meta, in providing the WhatsApp Business Platform, acts as a processor for the business and keeps messages for a maximum of 30 days. Our artificial intelligence providers act as sub-processors of Softshop (see section 5).
3. Information we process
In short
We process account information, the content of the communications that go through the service, the information that each business provides, technical and security information, and the information generated by artificial intelligence features.
- Account information. The name, work email address, role and organisation of platform users, together with their sign-in credentials.
- Content of communications. The messages and files sent and received through the service, the WhatsApp number and profile name of the people who communicate with the business, and the delivery status of each message.
- Information provided by the business customer. The information a business records about its customers and the content it uploads to configure the service.
- Technical and usage information. Technical session cookies and security logs, which record the IP address, date and type of security events.
- Information generated by artificial intelligence features. Summaries, classifications and other analysis of communications produced by the features that the business enables.
We ask businesses not to use the service for sensitive information (for example, about health, religion or political opinions) unless it is necessary and they hold the legal basis the law requires.
4. How we use information and on what legal basis
In short
We use information to provide the service, to run the artificial intelligence features that each business enables, to keep the service secure, to comply with the law and to communicate with business customers about the service. We never sell information or use it for advertising.
| Purpose | Legal basis |
|---|---|
| Provide, operate and maintain the service: receive, send, store and display communications and the related information for the business. | For end customers' information, the instructions of the business customer, which holds its own legal basis towards its customers. For platform user accounts, the performance of the contract with the business customer. |
| Artificial intelligence features for the business, including the adjustment of models for the exclusive use of that business (see section 5). | The instructions and contract of the business customer. |
| Security and abuse prevention: protect accounts, detect and investigate incidents. | Our legitimate interest in protecting the service, our customers and the commitments we have towards Meta. |
| Compliance with legal obligations and answers to requests from authorities. | Legal obligation. |
| Communications with business customers about the service (notices, changes, incidents). | The performance of the contract with the business customer. |
These legal bases follow article 5 of Paraguay's Personal Data Protection Law No. 7593/2025 (see section 10).
5. Artificial intelligence
In short
Artificial intelligence features are optional for each business. They run on paid plans of OpenAI, Anthropic and Google, which do not use the information to train their models. When an automated feature replies, the business must tell its customer that it is an artificial intelligence.
A business may enable artificial intelligence features that help it answer and organise its communications, including automatic replies. To provide them, Inbox 360 uses the services of OpenAI, Anthropic and Google (Gemini) under paid, commercial plans. By contract, these providers do not use the information to train their models, keep it only for a limited time to detect abuse (up to 30 days; Google up to 55 days) and may process it outside Paraguay, mainly in the United States.
When an artificial intelligence feature replies automatically, the business must tell its customer that it is interacting with an artificial intelligence, and a person can take over the conversation.
In line with section 4.7 of the Meta Terms for WhatsApp Business Platform, information obtained through WhatsApp may be used to adjust an artificial intelligence model only for the exclusive use of the business that obtained it, under its instructions. It is never combined with another business's information and never used to build or improve any other model. A business's models are deleted together with its information when its contract ends.
6. Who we share information with
In short
We share information only with Meta and with our artificial intelligence providers, under written contracts, and with authorities when the law requires it. We do not sell information.
| Provider | Role | Where it processes information |
|---|---|---|
| Meta (WhatsApp Business Platform) | Processor for the business; carries the messages and keeps them for a maximum of 30 days. | Meta's data centres (see Meta's documentation). |
| OpenAI, Anthropic and Google (Gemini) | Artificial intelligence sub-processors, only when the business enables those features. | Outside Paraguay, mainly in the United States. |
No other provider receives personal information. We disclose information to public authorities only when a law or a binding order requires it. We do not sell, license or share information with third parties for their own purposes, as required by the Meta Platform Terms and the Meta Terms for WhatsApp Business Platform. Each business customer's information is kept separate from every other business's.
7. Where information is processed
In short
Inbox 360 runs on Softshop's own servers in Paraguay. Meta and our artificial intelligence providers process information outside Paraguay under data processing agreements.
Inbox 360 runs on servers owned and managed by Softshop in Paraguay. Meta processes messages in its own data centres, and our artificial intelligence providers process information outside Paraguay, mainly in the United States.
These transfers are necessary to perform the contract with the business customer and are covered by data processing agreements with each provider, which commit them to use the information only to provide their service (article 19 of Law No. 7593/2025).
8. How long we keep information
In short
A business's information is kept while its contract lasts and deleted within 30 days after it ends. Security logs are kept for 12 months. Deleted information leaves our backups within a maximum of 90 days.
| Information | Retention |
|---|---|
| Content of communications, information provided by the business and information generated by artificial intelligence features, including the models of exclusive use of the business. | While the business's contract lasts. Deleted within 30 days after the contract ends. |
| Platform user accounts. | While the account exists. |
| Security logs (IP address, date and type of event). | 12 months, even if the account is deleted earlier, in order to investigate incidents. |
| Backups. | Deleted information leaves backups within a maximum of 90 days. Backups are not used to restore information deleted on request. |
| Copies held by Meta and by our artificial intelligence providers. | Meta: maximum 30 days. Artificial intelligence providers: up to 30 days (Google up to 55 days), only to detect abuse. |
We keep information only for as long as it is needed for the purposes described in this policy, in line with the Meta Platform Terms and with Law No. 7593/2025.
9. Security
In short
Each business's information is stored separately, access is limited by role, connections are encrypted and Softshop follows its Information Security Policy.
Softshop applies technical and organisational measures appropriate to the information it processes: the information of each business customer is stored separately; access is limited by role; connections and stored credentials are encrypted; the notifications that Meta sends to the service are verified; and security events are logged. Softshop operates under its Information Security Policy.
No system is completely secure. If a security incident affects personal information, we act as described in section 11.
10. Your rights and how to exercise them
In short
You can ask for access, rectification, deletion, objection and portability of your information, free of charge. End customers contact the business they communicated with; business customers and platform users contact Softshop. Requests are answered within 30 calendar days.
You can request access to the personal information we hold about you, its rectification, its deletion, object to a processing and obtain a copy of the information you provided (portability). Requests are free of charge and are answered within a maximum of 30 calendar days.
If you are an end customer, contact the business you communicated with: it is responsible for your information, it knows you and verifies your identity, and it asks Softshop to carry out in the service whatever is needed. If you write to Softshop directly, we will direct you to that business or forward your request to it.
If you are a platform user or a business customer, write to Softshop at the privacy email address in section 15. The Data Deletion page explains the steps.
This process is aligned with Paraguay's Personal Data Protection Law No. 7593/2025, which comes into force in late 2027 and whose standards we apply from now on. Once it is in force, you may also lodge a complaint with the National Personal Data Protection Agency (Agencia Nacional de Protección de Datos Personales).
11. Security incidents
If a security incident affects personal information processed in Inbox 360, Softshop notifies Meta immediately, as its terms require, notifies the business customers affected without undue delay, and notifies the competent authority within a maximum of 72 hours and the affected people when the incident may harm them, as Law No. 7593/2025 provides.
12. Cookies
Inbox 360 uses only technical session cookies, which are necessary to keep platform users signed in. We do not use advertising or analytics cookies. These legal pages do not set cookies.
13. Minors
Inbox 360 is not aimed at minors. Platform users are adult staff of our business customers. Each business is responsible for the people it communicates with and for obtaining the consent that the applicable law requires when it communicates with a minor.
14. Changes to this policy
We may update this policy when the service, the law or Meta's requirements change. If we add features that change how we process information, we update this policy before enabling them. We publish each new version on this page with its effective date and notify business customers by email at least 15 days before a material change takes effect.
15. Contact
Softshop S.A.
España esquina Brasilia, Edificio España
Asunción, Paraguay
Privacy email: info@softshop.com.py