Privacy Policy

1. Who We Are

WAZO may operate services through affiliated entities, including Wazo Solutions Pvt. Ltd., depending on the product, customer relationship, geography, and applicable contractual arrangements.

For privacy questions, data-subject requests, integration questions, or requests concerning third-party account data, email hello@wazo.one.

Where applicable, the WAZO entity acting as the controller or processor for your information will be identified in the relevant customer agreement, product documentation, or applicable notice.

2. Information We Collect

We collect information necessary to provide, secure, operate, and improve our services.

2.1 Information You Provide

This may include:

• Name
• Email address
• Phone number
• Profile information
• Company or organization information
• Job title and department
• Employee or user identifiers
• Account credentials where applicable
• Preferences and settings
• Survey responses
• Comments, feedback, recognition activity, and other content you submit
• Information you provide when contacting customer support

2.2 Automatically Collected Information

We may automatically collect:

• IP address
• Device information
• Browser and operating system information
• Approximate location derived from IP address
• Log information
• Authentication and security events
• Usage information
• Pages, screens, and features accessed
• Application performance information
• Error and diagnostic information

2.3 Information from Third-Party Integrations

When you connect a third-party service to WAZO, we may receive information from that service based on the permissions you authorize. The exact information depends on the integration, the scopes or permissions requested, the feature you enable, and whether the connection is made for sign-in, synchronization, automation, or another purpose. We request the minimum permissions reasonably necessary to provide the requested functionality.

3. Third-Party Sign-In

WAZO may allow you to sign in or create an account using third-party identity providers such as:

• Google
• Microsoft
• GitHub
• Apple
• Other supported identity providers

When you use a third-party sign-in method, we may receive information necessary to authenticate and establish your WAZO account, such as:

• Name
• Email address
• Profile photo
• Provider-specific account identifier
• Authentication information
• Other basic profile information included in the permissions you authorize

Third-party sign-in should not be interpreted as authorization for WAZO to access all information available in that third-party account. Additional permissions are requested separately when a WAZO feature requires access to additional third-party data.

4. Connected Integrations

WAZO may allow you to connect external applications and services to your WAZO account.

4.1 Identity and Authentication Services

For identity providers such as Google, Microsoft, GitHub, and Apple, information may include:

• Name
• Email address
• Profile image
• Provider account identifier
• Authentication information
• OAuth access or refresh tokens where required to maintain an authorized connection

4.2 Calendar Services

Where a calendar integration is enabled, WAZO may access information such as:

• Calendar identifiers
• Event titles
• Event dates and times
• Event descriptions where required
• Event locations where required
• Attendees
• Organizer information
• Recurrence information
• Availability information

WAZO only accesses calendar information required for the calendar-related feature you enable.

4.3 Communication and Collaboration Platforms

For platforms such as Slack, Microsoft Teams, or similar services, information may include, depending on the feature and permissions granted:

• Workspace or organization information
• User profiles
• User identifiers
• Channel or team information
• Messages or communications
• Files or attachments
• Membership information
• Relevant activity or metadata

WAZO does not access message content, files, or other communication data unless the applicable integration and feature require that access and the required permissions have been granted.

4.4 HRMS Systems

When you connect an HRMS or workforce management system, information may include, depending on the configured integration:

• Employee names
• Employee identifiers
• Work email addresses
• Departments
• Job titles
• Reporting relationships
• Employment information
• Organizational structure
• Other employee information required to provide the enabled functionality

4.5 CRM Systems

When you connect a CRM, WAZO may process information such as:

• Customer or contact names
• Contact information
• Account identifiers
• Organization information
• Sales or account information
• Relevant CRM records and metadata

Only the data necessary for the enabled integration or workflow is requested.

4.6 ERP and Business Systems

When you connect an ERP or other business application, WAZO may process records and metadata needed to provide the requested integration, such as:

• Organization information
• Users and employees
• Operational records
• Business entities
• Transaction-related metadata
• Workflow information

The exact data accessed depends on the permissions granted and the functionality configured by you or your organization's administrator.

4.7 Project and Development Platforms

For services such as Jira, GitHub, or similar platforms, information may include:

• User and profile information
• Organization or workspace information
• Projects
• Issues or tickets
• Comments
• Labels
• Assignees
• Project activity
• Repository or development metadata where applicable

5. How We Use Information

We use information only for legitimate business and product purposes, including:

1. Providing and operating WAZO products and services.
2. Creating and managing accounts.
3. Authenticating users.
4. Enabling third-party integrations that you or your organization activate.
5. Synchronizing information between WAZO and connected services.
6. Providing automation and workflow features requested by you.
7. Providing calendar, communication, HRMS, CRM, ERP, project-management, and productivity functionality.
8. Providing customer support and troubleshooting.
9. Maintaining security and preventing fraud, abuse, and unauthorized access.
10. Monitoring service availability and performance.
11. Meeting legal, regulatory, contractual, and security obligations.
12. Improving WAZO products and features in accordance with applicable law and the limitations described in this Privacy Policy.

We do not use third-party account data for purposes unrelated to the functionality for which the relevant data was authorized.

6. Google User Data

When you connect a Google account or use a WAZO feature that accesses Google APIs, WAZO accesses only the Google data covered by the permissions you authorize. Examples may include:

• Google account profile information
• Calendar information
• Contacts
• Authentication information
• Other Google data necessary for a specific enabled WAZO feature

The exact permissions requested are displayed during the applicable Google authorization process.

Google Data Use

WAZO uses Google user data only as necessary to:

• Provide the WAZO feature you requested.
• Authenticate and authorize your account.
• Maintain an authorized connection.
• Synchronize information required for an enabled feature.
• Provide support when you request assistance.
• Protect the security of WAZO and its users.
• Comply with applicable legal obligations.

Google user data is not sold. WAZO does not use Google user data for targeted advertising or advertising profiling. WAZO does not use Google user data for unrelated purposes that are not disclosed to you as part of the relevant feature.

Where Google user data is transferred to another service provider, such transfer is limited to what is necessary to provide the authorized feature, maintain security, comply with applicable law, or otherwise as permitted by applicable Google policies.

WAZO's handling of Google user data complies with the Google API Services User Data Policy, including applicable Limited Use requirements.

6.1 Google User Data Retention and Deletion

WAZO retains Google user data only for as long as necessary to provide the Google-enabled functionality you have authorized, maintain your WAZO account and authorized connection, provide requested support, maintain security, comply with applicable legal obligations, or satisfy other legitimate purposes described in this Privacy Policy.

When a Google account connection is disconnected or Google access is revoked, WAZO will stop accessing Google data through that authorization. Google OAuth access and refresh tokens associated with the disconnected integration will generally be deleted within 30 days, unless a longer retention period is required or permitted for security, fraud prevention, account recovery, audit, legal, or contractual purposes.

Google profile information and other Google user data stored by WAZO for an enabled feature will generally be deleted or removed within 30 days after the Google integration is disabled or a valid deletion request is processed, unless a longer retention period is required or permitted by applicable law, contractual obligations, security requirements, legal holds, or other legitimate purposes described in this Privacy Policy.

If you delete your WAZO account, Google user data associated with your account will generally be deleted or irreversibly anonymized within 90 days, subject to the same legal, security, contractual, and backup requirements described in this Privacy Policy.

Google user data may temporarily remain in encrypted backups after deletion. Such backup copies are isolated from ordinary processing and are automatically overwritten in accordance with WAZO's backup retention procedures.

You may request deletion of Google user data held by WAZO at any time by contacting hello@wazo.one or by using the applicable WAZO account or integration deletion controls.

You may also revoke WAZO's access to your Google account through your Google Account security settings.

7. GitHub, Microsoft, Apple, Slack, Jira and Other Third-Party Data

For non-Google integrations, WAZO similarly limits access to the permissions necessary for the feature you choose to use.

• GitHub: account information, repositories, issues, pull requests, teams, organization information, or other authorized resources.
• Microsoft: account/profile information, Microsoft 365 resources, calendars, mail, files, Teams or other Microsoft resources when specifically enabled and authorized.
• Apple: identity and account information made available through Apple’s authorization services.
• Slack: workspace, user, channel, message, file, and other information depending on the scopes granted.
• Jira/Atlassian: account information, projects, issues, comments, users, and related project information depending on permissions granted.

The exact data accessed varies by integration and is presented through the applicable authorization or connection flow. For Microsoft integrations, permissions may be granted incrementally as additional features are enabled, and organizations may also use administrator consent to authorize access for users. Slack integrations likewise use defined permission scopes that determine what information an application can access and what actions it can perform.

8. With Whom We Share Information

We do not sell personal information or third-party account data. We may share information with the following categories of recipients.

8.1 Service Providers and Subprocessors

We may use trusted third-party service providers for:

• Cloud hosting
• Database and storage services
• Authentication
• Security
• Monitoring
• Logging
• Analytics
• Customer support
• Communication delivery
• Infrastructure management
• Data processing
• Backup and disaster recovery

These providers may process information on our behalf and are required to maintain appropriate confidentiality, security, and contractual protections.

8.2 Connected Third-Party Services

When you explicitly connect an integration, WAZO may send or receive information from the connected service as necessary to provide the feature you enabled. For example, if you enable a CRM integration, data may be exchanged between WAZO and that CRM according to the configured workflow.

Where an integration involves sharing information with a third party beyond the connected service itself, WAZO will provide appropriate notice and, where required, obtain your consent.

8.3 Your Organization

If you use WAZO through an employer, organization, or other business customer, information may be accessible to authorized administrators of that organization, subject to the organization's configuration and applicable agreements.

8.4 Legal and Regulatory Disclosures

We may disclose information when reasonably necessary to:

• Comply with applicable law
• Respond to valid legal process
• Respond to lawful government requests
• Enforce our agreements
• Protect the rights, property, or safety of WAZO, our users, or others
• Prevent fraud, abuse, or security threats

8.5 Corporate Transactions

If WAZO is involved in a merger, acquisition, financing, reorganization, sale of assets, or similar transaction, information may be transferred to the relevant successor or acquiring entity subject to applicable law and appropriate confidentiality obligations.

9. Security and Protection of Information

WAZO maintains technical, organizational, and administrative safeguards designed to protect personal information and connected third-party data. Depending on the service and data involved, safeguards may include:

Encryption

Data transmitted between systems is protected using modern transport encryption such as TLS. Data stored by WAZO is encrypted at rest using security controls provided by our infrastructure and storage providers, where supported.

Access Controls

Access to systems containing customer or third-party data is restricted using role-based access controls and least-privilege principles. Personnel receive access only when required to perform their responsibilities.

Authentication

Administrative and privileged access is protected using strong authentication controls, including multi-factor authentication where supported or required.

Credential and Token Protection

OAuth access tokens, refresh tokens, API credentials, and other authentication material are protected using appropriate access restrictions and secure storage mechanisms.

Monitoring

Production environments are logged and monitored for security and operational purposes. Security-relevant events may be investigated to detect unauthorized access, abuse, or other threats.

Secure Development

We use security practices such as code review, vulnerability management, dependency monitoring, security testing, and controlled deployment processes appropriate to the systems processing data.

10. Human Access to Third-Party Data

WAZO limits human access to third-party account data to personnel who have a legitimate operational need. Where data is particularly sensitive, access may be further restricted.

Human access may occur when necessary for:

• Customer support requested by the user or organization
• Troubleshooting
• Security investigations
• Fraud or abuse prevention
• Legal or regulatory compliance
• Other purposes permitted by applicable law and the relevant third-party provider’s policies

We do not permit employees to access third-party account data merely for personal use or unrelated purposes.

11. Data Retention

We retain information only for as long as reasonably necessary to provide the applicable service, fulfill the purposes described in this policy, satisfy contractual obligations, resolve disputes, maintain security, or comply with legal requirements. Retention periods vary depending on the type of information.

Connected account credentials and OAuth tokens

Access and refresh tokens are generally retained while the integration remains active and for a limited period after disconnection where reasonably necessary for security, account recovery, audit, or legal purposes. Unless a longer period is required by law or a customer agreement, OAuth tokens may be deleted within 30 days after an integration is disconnected.

Profile information

Account and profile information is generally retained while your WAZO account remains active. Following account deletion, information will generally be deleted or irreversibly anonymized within 90 days, subject to legal, security, contractual, or backup requirements.

Calendar and integration data

Data synchronized or cached for an enabled integration is generally retained while the integration remains active. Unless a longer period is required by law or a customer agreement, applicable cached integration data will generally be deleted or removed within 30 days after the integration is disabled or a valid deletion request is processed.

Logs and audit information

Operational, security, and audit logs may be retained for up to one year. Aggregated or anonymized information may be retained for a longer period where it can no longer reasonably identify an individual and is used for legitimate operational, security, or analytical purposes.

Backups

Deleted information may remain temporarily in encrypted backups until those backups are automatically overwritten in accordance with our backup retention procedures. Backup data is not restored for ordinary processing except where necessary for disaster recovery, security, legal compliance, or other legitimate operational reasons.

12. Deletion of Information

You may request deletion of your WAZO account and associated information by:

• Using the WAZO Account Deletion Request page
• Using available account deletion controls within the WAZO application
• Contacting us at hello@wazo.one

When you disconnect a third-party integration, WAZO will stop accessing the connected service using the authorization associated with that integration, subject to technical processing necessary to complete the disconnection.

Where deletion is requested, WAZO will delete or irreversibly anonymize applicable information within the retention periods described above, unless retention is required or permitted by law, contractual obligations, legal holds, fraud prevention, security requirements, or other legitimate purposes. Certain residual information may temporarily remain in backups, logs, or security records until it is automatically overwritten.

To submit a deletion request, visit our Account Deletion Request page.

13. Revoking Third-Party Access

You may revoke WAZO's authorization to access a connected third-party service:

1. Through controls provided by WAZO;
2. Through the connected third-party service's account or security settings; or
3. By contacting WAZO at hello@wazo.one.

Revoking access may prevent WAZO features that depend on that integration from operating. For Google accounts, users can also revoke WAZO's access through their Google Account security settings. Similar controls may be available through Microsoft, GitHub, Slack, Apple, Atlassian, and other connected providers.

14. User Rights

Subject to applicable law, users may have rights including:

• Access to personal information
• Correction of inaccurate information
• Deletion
• Restriction of processing
• Objection to certain processing
• Data portability
• Withdrawal of consent
• Revocation of connected integrations

To exercise your rights, contact hello@wazo.one. We may require sufficient information to verify the identity of the requester before fulfilling a request.

15. International Data Transfers

WAZO operates internationally, and information may be processed or stored in countries different from the country where you reside. These locations may include the United States and other countries in which WAZO or its service providers operate. Where required by applicable law, WAZO will use appropriate safeguards for international transfers, which may include contractual safeguards, adequacy mechanisms, or other legally recognized transfer mechanisms.

16. Data Protection for Organizational Customers

When WAZO provides services to a company, employer, or other organization, that organization may determine:

• Which integrations are enabled
• Which permissions are granted
• Which employees can access information
• Which data is synchronized
• How long certain business data must be retained

In such circumstances, WAZO may process information on behalf of the organization in accordance with the applicable customer agreement, data processing agreement, and applicable law.

17. Children's Privacy

WAZO's services are intended for business and professional use and are not directed toward children under the minimum age required by applicable law. We do not knowingly collect personal information from children in violation of applicable law.

18. Cookies and Similar Technologies

WAZO uses cookies and similar technologies for purposes such as:

• Authentication
• Session management
• Security
• Preferences
• Analytics
• Application functionality

Cookies and similar technologies are not used to obtain access to third-party account data beyond the permissions and functionality you authorize. Additional information may be provided in our Cookies Policy.

19. Automated Decision-Making and Profiling

WAZO may use automated features to provide product functionality, such as recommendations, workflow automation, calendar suggestions, analytics, or other product features.

WAZO does not use connected third-party account data to make automated decisions that produce legal or similarly significant effects about individuals, except where explicitly disclosed and permitted by applicable law. For questions regarding automated processing, contact hello@wazo.one.

20. Security Incidents

If WAZO discovers a security incident affecting personal information or connected third-party data, we will investigate, contain, and remediate the incident. Where required by applicable law or contractual obligations, we will notify affected customers, users, regulators, or other relevant parties.

21. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect:

• Changes to our services
• New integrations
• Changes in technology
• Changes in legal or regulatory requirements
• Changes in our data processing practices

When material changes affect the processing of personal information or third-party account data, we may provide additional notice through the WAZO application, website, email, or other appropriate communication methods. The “Last Updated” date at the top of this policy indicates when it was most recently revised.

22. Contact Us

For privacy questions, deletion requests, data-subject requests, security questions, or third-party integration concerns, contact: