Privacy Policy

1. Who We Are

The Service is provided by Heion Ventures Private Limited, the legal entity and Google Play developer account holder associated with the Autorbix and Sanghi Sales Essentials store listings. Autorbix and Sanghi Sales Essentials are mobile and web products of Heion Ventures Private Limited that help automobile dealerships manage inventory, leads, quotations and team performance.

We act as the data controller for personal information about our account holders and website visitors, and as a data processor for the customer and lead data that dealerships store in the Service.

Registered address: 22, Krishna Nagar, Imli Phatak, Jaipur 302005, India. For privacy questions, contact us at contact@heion.co.

2. Information We Collect

2.1 Information you provide

• Account & contact details — name, business name, email address, phone number and role at the dealership.
• Dealership operational data — vehicle inventory (variant, colour, VIN, status), leads, customer contact details, quotations, accessories and sales activity that you enter into the Service.
• Communications — messages you send to our support or sales teams.

2.2 Location Data

With your explicit permission, the Autorbix and Sanghi Sales Essentials mobile apps may access and collect both approximate and precise Location Data from your device. We access this data on-device and may also collect and store it on our servers when needed to provide the features you request.

We use Location Data to:

• Help you find nearby dealerships.
• Support check-in workflows.
• Power maps and location-based navigation within the Service.
• Analyse aggregated usage patterns to improve product performance and reliability.

Location access is requested only after an explicit user action and after you grant the relevant device permission. Location is optional: if you deny or later revoke location permission, you can still use the core features of the Service. We do not share Location Data with any third parties.

2.3 Information collected automatically

• Usage & device data — IP address, device identifiers, browser type, operating system, pages viewed and feature interactions.
• Cookies & similar technologies— used to keep you signed in, remember preferences and measure performance. See Section 7.

2.4 Information from third-party integrations

When you choose to connect an integration, we receive data from that provider only after you authorise access. We request the minimum scope needed to deliver the feature you enabled. See Section 4 for specifics on Google, Meta and Facebook.

3. How We Use Your Information

• To provide, operate, maintain and secure the Service.
• To create and manage leads, inventory, quotations and performance reporting on your behalf.
• To enable location-based features such as nearby dealerships, check-in and maps when you grant permission.
• To sync leads, advertising and account data from integrations you have explicitly connected.
• To respond to your requests and provide customer support.
• To send service-related notifications and, where permitted, product updates (you can opt out).
• To detect, prevent and address fraud, abuse and technical issues, and to comply with legal obligations.

4. Third-Party Integrations

Integrations are optional and are only activated when you connect them. You can disconnect an integration at any time from your account settings, which revokes our ongoing access to that provider's data.

4.1 Google

If you sign in with Google or connect Google services, we may access your basic Google profile (name, email address and profile picture) and, where you grant it, scopes needed for features you enable. Autorbix's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, and we do not sell it or transfer it to third parties except as needed to provide the Service, comply with law, or with your consent.

4.2 Meta Platform Data (Facebook, Instagram, WhatsApp, Ads)

This Section 4.2 is Autorbix's public Meta Platform Data policy. It applies to every person or business that can access Autorbix, including dealership staff, people who connect a Meta account, and people whose data we receive because they submitted a Meta Lead Ad, messaged a connected Page or Instagram account, or messaged a connected WhatsApp Business number. The right to request deletion is available to all of those people. This page is published at a stable, publicly crawlable, non-geoblocked HTTPS URL for Meta App Review and Platform compliance.

Heion Ventures Private Limited uses the Meta for Developers Platform (APIs, SDKs, webhooks, tokens and related services) only to operate Autorbix for automobile dealerships. We agree to, and process Platform Data only in accordance with, the Meta Platform Terms, the Meta Developer Policies, applicable Meta Product terms (including Instagram Terms of Use, Meta Commercial Terms, Business Tools Terms, and WhatsApp Business terms), Meta's Developer Docs, and applicable law. This Privacy Policy describes Autorbix's processing. It does not supersede, modify or replace Meta's terms. If anything here is less protective of Meta or of people who use Meta Products, Meta's terms control our use of Platform Data.

Autorbix is an independent product of Heion Ventures Private Limited. It is not endorsed, sponsored or administered by Meta. Connecting Meta does not create a partnership with Meta. We do not ask for, collect or store Facebook, Instagram or WhatsApp passwords. Authentication uses Meta's official Login, Embedded Signup and token flows only.

4.2.1 What Platform Data we process

We process Platform Data only after a dealership admin authorises Autorbix in Meta, or after a person interacts with that dealership on Meta Products. We request the minimum permissions needed for the feature the dealership enabled. Depending on what is connected, this may include:

• Facebook Login / connection identity — app-scoped user ID, name, email (if granted), and the fact that you authorised the app.
• Pages — Page ID, name, category, roles, subscribed webhook fields, and Page access tokens needed to receive leadgen and related events.
• Lead Ads — leadgen IDs, form IDs, form names, field answers the person submitted (typically name, phone, email, and any custom questions on that form), created time, and the ad/form that produced the lead.
• Marketing / campaign facts — campaign, ad set and ad identifiers, status, spend, impressions, clicks and lead counts used to show performance in Autorbix. We do not use these to build personal profiles of Facebook or Instagram users.
• Instagram professional account — account ID, username, media metadata, insights, comments and Instagram Messaging threads that the connected Page is authorised to manage.
• WhatsApp Business — WABA ID, phone number ID, display name, template metadata, inbound and outbound message content, delivery statuses, Click-to-WhatsApp referral data, and opt-out (STOP) signals.
• Webhooks and jobs — signed deliveries, job receipts and error metadata required to ingest events reliably.
• Secrets we must protect — Page, system-user and WhatsApp access tokens, app-scoped IDs and encryption context. These are Platform Data. We do not put them in the browser, logs, URLs or marketing tools.

4.2.2 Why we process it (permitted purposes only)

We process Platform Data solely to provide the Autorbix features the dealership enabled, as described in Meta's Developer Docs for those APIs:

• Connect a Facebook Page, ad account and Instagram professional account.
• Ingest Meta Lead Ads into the dealership's Autorbix lead pipeline.
• Route and assign those leads to the dealership's staff.
• Show campaign performance the dealership already runs in Meta Ads Manager.
• Show Instagram insights, media and authorised messaging for that Page.
• Operate WhatsApp Business messaging the dealership authorised (inbox, templates, qualification bot, opt-out).
• Secure the integration, prevent abuse, and comply with law or Meta requests.

We do not process Platform Data for any other product, for Autorbix's own advertising, or to change Autorbix's core purpose without a new App Review submission.

4.2.3 Practices we prohibit (Meta Platform Terms §3)

We will not perform, or help others perform, the following with Platform Data:

• Discriminate or encourage discrimination based on race, ethnicity, colour, national origin, religion, age, sex, sexual orientation, gender identity, family status, disability, medical or genetic condition, or any other category prohibited by law or Meta policy.
• Make eligibility determinations about people for housing, employment, insurance, education, credit, government benefits or immigration status, or set the terms of those benefits, using Platform Data.
• Perform, facilitate or provide tools for surveillance, including processing Platform Data about people, places, groups or events for law-enforcement or national-security purposes.
• Sell, license or purchase Platform Data.
• Process Platform Data without valid user consent in order to build or augment user profiles for any purpose.
• Decode, circumvent, re-identify, de-anonymise, unscramble, unencrypt, reverse-hash or reverse-engineer Platform Data that Meta provides in protected form.
• Materially change Autorbix's core functionality or the scope of processing of previously collected Platform Data without first re-submitting the app and receiving Meta App Review approval.
• Process Platform Data for purposes other than the permitted purposes in Meta's Developer Docs for the APIs we use.

Restricted Platform Data (data that can identify a person or device, or that Meta designates as restricted) is requested only when it is necessary to meaningfully improve that person's experience in the specific Autorbix feature for which they or the dealership shared it, and only when it is clear why we need it.

4.2.4 How we share Platform Data

We share Platform Data only:

• With the dealership Client that authorised the connection, and with staff that Client invites, so they can work the lead or conversation.
• With subprocessors we use solely to host and operate Autorbix (for example infrastructure providers), under written terms that require them to process Platform Data only for us, only as we direct, and to delete it when they stop providing the service.
• When a person expressly directs us to share it, or when law or a binding governmental request requires it (we retain proof of the requirement).
• When Meta instructs us to update or delete it.

We do not sell Platform Data. We do not share it with other advertisers, data brokers, or unrelated Autorbix customers. Platform Data we hold for one dealership is kept separate from other dealerships. Location Data from our mobile apps is never mixed with Meta Platform Data or shared with Meta.

4.2.5 Tech Provider role (dealerships are our Clients)

Autorbix's Meta integration exists so that dealership Clients can use Platform Data in their own sales workflow. We process that data on behalf of and at the direction of the Client that connected the asset, not for Autorbix's own marketing and not for another Client.

• Each Client must comply with Meta's Platform Terms, Developer Policies, Community Standards, Advertising Standards, and any WhatsApp or Instagram terms that apply to their use.
• We will promptly notify a Client of a communication from Meta about a person's data-subject request that concerns that Client's Platform Data.
• We will promptly terminate a Client's use of Meta Products through Autorbix if Meta requests it because the Client has violated Meta terms or is harming Platform, Meta Products, Platform Data, or people who use Meta Products.
• We maintain Client contact details so we can cooperate with Meta reviews, audits and certifications described in the Platform Terms.

4.2.6 Lead Ads, messaging, Instagram and ads insights

• Lead Ads.We use lead-form answers only to create or update the dealership's Autorbix lead and to contact that person about the vehicle or offer on the form they submitted. We do not use lead-form data for unrelated marketing, eligibility scoring of the kinds Meta forbids, or transfer to anyone other than that dealership and its authorised staff.
• WhatsApp and Instagram Messaging.We contact people on those channels only when the dealership (or we, as its provider) has legally sufficient opt-in. People can opt out (including STOP on WhatsApp). We honour opt-out immediately. We do not send spam, do not use message tags or utility templates for promotions, do not collect payment-card numbers in chat, do not use messaging to sell digital goods, do not use it for healthcare provider–patient conversations or patient data, and we stay within Meta's 24-hour and template rules. Messaging data is used only as reasonably necessary to support the message types the dealership enabled.
• Instagram content.We display User Content only as the Instagram Platform and the content owner allow, as part of the dealership's connected workspace — not as a generic Instagram browser, backup tool or relationship manager.
• Ads insights.Campaign metrics are used only in aggregate (or as the Marketing API product terms allow) to assess that end advertiser's own Meta campaigns. We do not retarget with Meta advertising data, mix it into campaigns on other platforms, or build or augment user profiles from it. One advertiser's Meta ads data is not used to optimise another advertiser.
• Pages. We do not charge a fee to create or claim a Page, create Pages without consent, hide Page access from the people entitled to it, or disclose Page administrators to third parties without their consent.

4.2.7 Retention, deletion and Meta callbacks

Unless a longer period is required by law (in which case we keep proof of that requirement), we delete Platform Data as soon as reasonably possible when:

• It is no longer needed for the legitimate Autorbix purpose above.
• We stop offering the Meta feature that collected it.
• Meta asks us to delete it to protect users.
• A person or Client asks us to delete it, or the person or Client no longer has an Autorbix account (unless the data has been aggregated or de-identified so it cannot be tied to a person, browser or device).
• Meta ends our access or we disconnect the integration.

Anyone can request deletion at any time via autorbix.com/data-deletion or contact@heion.co. We also honour Facebook's in-product deletion request (Settings → Apps and Websites → Send Request) and Meta's User Data Deletion Request lists in the App Dashboard. If Platform Data is received in error, we report it to Meta, delete it, and provide proof if asked.

4.2.8 Security of Platform Data

We maintain administrative, physical and technical safeguards designed to prevent unauthorised processing of Platform Data, including encryption in transit, encrypted token storage, role-based access, and service-role isolation from the browser. We do not transfer, share or solicit Meta user IDs, access tokens or app secrets except with a subprocessor that helps us run Autorbix under the limits above. People can report a security issue to contact@heion.co; we address identified deficiencies promptly. If we become aware of unauthorised processing of Platform Data or an incident likely to compromise the systems that hold it, we notify Meta using Meta's incident form as soon as practicable and begin remediation.

4.2.9 Authentic use, support and unused Meta products

We operate Autorbix from an authentic developer account, keep App Dashboard and Business contact details current, and watch Developer Alerts sent from meta.com, fb.com and facebookmail.com. We do not confuse, deceive or spam people; we do not host malware; we obtain consent before publishing content on someone's behalf; and we provide support at autorbix.com/support. We do not buy or sell likes, followers, comments or similar engagement. We do not use Autorbix to circumvent a Meta enforcement action on another app or account.

Autorbix does not currently use Meta Games, Marketplace Platform, Commerce Platform, Live API, Social Plugins, Meta Payments, Instant Experiences, or Instant Games. We will not enable those products without updating this policy and completing any required App Review first.

4.3 Other processors

We rely on trusted service providers for hosting, analytics and session replay, communication (e.g. email, WhatsApp/SMS) and payments. These providers process data on our behalf under contractual confidentiality and security obligations. Location Data is not shared with these providers or any other third parties.

Product analytics and session replay are processed by PostHog, Inc. (US Cloud) on our instructions. Session recordings mask form inputs. We do not send vehicle identification numbers, one-time passwords, or full customer records to PostHog.

5. How We Share Information

We do not sell your personal information. Platform Data is shared only as described in Section 4.2.4. Other personal information is shared only:

• With service providers and processors who support the Service.
• With integrations you have connected, to enable the requested functionality.
• With other authorised users within your dealership account, according to the roles and permissions you configure.
• When required by law, regulation, legal process or enforceable governmental request.
• In connection with a merger, acquisition or sale of assets, subject to this Policy.

Location Data is not shared with any third parties.

6. Data Retention

We retain personal information for as long as your account is active or as needed to provide the Service, then delete or anonymise it within a reasonable period unless a longer retention is required by law. Meta Platform Data is retained and deleted under the shorter of this rule and Section 4.2.7. You can request deletion as described in Section 9 and on our Data Deletion page.

7. Cookies

We use strictly necessary cookies to operate the Service and optional analytics cookies to understand usage. You can control cookies through your browser settings; disabling some cookies may affect functionality.

8. Data Security

We implement administrative, technical and organisational safeguards such as encryption in transit, access controls and the principle of least privilege. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

9. Your Rights & Choices

Depending on your location, you may have the right to access, correct, export or delete your personal information, object to or restrict certain processing, and withdraw consent. You may also revoke location permission at any time in your device settings. To exercise these rights, contact us at contact@heion.co or use the Data Deletion page. This includes people who never created an Autorbix login but whose data we received through Meta Lead Ads, Instagram Messaging or WhatsApp. We will respond within the timeframes required by applicable law.

10. Children's Privacy

The Service is intended for business use and is not directed to individuals under 18. We do not knowingly collect personal information from children. We comply with applicable children's privacy laws, including COPPA where it applies. Dealerships must not use Autorbix or connected Meta products to target or collect data from children.

11. International Transfers

Heion Ventures Private Limited is based in India and may process data in India and other countries. Where required, we use appropriate safeguards for cross-border transfers.

12. Changes to This Policy

We may update this Policy from time to time. Material changes will be notified through the Service or by email, and the “Last updated” date above will be revised.

13. Contact Us

Questions about this Policy or your data may be directed to Heion Ventures Private Limited.

• Privacy: contact@heion.co
• Meta / social integrations: socials@heion.co
• Support: hello@autorbix.com
• Address: 22, Krishna Nagar, Imli Phatak, Jaipur 302005, India
• Public policy URLs for Meta App Dashboard: https://autorbix.com/privacy-policy, https://autorbix.com/terms-of-service, https://autorbix.com/data-deletion, https://autorbix.com/support

This Privacy Policy applies to the Google Play applications Autorbix and Sanghi Sales Essentials, and to related Autorbix web services operated by Heion Ventures Private Limited.