Data Protection & Security

For account, support, and billing records used to run Pinglo, Pinglo may act as a controller. For contacts, conversations, campaigns, and other workspace data a business adds, that business decides the purposes and means of processing; Pinglo processes that data on the business’s instructions as a processor. The public Privacy Policy and Data Processing Agreement explain these roles.

• Workspace access is authenticated and assigned according to account roles.
• Database access is scoped by account policies, with server-side checks for sensitive operations.
• Integration credentials are handled by server-side application code and protected configuration; do not share tokens or passwords with other users.
• HTTPS is used for public application traffic and provider API connections.
• Operational logs and monitoring help diagnose service and security issues. Access to customer data is limited to what is needed to operate and support Pinglo.

No internet service can guarantee absolute security. Customers should use strong unique passwords, limit team access, protect connected Meta accounts, and contact Pinglo promptly if they suspect a compromise.

Pinglo’s application is deployed through Vercel; authentication, database, and storage services are provided through Supabase. WhatsApp messaging connects to Meta’s WhatsApp Business Platform Cloud API. Paystack processes Pinglo subscription payments. Optional AI features send relevant prompts and conversation or knowledge context to the AI provider configured for that account. Providers may process data in other countries under their own terms and security practices.

Pinglo sends WhatsApp API requests directly to Meta’s Cloud API. Customers connect their own Meta business assets by providing the required WhatsApp Business Account, phone-number identifier, and access credentials in Pinglo settings. Meta hosts the Cloud API; Pinglo provides the CRM interface and workflow orchestration. Pinglo is not WhatsApp or Meta and does not control Meta’s account approval, message delivery, pricing, or enforcement decisions. See WhatsApp connection and usage details.

Customer content is retained while needed to provide the service and until it is deleted or an account request is completed, subject to legal, backup, and security-log retention needs. If Pinglo becomes aware of a security incident affecting customer personal data, Pinglo will notify the affected customer without undue delay and share reasonably available information, consistent with the DPA and applicable law.

Email pinglosupport@gmail.com with “Security report” in the subject. Include the affected account or page and steps to reproduce, but do not send passwords, access tokens, or sensitive customer data.