PRIVACY POLICY
Privacy Policy
What Cosalyx collects, why, who it reaches, and how to get it back or have it deleted.
01 Who we are
Cosalyx is operated by MATalogics, a sole proprietorship registered in Lahore, Punjab, Pakistan. In this policy “we” means MATalogics trading as Cosalyx. Write to [email protected] with anything.
Two different roles
We are the controller of what you give us to run your own account: your name, your billing details, how you use the product.
We are a processor of everything you bring into Cosalyx about your own customers: their contact details, your conversations, your team’s notes. That data is yours. We act on your instructions, we do not sell it, and we do not use it to train anything.
02 What we collect
From you, at signup
Name, email address and phone number
Business name, and the sub-accounts you create under it
A password, stored as a hash; we cannot read it back
Billing details, held by our payment provider; we never see a full card number
From how you use Cosalyx
The records you create: contacts, leads, opportunities, tasks, appointments, notes, tags
Files you put in the media library
Messages sent and received on any channel you connect
Technical logs: IP address, browser, timestamps, kept for security and for fixing faults
From services you choose to connect
Nothing here is collected unless you turn the integration on. Disconnecting it stops the collection immediately.
WhatsApp Business Platform (Meta). The number and display name of your account, the phone numbers of people who message it, their WhatsApp profile name, and the content exchanged: text, images, documents, delivery and read receipts.
Meta Lead Ads. Whatever someone submits to your lead form, plus which form, page and campaign it came from.
Google. When you connect a Google account to Gmail, Sheets, Drive, Docs, Slides, Calendar, Forms, Meet or YouTube, you grant on Google’s own consent screen only the access that app needs. We use it only to do what you set up: the steps in your workflows, such as adding a row to the spreadsheet a workflow names or sending an email you wrote, and the lists you pick from while building one. We do not browse, copy or keep the rest of your Google data.
Cosalyx’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
03 How we use it
To run the product: your pipeline, your messages, your calendar
To tell your account apart from everyone else’s
To send service email: password resets, receipts, security notices
To investigate faults, abuse and security incidents, and to meet legal obligations
What we will never do
Sell your data. Hand it to advertisers. Train a model on the contact data you bring into Cosalyx. Where a feature is described as AI, it produces output for you, inside your own account, from your own data. Nothing more.
04 WhatsApp and Meta data
Connecting a WhatsApp Business number makes Cosalyx your technology provider on the WhatsApp Business Platform. We hold access to it on your behalf; Meta issues the account to your business, not ours.
The account stays yours
Disconnecting WhatsApp in Cosalyx removes our access immediately and tells Meta to stop sending us your messages. The number itself was never ours to give back; it was always registered to you.
Messages to and from your number are stored so your team can see the full conversation history
Access tokens issued by Meta are encrypted at rest, never shown in the interface, not even to the person who connected them
Meta processes the messages themselves under its own policies, and bills you directly for conversations; that billing relationship is between you and Meta, not routed through us
Your existing conversation history stays in your account after you disconnect, unless you delete it yourself
You are responsible for having a lawful basis to message the people you message, and for honouring opt-outs. See the Acceptable Use Policy.
05 Who we share data with
Only the providers needed to run Cosalyx, only as much as each one needs, and each one bound to protect it. The current list (who, what they can see, and where) is on the sub-processors page, so this is checkable rather than taken on trust.
We will also disclose data where the law requires it, or to protect our rights or safety. If Cosalyx is ever sold or merged, your data may transfer to the acquirer. You would hear about it before it happened, and this policy would keep applying.
06 Where your data is stored
Cosalyx is hosted in Singapore. Your records, files, and backups all sit there. If you are outside Singapore, using Cosalyx means your data is transferred there and processed there. Where local law requires a transfer mechanism, we rely on your consent and on contractual protections with our providers.
07 How we protect it
Traffic is encrypted in transit with TLS
Passwords are hashed and never stored in a readable form
Every record is scoped to its workspace and sub-account, enforced on every read, not just at the edge
Access to production systems is limited to the people who need it
Integration tokens
WhatsApp, Meta and Google tokens are encrypted at rest with a key held separately from the database. Losing the database alone is not enough to read them.
No system is perfectly secure and we will not claim otherwise. If we find a breach affecting your data, we will tell you promptly, and explain what happened and what we are doing about it.
08 How long we keep it
While your account is open: kept so the product works.
After you close it: deleted within 30 days, except what we must keep for a legal or tax obligation.
Backups: encrypted copies of deleted data may persist for up to 90 days before they expire on their own.
Billing and tax records: kept as long as Pakistani law requires.
09 Your rights
You can ask us to give you a copy of your data, correct it, delete it, limit how we use it, or export it.
Most of this you can do yourself inside the product. For anything else, write to [email protected] and we answer within 30 days. See Data Deletion for the deletion route specifically.
If a business holds your data, not you
Someone who messaged a Cosalyx customer on WhatsApp is not our customer; that business controls their data, not us. Contact them directly. If you reach us instead, we will forward your request and confirm we did.
10 Cookies
A small number, none of them advertising. Details are on the Cookie Policy page.
11 Children's data
Cosalyx is a business tool, not intended for anyone under 18. We do not knowingly collect data from children. If you believe a child has given us personal data, write to us and we will delete it.
12 Changes to this policy
The date at the top always reflects the current version. For a change that materially affects your rights, we email account owners at least 14 days before it takes effect; we do not change it quietly and rely on you to notice.
Questions about this document?
Write to [email protected] and we will answer. Cosalyx is operated by MATalogics, Lahore, Pakistan.