MaxERP Privacy Policy

At MERP TECHNOLOGIES L.L.C ("MaxERP", "we", "us", or "our"), we are committed to safeguarding personal data and maintaining transparent, secure information practices. This Privacy Policy explains how MaxERP collects, uses, retains, and protects personal data across our enterprise platform, including our core ERP modules, employee workflows, and our official Meta WhatsApp Business API integration.

1. Roles and Scope of Processing

MaxERP provides an all-in-one business management platform that enables businesses to manage human resources, payroll, operations, and customer communications.

• Customer Businesses as Data Controllers: When a business uses MaxERP to manage employee records, inventory, client invoices, or customer conversations, that business acts as the data controller determining the purposes and means of processing.
• MaxERP as Data Processor: MERP TECHNOLOGIES L.L.C processes data on behalf of and under the instruction of our customer businesses in accordance with our terms of service and applicable data protection agreements.

2. Official WhatsApp Business API Integration

Businesses can connect their own WhatsApp Business Account (WABA) to MaxERP using Meta's authorization flow. Authorized business users can manage customer conversations, send supported messages and attachments, and share business documents through their connected number. MaxERP processes the information needed to deliver those features and display message delivery information.

Categories of WhatsApp Data Processed

• Account Identifiers: Connected WhatsApp Business Account ID, phone-number identifiers, business display name, and connection status.
• Contact Information: Phone numbers, customer contact identifiers, and profile names provided through incoming or outgoing interactions.
• Message Content & Attachments: Inbound and outbound message text, supported media files (images, audio, video), shared business documents (such as invoices or receipts), timestamps, and delivery/read status.
• Template Definitions: Pre-approved message templates, language codes, and approval status synchronized with Meta.
• Credentials & Security Records: Securely stored tokens and authorization credentials used exclusively to communicate with Meta APIs, alongside operational logs needed for service reliability and security auditability.

3. Approved Retention Periods

MaxERP enforces policy-driven data retention schedules to ensure data is not kept longer than necessary for operational and compliance purposes:

• WhatsApp Message Text: Stored for 24 months from receipt or transmission, after which it is scheduled for routine cleanup and removal from active inboxes, subject to applicable legal-hold exceptions.
• WhatsApp Message Media & Attachments: Stored for 90 days from transmission, after which media files are scheduled for removal through routine cleanup routines, subject to applicable legal-hold exceptions.
• Raw Webhook Payloads: Retained for delivery verification and debugging, scheduled for removal after 7 days.
• Separately Retained Business Records: Business records generated through the platform (such as finalized invoices, accounting ledgers, and formal employment contracts) remain subject to their respective statutory retention requirements under applicable UAE laws and are not governed by inbox chat expiry.
• Disaster Recovery Backups: Encrypted backup snapshots are maintained for business continuity and are routinely overwritten according to standard retention lifecycles.

To submit a data deletion request or inquire about retained data, please review our Data Deletion Instructions or contact privacy@maxerp.ai.

4. Sharing and Third-Party Service Providers

We do not sell, rent, or trade personal data. We disclose personal information only to service providers that assist in delivering our platform services:

• Meta Platforms, Inc. / WhatsApp Ireland Limited: Facilitates message transmission, webhook delivery, and template approval via the WhatsApp Business API.
• Cloud Hosting, Edge Delivery & Data Infrastructure: Cloud infrastructure, application hosting, edge delivery, and database/storage providers utilized to host the platform services and securely store application data, operating with encrypted-at-rest and encrypted-in-transit protocols.
• Legal and Regulatory Authorities: We disclose data only where strictly required by binding court orders, applicable UAE statutes, or lawful governmental requests.

5. Employee Monitoring & HR Module Compliance

For organizations utilizing MaxERP's workforce management, shift scheduling, and time-tracking features:

• Transparency & Consent: We recommend obtaining written consent from employees before enabling device-based activity tracking. MaxERP provides clear indicators when time tracking or attendance sessions are active.
• Access to Tracked Information: Employees and administrators can review recorded timesheets and activity logs directly from their workspace. Accidental tracking of non-work tasks can be corrected in accordance with company policy.
• Respect for Boundaries: MaxERP collects only the data attributes configured by the employer for legitimate workplace management.

6. Data Subject Rights & Requests

In accordance with the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), the General Data Protection Regulation (GDPR), and applicable privacy laws, data subjects have the right to:

• Access personal data held about them and receive a description of processing.
• Request correction or rectification of incomplete or inaccurate records.
• Request deletion or erasure of personal data under eligible circumstances.
• Object to or request restriction of processing.
• Withdraw consent where processing was initiated based on consent.

To exercise any of these rights, please email privacy@maxerp.ai. If your request specifically concerns data held in connection with our WhatsApp integration or general platform storage, please follow our Data Deletion Instructions.

7. Disconnecting WhatsApp Integration

Disconnecting disables the WhatsApp connection in MaxERP. It does not automatically delete previously stored messages, media or business records. To request deletion of stored data, follow our Data Deletion Instructions or email privacy@maxerp.ai.

8. Security and Safeguards

MERP TECHNOLOGIES L.L.C implements industry-standard administrative, physical, and technical safeguards designed to protect personal and organizational data against unauthorized access, loss, alteration, or misuse. These measures include role-based access controls (RBAC) restricting data access to authorized personnel, SSL/TLS encryption for data in transit (HTTPS), encrypted database storage at rest, and secure, isolated token storage for third-party integration credentials.

9. Updates to this Policy

We may update this Privacy Policy periodically to reflect enhancements to our services, changes in applicable laws, or adjustments in our operational practices. Any revisions will be published on this page with an updated effective date.

10. Contact Us

If you have questions, feedback, or data privacy requests regarding this Privacy Policy or MaxERP's data practices, please contact our team:

MERP TECHNOLOGIES L.L.C
United Arab Emirates
Email: privacy@maxerp.ai