Privacy Policy

Last updated: 26 February 2026

1. Who we are

Airwave Inbox is operated by API Boutique Limited, a company registered in England and Wales. When this policy refers to "we", "us", or "our", it means API Boutique Limited.

For data protection queries, contact us at support@airwaveinbox.com.

2. What this policy covers

This policy explains how we collect, use, store, and share personal data when you:

  • Visit our website at airwaveinbox.com
  • Use the Airwave Inbox dashboard at dashboard.airwaveinbox.com
  • Send messages to a radio station that uses Airwave Inbox (as a listener)
  • Connect a third-party channel (e.g. WhatsApp Business) to Airwave Inbox

3. Data we collect

3.1 Station users (producers, presenters, admins)

  • Account data: email address, name, password (stored securely), role
  • Session data: authentication and session identifiers
  • Usage data: actions taken within the dashboard (e.g. messages triaged, queue changes)

3.2 Listeners (message senders)

  • Message content: text, images, audio, and video sent via WhatsApp, SMS, or email
  • Sender identifiers: phone number, email address, or profile name
  • Message metadata: timestamp, channel type, delivery status
  • AI-derived data: sentiment and intent categorisation generated automatically from message content

3.3 Website visitors

  • Waitlist data: email address (if you sign up for early access)
  • Bot protection: security tokens used to prevent automated abuse (no tracking cookies)

4. How we use your data

Purpose Legal basis (UK GDPR)
Delivering and operating the Airwave Inbox service Performance of a contract
Routing listener messages to the correct radio station Legitimate interest of the station (data controller)
AI sentiment and intent classification of messages Legitimate interest (improving producer workflow)
Sending transactional emails (invites, password resets) Performance of a contract
Waitlist communications Consent (double opt-in)
Preventing abuse and ensuring security Legitimate interest

5. Data processors and third parties

We use trusted third-party services to operate Airwave Inbox, including:

  • Infrastructure and hosting providers — for storing and processing service data (EU data residency)
  • Messaging channel providers — for delivering and receiving WhatsApp, SMS, and email messages
  • Audio transcription providers — for converting voice notes to text

We do not sell personal data to any third party. We do not use personal data for advertising. A full list of sub-processors is available on request by emailing support@airwaveinbox.com.

6. Data controller vs data processor

For station user accounts, API Boutique Limited is the data controller.

For listener messages, the radio station using Airwave Inbox is the data controller. API Boutique Limited acts as a data processor, processing messages on the station's behalf. Listeners should refer to their radio station's own privacy policy for details on how their messages are handled.

7. WhatsApp and channel data

When a radio station connects their WhatsApp Business Account to Airwave Inbox, we receive and process messages sent by listeners to that station's WhatsApp number. This data is processed in accordance with Meta's platform terms and the station's instructions as data controller.

We store message content, sender information, and media attachments to provide the inbox service. All data is stored within the EU.

8. Data retention

  • Listener messages: retained according to the station's configured retention period (default 90 days), then permanently deleted
  • Station user accounts: retained while the account is active; deleted upon request
  • Waitlist emails: retained until you unsubscribe or the waitlist is closed
  • Audio transcriptions: retained for the same period as the parent message

9. Data security

All data is transmitted over encrypted connections. Data at rest is encrypted. Passwords are securely hashed and never stored in plain text. Access controls ensure station users only see data for their own station.

10. Your rights (UK GDPR)

You have the right to:

  • Access your personal data
  • Rectify inaccurate data
  • Erase your data ("right to be forgotten")
  • Restrict processing in certain circumstances
  • Data portability — receive your data in a machine-readable format
  • Object to processing based on legitimate interest
  • Withdraw consent at any time (where consent is the legal basis)

To exercise any of these rights, email support@airwaveinbox.com. We will respond within 30 days.

We support data erasure requests and will permanently delete your data upon request.

11. Cookies

Airwave Inbox uses only essential cookies required for authentication and session management. We do not use analytics cookies, advertising cookies, or third-party tracking.

12. Data deletion callback

If you connected a Facebook or WhatsApp account to Airwave Inbox and wish to have your data deleted, you can request deletion by emailing support@airwaveinbox.com. We will confirm deletion within 30 days.

13. Changes to this policy

We may update this policy from time to time. Material changes will be communicated via email to registered station users. The "last updated" date at the top reflects the most recent revision.

14. Contact

API Boutique Limited
Email: support@airwaveinbox.com
Website: airwaveinbox.com