How BMexa protects your data

Your company controls its data

The company that signs up for BMexa (a builder or a channel partner firm) decides what goes into its account and who on its team sees it. BMexa processes that data on the company’s behalf; it does not sell it, show ads against it, or use it for anything other than running the product. Each company’s data is isolated at the database level from every other company’s.

Where it is stored

• The application and database run on AWS and Supabase in India (Mumbai region).
• Emails are sent through Resend; phone notifications through Expo, Firebase Cloud Messaging and Apple Push Notification service.
• WhatsApp messages go through Meta’s WhatsApp Cloud API, which may process data outside India.
• All traffic between your browser or phone and BMexa is encrypted.

Who sees what inside your company

• Roles and access profiles decide which menus and projects a person has; a sales executive sees their own clients, a manager sees their team, an admin sees everything. Access is enforced on the server, not just hidden in the menu.
• Data masking: when the company turns it on, people outside a client’s handling line see the mobile number as ••••••3797 and cannot copy it. Calls from the phone app still connect, and each one is recorded in the audit log.
• Reports and the Audience page never show phone numbers or emails. Exports that do are limited to admins and executives, and every export is written to the audit log with its row count.
• Admins have an Audit log and a Security log under Settings › Company settings: who changed what, exports, sign-ins and locks.

Sign-in and sessions

• Passwords are stored as a one-way hash; nobody at BMexa or in your company can read them.
• Ten wrong passwords or codes in 15 minutes lock the account for 15 minutes and email the person and the admins.
• Optional 6-digit sign-in codes on WhatsApp or email, with devices trusted for 30 days. See Sign-in security.
• Web sessions last 24 hours, phone sessions 30 days; Sign out everywhere ends them all.

Location, contacts and your phone

• Location is recorded only for staff, only when the company switches tracking on, only inside the person’s reporting hours on working days, after a consent screen on the phone. Readings are visible to the person’s managers and admins, never to the person’s peers, and are deleted after 90 days.
• BMexa does not read your contacts, call log or microphone, and has no access to your personal WhatsApp. Only business numbers the company connected through Meta’s Cloud API are read.
• WhatsApp alerts to staff mask the client’s phone and email (for example ******3210).

Retention and your rights

• Data is kept while the company uses BMexa and for 90 days after it leaves, then deleted or anonymised. Some records, such as invoices and receipts, may have to be kept longer by law.
• Anyone whose data is in BMexa can ask to see, correct or delete it, or withdraw consent: ask the company first, or use the form described in Deleting your data.
• A data breach is notified within 72 hours; changes to the terms are announced 30 days ahead.