Privacy Policy

Convoza provides a WhatsApp AI CRM and hybrid automation platform for businesses. This policy explains our handling of information received from businesses, their authorized workspace users, customers who communicate through WhatsApp, and visitors to our public marketing and application pages.

Depending on how the service is used, we may process:

• Business and account data: workspace name, authorized-user details (name, email, role), account settings, catalog and product information, business policies, FAQs, order workflows, and subscription or billing records.
• Customer and conversation data: WhatsApp phone number or platform identifier, profile name when provided, message text, media metadata, timestamps, language, conversation history, tags, custom fields, pipeline status, opt-out preferences, and support notes.
• Sales and service data: product interests, cart or order details, delivery information, payment references or status supplied during a conversation, and human-support notes. We do not ask customers to send full card numbers, passwords, or authentication codes.
• Technical data: service logs, request identifiers, error and security events, browser information for web access, and usage metrics needed to operate and protect the service.

When a customer messages a participating business on WhatsApp, Meta sends the message and related metadata to Convoza through the WhatsApp Business Platform. We process it to understand the request, retrieve relevant business knowledge, generate or select a response, maintain conversation context, assist with sales or support workflows, and transfer the conversation to a human team member when appropriate.

Messages may be sent back through Meta’s platform on the business’s behalf. WhatsApp and Meta also process information under their own terms and privacy policies.

Convoza combines automated business rules, business-provided knowledge bases, and third-party AI models. Relevant message content and limited conversation context may be sent to an AI provider to classify intent or draft a response.

AI output may occasionally be inaccurate, so businesses remain responsible for reviewing important decisions, and customers may request human assistance at any time. We do not use customer conversations to train our own general-purpose AI models. AI providers process submitted data under their service terms and our contractual arrangements.

We use information to provide and improve the requested service, respond to users, process transactions and workflows, prevent fraud and abuse, secure accounts, comply with law, and enforce our terms.

Depending on the context and applicable law, processing is based on performance of a contract, legitimate interests in operating a safe service, compliance with legal obligations, or consent. A participating business acts as controller of its customer data while Convoza acts as its service provider or processor.

Information may be stored on systems operated by Convoza and vetted hosting, database, messaging, AI, monitoring, and support providers. Data may be processed in countries other than the user’s country, with protections used where required by law.

We use reasonable technical and organizational safeguards including workspace isolation, per-user session validation, HMAC-SHA256 webhook signature verification, encrypted network transport, secret management, logging controls, and restricted administrative access. No internet service can guarantee absolute security.

We disclose information only as needed to service providers acting for us, to the participating business whose customer initiated the conversation, during a lawful business transfer, to protect rights or safety, or when legally required. We do not sell personal information.

We retain information only as long as reasonably necessary to provide the service, maintain security and business records, resolve disputes, enforce agreements, and meet legal obligations. Retention varies by data type, account configuration, and applicable law.

Conversation and operational records are deleted or anonymized when no longer needed, subject to backups that expire through normal rotation and legally required retention.

Subject to applicable law, users may request access, correction, deletion, restriction, portability, or objection to processing, and may withdraw consent where processing relies on consent. We may verify identity and direct a customer request to the relevant participating business when that business controls the data.

Users may opt out of marketing or automated follow-ups by replying STOP on WhatsApp, asking the business or human agent to stop, or emailing us. Operational messages needed to complete a requested transaction may still be sent.

See our Data Deletion page for detailed step-by-step instructions. Users may also complain to their local data-protection authority where that right applies.

The service is intended for businesses and customers able to enter lawful transactions and is not directed to children under 13. We may update this policy as the service or law changes. Material changes will be posted here with a revised effective date.