Convomatic – Privacy Policy

This summary gives the key points of this policy. Each point is explained in full in the sections below.

• What do we collect? Your account details, your team's details, the business accounts you connect, and the contacts, messages and orders you keep in Convomatic. See section 3.
• Do we process sensitive information? No. We do not ask for or knowingly process sensitive personal information.
• Do we sell your information? No. We never sell personal information, and we do not use a business's contacts or conversations to advertise or to train AI models.
• Who do we share it with? Only with the providers that help us run Convomatic (such as Meta, Google, Anthropic, DigitalOcean and Cloudflare), with services you connect yourself, or when the law requires it. See section 7.
• How do we keep it safe? HTTPS everywhere, encrypted access tokens and role-based project access. See section 11.
• What are your rights? You can see, correct and delete your information, and withdraw consent. See sections 9 and 10.

Convomatic (https://convomatic.com) is a WhatsApp Business software platform for marketing, automation and customer support. It is operated by Lumoonix Innovation Private Limited, a company registered in India ("Convomatic", "we", "us" or "our").

Convomatic gives businesses broadcasts, a drag-and-drop flow builder, an AI agent, a shared team inbox, commerce, payments and appointments, all on the WhatsApp Business Account the business owns. It is built on Meta's official WhatsApp Business Cloud API.

This policy explains what information we collect when you visit our website or use the Convomatic app, why we collect it, who we share it with and the choices you have. If you do not agree with this policy, please do not use our services.

We play two different roles, depending on whose information it is.

• Controller for your account. For your own account (your name, your email and how you use the app) we decide how the information is used.
• Processor for a business's customers. For the contacts and conversations a business keeps in Convomatic, that business decides how the information is used. We process it on the business's behalf and only on its instructions.

Information you give us

• Account details. Your name, email address and profile picture. Sign-in is handled by Google Firebase Authentication. If you use a password we never see or store it. If you sign in with Google we receive only your name, email and picture.
• Team details. The names, email addresses and roles of the people you invite to a project.
• Business connections. When you connect WhatsApp, Meta ads, a product catalogue, Shopify or Razorpay, we keep the account IDs and access credentials those services issue, so we can act for you.
• Customer data. Contacts you add or import (names, phone numbers, tags and attributes), the messages and media you send and receive, notes, orders and bookings, and the templates, flows and campaigns you build.
• Support and sales. What you tell us when you email or message us.

Information collected automatically

• Usage and device data. IP address, browser, the pages you open and the actions you take. This is recorded in server logs and used to run, secure and fix the service.
• Analytics. Our website and the app use Google Tag Manager and Google Analytics to count page views. In the app, record IDs are removed from page addresses before they are sent. Pages that customers open from a message link, such as order tracking or an address form, do not load analytics.
• Cookies and local storage. Used to keep you signed in, remember your current project and, through Google Analytics, tell visits apart. You can block analytics cookies in your browser and the app still works.

Information about a business's customers, collected for that business

• WhatsApp messages. Messages, media and delivery receipts that Meta passes to us for the business's number.
• Link clicks. When a customer taps a tracked link in a message, we record the click against that message before sending them on.
• Store events. If the business connects a Shopify store, the store sends us shopper events such as product views, carts and checkouts, tagged with a visitor identifier, so the business's automations can follow up.
• Forms. Details a customer types into a form the business sends them, such as a delivery address.

We process your information only when we have a valid reason to do so. We use it to:

• Provide the service: send messages, run flows and campaigns, and show the conversations and reports you ask for.
• Create and secure your account, including detecting abuse and access that nobody authorised.
• Answer support requests, and tell you about changes to the service, your plan or our terms.
• Bill for paid plans and keep the records that tax law requires.
• Understand which parts of the product are used, through counts and totals, so we can improve it.
• Meet our legal obligations and enforce our terms.

Convomatic is built on Meta's official WhatsApp Business Cloud API. Every message a business sends or receives passes through Meta, which processes it under its own terms and privacy policy. We are an independent software provider. We are not part of Meta, and we are not affiliated with or endorsed by Meta.

When you connect with Facebook Login, we ask only for the permissions a feature needs: managing your WhatsApp Business Account and message templates and, if you use them, your ad accounts, Pages and product catalogues. We use what we receive only to provide those features to you. We do not sell it, use it for our own advertising, or share it beyond the providers listed in this policy.

The access tokens Meta issues to us are encrypted at rest (AES-256-GCM) and are used only from our servers.

You can remove our access at any time from your Facebook settings, under Business Integrations, or by disconnecting the account inside Convomatic.

Your WhatsApp Business Account is created in your own business name. Meta bills you directly for conversations at its published rates. We do not resell message credits.

AI agent

The Convomatic AI agent answers customers from the knowledge a business gives it: website pages, files, FAQs and products. To make that knowledge searchable, its text is sent to Google's Gemini service, which turns it into search data that we keep on our own servers. Customer questions are sent to the same service so they can be matched against that data.

When the AI agent replies, the customer's message, the last two hours of that conversation, the best-matching passages and the business's product list are sent to an AI language model, which writes the reply. Depending on the project's setting, that model is Google's Gemini or Anthropic's Claude.

Questions the agent could not answer are saved for the business to review. Answers to repeated questions are stored so they can be reused.

Inbox writing tools

The inbox has optional tools that suggest replies, summarise a chat or translate a message. They run only when a team member uses them. They then send the text of that conversation to the same AI language models to produce the result.

We share information only with providers that help us run Convomatic, with services you connect yourself, or when the law requires it. Our providers process it on our instructions:

• Meta Platforms. WhatsApp messaging, Facebook Login, ads and product catalogues.
• Google. Firebase Authentication for sign-in, Google Tag Manager and Google Analytics for analytics, and Gemini for the AI agent and the inbox writing tools.
• Anthropic. Claude models for the AI agent and the inbox writing tools, when a project uses them.
• DigitalOcean. The cloud servers that host the app and its database.
• Cloudflare. Storage for the images, videos and documents uploaded to the app.

Services you connect

When you connect Shopify, Razorpay, PayU, Google Sheets, a webhook or our API, information moves between Convomatic and that service because you set it up. That service's own terms cover what it receives. Payments made through a payment link are collected by the payment provider. We never receive card, UPI or bank details.

Legal and business transfers

We may disclose information when a law, court order or government authority requires it, to protect the rights and safety of our users or the public, or as part of a merger or sale of our business. In a merger or sale, this policy continues to apply to the information.

International transfers

Some of these providers store data outside India. Where they do, we rely on their contractual commitments to protect it.

• We keep account and project data while your account is open, because the service needs it.
• Contacts and messages stay in a project until you delete them or delete the project.
• When you close your account, or ask us to delete it, we delete your account and project data within 30 days.
• Invoices and billing records are the exception: we keep them for as long as Indian tax and company law requires.
• Server logs are kept only as long as we need them to keep the service secure and fix problems.

You can ask us to delete your data at any time. This section is also our data deletion instructions for Facebook Login.

If you have a Convomatic account

• Step 1. Email info@convomatic.com from the address on your account, with the subject "Delete my data".
• Step 2. Say whether you want your whole account deleted or a single project.
• Step 3. We confirm the request, may ask you to verify it, and delete the data within 30 days. We email you when it is done.

To remove our access to your Facebook data, open your Facebook settings, go to Business Integrations, select Convomatic and choose Remove. That stops further access. To delete what we already hold, also email us as above.

If you are a customer of a business that uses Convomatic

Reply STOP or UNSUBSCRIBE to the business's WhatsApp number to stop its marketing messages, and ask the business to delete your details. You can also email us with your phone number and the business's name. We will pass the request on and help the business act on it.

Under India's Digital Personal Data Protection Act, 2023, and any other law that applies to you, you can ask to:

• See the personal information we hold about you and how it is used.
• Correct or update information that is wrong or incomplete.
• Delete your information, or withdraw a consent you gave.
• Nominate someone to use these rights for you if you cannot.
• Complain to us, and then to the Data Protection Board of India if you are not satisfied with our answer.

Email info@convomatic.com to use any of these rights. We reply within 30 days. You can also change most account details yourself in the app.

• Every connection to Convomatic is encrypted with HTTPS.
• Access tokens and keys for WhatsApp, Meta ads and connected services are encrypted at rest.
• Passwords are held by Google Firebase, not by us.
• A project's data is visible only to the people its owner invites, according to the role each person is given.

We use a small number of cookies and local storage entries:

• Essential. Keep you signed in and remember your current project. The app does not work without them.
• Analytics. Google Analytics cookies that count visits and tell them apart. You can block them in your browser and the app still works.

We do not use advertising cookies in the app, and pages that customers open from a message link do not load analytics.

Convomatic is a tool for businesses and is not meant for anyone under 18. We do not knowingly collect information from children. If you believe a child has given us personal information, email info@convomatic.com and we will delete it.

When we change this policy, we update the "Last Updated" date on this page. If a change materially affects how we use your information, we tell account owners by email or in the app before it takes effect.