1. Introduction & Overview
Welcome to Convoos (convoos.si). We are committed to protecting your personal data and respecting your privacy rights. Convoos provides enterprise-grade AI social media engagement, Meta Lead Ads ingestion, official WhatsApp Business API automation, and omnichannel messaging solutions.
This Privacy Policy explains how Convoos collects, processes, protects, and discloses personal data when you visit our website, register for an account, connect third-party platforms (such as Meta, WhatsApp, Instagram, Shopify), or use our APIs and messaging services.
2. Data Controller & Processor Roles
Under Regulation (EU) 2016/679 (General Data Protection Regulation - GDPR):
- Data Controller: Convoos operates as a Data Controller for our direct customers' account credentials, billing details, analytics, and website interaction data.
- Data Processor: Convoos operates as a Data Processor on behalf of our business clients when ingesting, routing, automating, and transmitting messages sent to and received from our clients' end users over WhatsApp, Instagram Direct, and Threads.
3. Information We Collect
We collect information in the following categories:
- Account & Contact Data: Full name, company name, corporate email address, WhatsApp business telephone number, and hashed passwords.
- Meta & WhatsApp API Credentials: Meta App IDs, System User Access Tokens, WhatsApp Business Account (WABA) IDs, Phone Number IDs, and Webhook verification tokens.
- Communication Content: Message text, customer quick-reply choices, order identifiers, and media links transmitted through customer conversational flows.
- Technical & Telemetry Data: IP addresses, browser user agent, message delivery receipts, read status indicators, and performance latency logs.
4. How We Use Your Data
Convoos uses the collected data strictly to:
- Deliver, maintain, and optimize our WhatsApp automation and unified inbox services.
- Process incoming Meta Lead Ads webhooks and dispatch messages via BullMQ and RabbitMQ queues.
- Train and tune custom-knowledge AI agents exclusively within your private workspace.
- Comply with legal obligations, anti-abuse policies, and official WhatsApp Business terms.
5. WhatsApp Business API & Meta Compliance
We never sell your customer lists, broadcast recipients, or message records to advertisers or third parties. All WhatsApp interactions are transmitted via encrypted HTTPS TLS 1.3 connections directly to Meta’s Cloud API infrastructure.
6. Legal Basis under GDPR
We process personal data under the following GDPR legal bases:
- Performance of a Contract (Art. 6(1)(b)): To deliver our SaaS messaging platform per our Terms of Service.
- Legitimate Interests (Art. 6(1)(f)): To safeguard infrastructure against fraud, abuse, and security threats.
- Legal Compliance (Art. 6(1)(c)): To maintain tax, accounting, and regulatory records.
7. Third-Party Subprocessors
Convoos engages selected third-party subprocessors who adhere to strict data processing agreements:
- Meta Platforms Ireland Ltd: WhatsApp Cloud API & Instagram Graph API transport.
- Cloud Hosting (EU Region): Encrypted PostgreSQL, Redis, and compute nodes hosted within the EU.
- Resend: Transactional system notification emails and security alerts.
8. Data Retention & Deletion
We retain personal data only for as long as necessary to fulfill the purposes outlined in this policy or as required by law. When an account is terminated, client message histories and workspace configurations are permanently purged from active databases within thirty (30) days.
9. Security & Encryption Standards
Convoos enforces defense-in-depth security measures:
- End-to-end transport encryption via TLS 1.3 for all web and API traffic.
- AES-256 encryption at rest for database volumes, backups, and secure token vaults.
- Strict role-based access control (RBAC) and audited administrative authentication.
10. Your Rights & Subject Requests
Under EU data protection legislation, you are entitled to:
- Request access to and a portable copy of your personal data.
- Request rectification of incorrect or incomplete data.
- Request erasure of your personal data ("Right to be Forgotten").
- Object to or restrict specific processing operations.
11. Contact & Data Protection Officer
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please reach out to our Data Protection Officer: