Privacy policy
This policy explains what personal data Konvosa (“we”) collects, why, and the choices you have. Konvosa is software that businesses (“customers”) use to talk with their own customers. For the conversations a business holds in Konvosa, that business is the controller and we process the data on its behalf.
What we collect
- Account data: the name, email address, password hash and settings of people who sign in to Konvosa.
- Workspace content: conversations, messages, attachments, contacts, notes, tags and call recordings or voicemails that a customer receives or creates through its connected channels.
- Channel connections: the access tokens and account identifiers a customer authorizes when connecting email, WhatsApp, Instagram, Messenger, SMS or phone accounts. Tokens are stored encrypted.
- Technical data: IP addresses, browser type and logs needed to run, secure and debug the service.
Data from Meta platforms
When a customer connects a WhatsApp Business account, Instagram professional account or Facebook Page, Konvosa receives the messages, sender names and profile identifiers sent to that account, and the access token Meta issues. We use them only to show those conversations to the customer's team and to send the replies the team writes. We do not sell this data, use it for advertising, or share it with anyone except the processors below.
How we use data
- To provide the service: deliver, store, search and send messages, and run the automation a customer sets up.
- To keep the service secure and reliable, and to prevent abuse.
- To contact account holders about their account and the service.
Who we share it with
We use service providers that process data on our behalf under contract: cloud hosting and storage, email delivery, DNS and network protection, and telephony. Messages sent through a channel are, by their nature, passed to that channel's provider (for example Meta for WhatsApp). Call transcription runs on our own servers. We disclose data when the law requires it.
How long we keep it
Workspace content is kept while the customer's workspace exists. Deleted conversations stay in trash for 30 days and are then removed. A customer can set a retention policy that removes older conversations. When a workspace is deleted, its content and connection tokens are removed. Backups expire on a rolling schedule.
Your choices and rights
If a business uses Konvosa to talk with you, contact that business first; it controls your data. You can also write to us at privacy@konvosa.com to access, correct, export or delete your data, or to object to its processing. See data deletion for the steps.
Security
Data is encrypted in transit, credentials are encrypted at rest, and access inside Konvosa is limited by roles and permissions.
Changes
We will post changes to this policy here and update the date above.