Privacy Policy

Conversaa (“Conversaa”, “we”, “us” or “our”) provides a business messaging, booking and customer-service platform with AI assistance across WhatsApp Business, Instagram, Messenger and a private web concierge (the “Service”), available at conversaa.in. Businesses use the Service to answer their customers on WhatsApp, on Instagram (direct messages and comments), on Facebook Messenger, and in a private web chat on our website that we call the Private Concierge. AI helps draft and send replies. Businesses can also use the Service to take bookings and payments, send passes and check guests in, run loyalty rewards, keep customer records, and send reminders and offers.

This Policy covers two groups of people: (a) the people who use Conversaa for a business — owners, staff and the people they invite; and (b) the customers of those businesses, and other members of the public, whose information reaches us when they message, comment on, book with or pay a business that uses Conversaa.

This Privacy Policy explains what personal data we process, why, the legal bases we rely on, who we share it with, how long we keep it, how we protect it, and the rights you have. It is written to meet the requirements of the EU and UK General Data Protection Regulation (GDPR / UK GDPR), the California Consumer Privacy Act as amended by the CPRA (CCPA/CPRA), India’s Digital Personal Data Protection Act, 2023 (DPDP Act), and other applicable data-protection laws.

By using the Service you acknowledge this Policy. If you do not agree with it, please do not use the Service.

Data protection law distinguishes between a “controller” (who decides why and how data is processed) and a “processor” (who processes data on the controller’s instructions). Our role depends on the data:

• Data about business users. For the people who sign up for, administer or work in a Conversaa account, and for people who contact us directly, we are the controller. This covers account, sign-in, team, billing and support data, and the security records we keep about use of the Service (see Personal data about business users).
• Data about a business’s customers. When a business uses the Service with its own customers, that business is the controller of its customers’ personal data, and we act as a processor on the business’s documented instructions. This covers messages and comments on WhatsApp, Instagram, Messenger and the Private Concierge; bookings, booking-form answers, guest lists, passes, check-ins and guest photos; booking payment records; loyalty records; customer profiles, tags and notes; and anything the Service learns from those conversations (see Customer data we process for businesses). The business is responsible for having a lawful basis, for obtaining any opt-in or consent that is needed, and for giving its customers its own privacy notice.
• Booking payments. A business that takes payment for bookings connects its own Razorpay account. Razorpay processes those payments for the business under Razorpay’s own terms. We create the payment link and receive Razorpay’s payment notifications on the business’s behalf, as its processor.
• Our own security and service operations. We also use limited customer data for our own purposes, as a controller: safety checks on incoming messages, preventing abuse and rate limiting, and the records we keep to monitor AI cost, quality and reliability. We rely on legitimate interests for this and do not use it for anything else.

Where we act as a processor, our processing is governed by a Data Processing Addendum (DPA). A copy of our standard Data Processing Addendum, with EU Standard Contractual Clauses annex (controller-to-processor), is available from privacy@conversaa.in within 5 business days of request.

If you are a customer of a business that uses Conversaa, that business’s own privacy notice explains how the business uses your information. This Policy explains what we do with it on the business’s behalf.

This section covers the people who use Conversaa for a business. For this data we are the controller.

a. Information you give us

• Account data: name, work email address, mobile number, business/organization name, role, preferences, and a password if you choose to set one (stored only as a secure hash). You can also sign in with a one-time code sent by SMS or email, or with Google.
• Google Sign-In: if you sign in with Google, we receive your Google account ID, email address, name and a link to your Google profile picture. We ask Google only for basic profile access.
• Profile picture: a photo you upload for your account.
• Team invitations: the email address of the person invited and who invited them. Invitation links expire after 7 days.
• Owner controls on WhatsApp: if your business manages Conversaa by messaging it on WhatsApp, we keep your WhatsApp number so we can recognize you, a hashed PIN, and the instructions you send. While that chat is locked, everything you send in it, including your PIN, is blanked before it is stored. Your instructions are read by an AI model to work out what you are asking. Photos, posters and files you send there can be saved to your media library; posters and captions are read by Google Gemini to fill in promotion details. The first 120 seconds of a voice note you send there are turned into text by OpenAI, and the temporary audio files are then deleted.
• Business profile & knowledge base: information you add so the AI can answer accurately — business hours, products, services, prices, policies, FAQs, offers, and custom instructions.
• Website import: if you ask us to learn from your website, we read up to 500 of its public pages and may import up to 30 of its images. Our crawler identifies itself as “ConversaaBot” and respects robots.txt. If you turn on automatic refresh, we read the site again every 24 hours. Website pages may contain personal data, such as staff names or contact details.
• Teaching material: chat text, TXT or PDF files, or chat screenshots that you upload to teach the assistant. You must confirm you are allowed to use them. Screenshots are sent to an AI provider to be turned into text. We do not keep the uploaded file. Phone numbers and email addresses are removed from the text, and you review it before anything is saved.
• Showcase profiles: details and up to 5 photos of people your business features, such as stylists, doctors, artists or trainers, together with your confirmation that everyone pictured has consented. Showcase profiles are shown to your customers and used by the AI to answer questions.
• Promotional images: reference photos you upload so the AI can create posters and other promotional images. We remove their metadata and store them privately, and you confirm you have the rights to use them. They are sent to OpenAI or Google to generate the images.
• Billing data: billing name and address, GSTIN, invoices, and payment records (payment reference, method, amount and status). Card, bank and UPI details are entered on Razorpay’s checkout and are not stored by us.
• Connections: when you connect WhatsApp, Instagram or a Facebook Page, we store the account or page IDs and names and an access token, kept encrypted. If you connect Google Analytics, we store the Google account email, the property you choose and encrypted access tokens. If you connect Razorpay for bookings, we store your Razorpay key ID, and your key secret and webhook secret encrypted; disconnecting Razorpay marks this record as deleted.
• Support & communications: messages you send us. If you use the contact form on our website, your name, email, company, phone number and message are emailed to our team; they are not stored in our database.

b. Information collected automatically

• Security and audit records: when you take an action that we record in our audit log (for example a change to settings, the team or a connection), we store your IP address and browser user agent with that record. We also use IP addresses for a short time to limit abuse (rate limiting).
• AI request records: for each AI request we record the model used, tokens, cost, response time, confidence score, the knowledge entries used, and a copy of the customer message the AI was answering. We use these to monitor cost and quality and to show you reports.
• Error reports and server logs: technical details of errors, and performance timings, sent to Sentry from our servers (and from your browser, if we switch browser error reporting on) as described in Artificial intelligence and sub-processors, and server logs. Passwords, tokens and other secrets are removed before logs are written.
• Cookies and browser storage: strictly necessary cookies and browser storage that keep you signed in and make the Service work (see Cookies and browser storage).

We do not use product analytics, advertising pixels or IP-based location lookups on our website or dashboard.

This section describes information about a business’s customers that passes through the Service. We process it on the business’s behalf, as described in Our role, and yours. Which parts apply depends on the features the business uses.

a. Messages and comments

• Who you are on each channel: on WhatsApp, your phone number and WhatsApp profile name; on Instagram, your Instagram user ID, username and name; on Messenger, your page-specific ID and first and last name. We receive these from Meta.
• Message content: text, reactions and replies, and images, audio, video and documents you send. Media sent over WhatsApp, Instagram or Messenger stays on Meta’s systems; we keep Meta’s reference to it rather than a copy.
• Message details: timestamps, delivery and read status, message IDs, and the original message data Meta sends us, which we keep with each message.
• Instagram comments: the comment text, the commenter’s username and ID, the post it was left on, and any public reply or private reply the business sends. The AI can draft replies to comments for the business.
• Instagram post links: when you reply to or share one of the business’s posts or stories, we record which post or story started the conversation, and may link it to a later booking, so the business can see which posts lead to bookings.
• Working notes: conversation status, tags, notes, assignments and scheduled follow-ups created by the business’s team.

b. Bookings, payments and passes

• Booking details: the booker’s name, email address and phone number; the date and time, party size and type of entry; answers to the questions the business asks on its booking form (these can include free text); acceptance of the business’s terms; amounts, invoice numbers and booking status. If a slot is full, a customer can join a waitlist.
• Guests: the names and email addresses of guests that a booker adds. The booker should only add people who agree to this. A guest with an email address receives their own pass by email.
• AI help: the AI can pre-fill booking-form answers from details the customer already gave in the chat, and can prepare a quote with the customer’s name and the items quoted.
• Payments: payment links are created on the business’s own Razorpay account. The link we create contains the amount, a short description of the booking (type of entry, party size and time) and a booking reference; it does not contain the customer’s name, phone number or email address, and we switch off Razorpay’s own SMS and email notices. The customer enters payment details on Razorpay’s page, not ours. Razorpay’s payment notifications to us can include the payer’s contact details and limited payment-method details (such as the card network or last four digits). We keep the payment ID, the time of payment and any refund.
• Confirmations and passes: if the booker gave an email address, we email them a confirmation with a calendar file, invoice and pass. We can also send booking messages and the pass in the chat. Pass PDFs sent in a chat are stored in our file storage. Passes carry a QR code. To view a private pass, the customer may be asked for a one-time code that Twilio sends to the booking phone number or email address; access then lasts 15 minutes.

c. Guest photos

A business can let guests add a photo of their face to their pass so that staff can recognize them at the entrance. The photo is optional and uploaded by the guest. We re-encode it, remove its metadata (including any location data), limit its size, and store it privately. It is shown on the guest’s pass and to the business’s staff. We do not use it for biometric processing: nothing creates a face template, matches faces automatically, or estimates age. Photos are deleted automatically 90 days after upload, or sooner if the business removes them, or if the guest removes the photo before finishing the booking. Photos added to a booking that is never completed are deleted after the booking session expires.

d. Door check-in

Staff at the entrance see an arrivals list with names, party size, guest names, pass reference and check-in status, and we record who checked each guest in, when, and at which entrance. When someone checks in, we can notify the business, message or email the guest, and tell the person who booked which of their guests have arrived. A venue can prepare a list for use without an internet connection. That list holds names, the event and pass references only — no phone numbers, email addresses, payments or booking-form answers. It is stored encrypted on our server. A copy is kept, unencrypted, in that staff member’s browser tab and is cleared when they sign out or close the tab. The list expires within 12 hours. Our server copy is deleted when the venue next prepares a list, once it is more than 2 days past expiry.

e. Loyalty rewards

If a business runs a loyalty program, we keep each member’s join date, the terms they accepted, their stamps and rewards, the staff member who made each change, and any payment reference that staff enter. Customers join and leave using a link the business sends them. The business can export its member list, and the AI can mention a customer’s loyalty status in replies.

f. Customer profiles and labels

• Profiles: for each customer, identified by phone number or email address: name, phone, email, first contact date, how they found the business, counts of bookings, visits, no-shows and cancellations, amount spent, languages, marketing consent or opt-out, tags and internal notes. A profile links a customer’s chats and bookings with the same business.
• Automatic labels: some labels are facts taken from booking records (for example “paid customer” or “abandoned booking”). Others are the AI’s reading of a conversation: “hot lead”, “browsing”, “unhappy” or “not a customer”. These help the business decide whom to follow up with. Staff can remove any label, and the AI will not add back a label that staff removed. We do not use these labels for anything except showing them to the business.
• Journey records: when a customer first messages, opens a booking page, books and pays, and which channel or campaign it came from, with the amount paid. These feed the business’s reports.
• Security records: when a customer submits a booking or joins or leaves a loyalty program, we record it in our audit log with the IP address and browser details it came from. We also use IP addresses briefly to limit abuse.
• Exports: the business can export customer lists as CSV or PDF, including through owner controls on WhatsApp.

g. Conversation memory and learning

Customer memory, staff examples and suggested answers are off until the business turns them on. Separately, preparing examples from past Instagram and Messenger conversations starts automatically when a business connects those channels, as described below; the examples stay pending until the business reviews them.

• Customer memory: the AI reads a customer’s recent messages and notes preferences such as their language, interests and how they like to be contacted, so later replies can take them into account. Memory is stored encrypted and deleted after 30 days (90 days for a language preference).
• Staff examples and suggested answers: the Service can learn the business’s tone from staff replies and suggest new knowledge-base answers. Staff examples are stored encrypted and deleted after 30 days. Suggested answers (a customer’s question with a staff reply) are saved as drafts in the business’s knowledge base and stay there until the business publishes or deletes them; an answer the business publishes becomes part of its knowledge base.
• Past Instagram and Messenger conversations: when someone who manages AI settings connects Instagram or Messenger, we automatically read up to 20 recent conversations (up to 20 messages each) through Meta to prepare tone examples and suggested answers for the business to review. This happens even if the features above are off. Messages that contain links, phone numbers, email addresses, or words about health, payment and similar topics are skipped. The examples are stored encrypted and deleted after 30 days. If the business approves a suggested answer, it is copied into its knowledge base as a draft, which stays until the business deletes it. Staff can also open earlier Instagram and Messenger chats from Meta in the dashboard; these are shown but not stored.
• Stopping it: a customer can type “forget my preferences” or “don’t remember me” in the chat. This clears the preferences and staff examples learned from that conversation and stops learning from it. Suggested answers already added to the knowledge base stay until the business deletes them. Staff can do the same for any conversation.

h. Reminders, follow-ups and offers

If the business turns them on, the Service sends booking reminders; follows up with customers whose question was not answered; and sends thank-you messages that ask for a rating, no-show and unfinished-payment messages, return offers, a review link and a referral link. We keep the rating a customer gives and a record of the offers and posters each customer was sent. Marketing messages are not sent to customers who have opted out or whose profile records that they declined marketing. The business is responsible for having any opt-in needed to send them.

i. Private Concierge (web chat)

• Getting in: a business can invite a customer from WhatsApp, Instagram or Messenger into a private chat on conversaa.in. The invitation link works for 15 minutes. To enter, the customer types a 6-digit code that we send through the business’s own chat with them. The chat is tied to that browser, lasts up to 24 hours, and ends after 120 minutes without activity. The customer can end it at any time.
• What we store: hashed session and invitation tokens, a hash that identifies the browser, a short description of the device (browser and operating system, taken from the user agent), the time of last activity, and the messages. A short encrypted copy of the customer’s latest request, used to hand the chat to staff, stops being used after 30 minutes and is deleted within the following hour. We use the customer’s IP address to limit abuse.
• Files: images, PDFs, audio and video (up to 5 MB) that the customer sends are stored on our server and deleted after 30 days.
• Finding bookings: to see their bookings, a customer can confirm their phone number or email address with a one-time code sent by Twilio. We keep the confirmed contact, encrypted, for 15 minutes.
• Codes: we check entry codes against a keyed hash. The copy waiting to be sent in the chat is encrypted and cleared within an hour of the code expiring, and code records are deleted a day after they expire.

j. WhatsApp Business app history

If a business connects a number that it also uses in the WhatsApp Business app, and chooses to share its history where WhatsApp offers this, WhatsApp can share up to 180 days of past one-to-one chats and the app’s contacts (names and phone numbers). We add these to the business’s inbox and customer profiles. While this is on, messages the business sends from the WhatsApp Business app are also copied into its inbox.

We do not ask for special-category (sensitive) data, such as health information, religion or sexual orientation, or for government IDs. We ask businesses not to collect them through the Service unless it is necessary and lawful. In practice:

• Healthcare businesses. Clinics, hospitals, dental practices, diagnostic centers and pharmacies can use the Service, so their customers’ messages and booking-form answers may contain health information. We process it only as the business’s processor, to provide the Service. The business must have a lawful basis for it and, where the law requires, the customer’s explicit consent.
• Customers may volunteer it. Anyone can include sensitive details in a message. These are handled like other message content.
• Guest photos show a person’s face, but we do not process them as biometric data (see Customer data we process for businesses).

We use personal data to:

• provide, operate, secure, and maintain the Service and your account;
• send, receive and store messages and comments on WhatsApp, Instagram, Messenger and the Private Concierge;
• generate suggested or automatic AI replies grounded in the business profile and knowledge base, draft replies to Instagram comments, pre-fill booking forms and prepare quotes;
• take bookings, create payment links, issue passes, check guests in, run loyalty rewards, and send the reminders, follow-ups and offers a business has turned on;
• keep customer profiles and labels for the business;
• learn from a business’s conversations: preparing reviewable examples from recent Instagram and Messenger chats when a business connects them, and other learning where the business has turned it on;
• check incoming messages for harmful content and emergencies, and alert the business;
• route difficult or low-confidence conversations to a human on the business’s team (escalation);
• provide analytics and reports to the business, including Instagram insights and, if connected, its Google Analytics reports;
• verify sign-ins and phone numbers with one-time codes;
• respond to your support requests and communicate about the Service;
• detect, prevent, and investigate fraud, abuse, security incidents, and violations of our Terms;
• comply with legal obligations and enforce our agreements.

We do not sell personal data, we do not use it for advertising, and we do not use the content of conversations to train our own or third parties’ general AI models. Message content is sent to AI providers only for the purposes listed in Artificial intelligence and sub-processors.

Where GDPR / UK GDPR applies, we rely on the following legal bases:

• Performance of a contract (Art. 6(1)(b)) — to provide the Service you signed up for.
• Legitimate interests (Art. 6(1)(f)) — to secure, improve, and support the Service, verify sign-ins, check incoming messages for harmful content, and prevent abuse, balanced against your rights.
• Consent (Art. 6(1)(a)) — where required, e.g. for non-essential communications; you may withdraw consent at any time.
• Legal obligation (Art. 6(1)(c)) — to comply with laws that apply to us, such as tax and accounting rules.

For customer data processed on a business’s behalf, the business is responsible for establishing the legal basis and obtaining any required opt-in or consent, including WhatsApp opt-in, consent to marketing messages, and explicit consent for health information where the law requires it.

India (DPDP Act). For business users we are a Data Fiduciary. We process your data with the consent you give when you sign up, or for the legitimate uses the Act allows, such as data you give us voluntarily for a stated purpose or to meet a legal duty. You can withdraw consent by emailing privacy@conversaa.in; we may then be unable to provide the Service. For a business’s customers we are, apart from the limited uses described in Our role, and yours, that business’s Data Processor.

The Service uses the WhatsApp Business Platform, the Instagram API (with Instagram Login) and the Messenger Platform, provided by Meta Platforms, Inc. and its affiliates (“Meta”). To send and receive messages, data is transmitted through Meta’s systems and is also subject to Meta’s own terms and privacy practices, including the WhatsApp Business Messaging Policy, the WhatsApp Business Terms, the Meta Platform Terms, and the Instagram Terms of Use.

What we receive from Meta

• WhatsApp: messages sent to and from the business’s number, customers’ phone numbers and profile names, delivery and read status, and the business account and phone number details needed to connect it. When a business connects or repairs WhatsApp, the page loads Meta’s JavaScript SDK to run Meta’s sign-up window.
• Instagram: direct messages; comments on the business’s posts with the commenter’s username and ID; customers’ names and usernames; account and post insights (reach, views, likes, comments, saves, shares and interactions, as totals that do not identify anyone); post and story details such as captions, links and preview images; and recent conversation history (see Customer data we process for businesses).
• Messenger: messages sent to the business’s Facebook Page, customers’ page-specific IDs and first and last names, the Page’s name and ID, and recent conversation history.

How we use it

We use data we receive from Meta only to provide the Service to the business that connected the account, as described in this Policy. We do not sell or license it. We do not use it for advertising or ad targeting, other than the reminders, follow-ups and offers a business itself chooses to send to its own customers through the Service. We do not give it to data brokers, and we do not use it to build profiles for anyone other than that business. Apart from that business and its team, we share it only with the service providers listed in Artificial intelligence and sub-processors, with a buyer of our business who must keep these same restrictions, or where the law requires. You are responsible for using WhatsApp, Instagram and Messenger in line with Meta’s policies, including obtaining valid opt-in from recipients and only sending permitted message types.

Removing access and deleting data

• A business can disconnect WhatsApp, Instagram or Messenger in Conversaa’s settings. We then delete the stored access token for that channel and stop replying on it. For WhatsApp this also stops new messages reaching us; for Instagram and Messenger, Meta may keep delivering new messages, which we store, until you also remove Conversaa in your Instagram or Facebook settings. Conversations already stored are kept until deletion is requested.
• You can also remove Conversaa’s access from your Instagram or Facebook settings (under apps and websites, or business integrations) or, for WhatsApp, from your Meta business settings.
• To have data we received through Meta deleted, follow the instructions at conversaa.in/data-deletion or email privacy@conversaa.in with the subject “Data Deletion Request” (see Data deletion and account removal). Data held by Meta is governed by Meta’s own retention and deletion practices.

Not affiliated with Meta. Conversaa is an independent product. “WhatsApp”, “Instagram”, “Messenger” and “Meta” are trademarks of Meta Platforms, Inc. This Service is not endorsed, certified, sponsored by, or otherwise affiliated with Meta, WhatsApp, Instagram or Messenger.

When we send data to AI providers

• Replies: the business profile, selected knowledge-base entries, the recent messages in the conversation and the customer’s name, plus, where the business uses these features, the customer’s loyalty status and remembered preferences.
• Safety checks: the text of every incoming customer message is checked by OpenAI models for harmful content, even when AI replies are paused, so the business can be alerted to serious messages. Messages in the owner-controls chat are not checked. Emergency detection runs on our own servers without an AI provider, so an emergency gets a fixed safety reply instead of an AI-written one; the message is still checked by the safety check above.
• Instagram comments: comment text, to draft replies.
• Memory and learning: recent messages and staff replies, where the business has turned these features on.
• Teaching and website import: uploaded text, screenshots and website pages, to extract and check knowledge.
• Owner controls: the text of instructions sent in the owner-controls chat, to understand them, and forwarded posters and captions, to extract promotion details.
• Owner voice notes: audio sent in the owner-controls chat, to turn it into text.
• Promotional images: reference photos and the promotion brief, to generate images.

Images, audio and video that customers send in chats are not sent to AI providers.

AI providers

• OpenAI, L.L.C. (United States) — AI replies (the default model), safety checks on incoming customer messages, turning owner voice notes into text, generating promotional images, and reading teaching material and website pages. Privacy policy.
• Google LLC (Gemini API) — AI replies and the other AI features described above when a business chooses a Gemini model or when the model in use does not answer, generating promotional images, reading the details of a promotion brief, and reading posters and captions forwarded in the owner-controls chat. Privacy policy.
• Anthropic, PBC (United States) — AI replies and the other AI features described above when a business chooses a Claude model or when the models before it do not answer, and reading and checking knowledge prepared from websites and teaching material. Privacy policy.

Each business can choose the model used for its replies. If that model does not answer, the request moves to models from the other providers in turn, so the customer still gets a reply. We contractually require these providers to process data only to provide their service, not to train their general models on it (as offered under their applicable API terms), and to maintain appropriate security. A business can pause AI replies for one conversation or for its whole account; the safety checks described above continue.

Other service providers

• Meta Platforms, Inc. — WhatsApp Business Platform, Instagram API and Messenger Platform: sending and receiving messages and comments, customer profile names, account and post insights, and recent conversation history (see the Meta section above) (United States / global).
• Twilio Inc. (Twilio Verify) — sends and checks one-time codes by SMS or email for sign-in, phone-number changes, private pass access and Private Concierge booking look-ups. It receives the phone number or email address the code is sent to (United States).
• Resend — sends our emails: booking confirmations, passes and invoices, check-in notices, team invitations, password resets, and alerts to businesses (an alert can include a short excerpt of a customer’s message).
• Razorpay Software Private Limited — online payments: subscription payments to us, and booking payments that a business takes through its own Razorpay account (India).
• Google LLC — Google Sign-In, and the read-only Google Analytics connection a business can add to see its own website reports.
• Functional Software, Inc. (Sentry) — error monitoring for our servers and your browser, including performance timings for a sample of page loads. It is set up not to collect personal data such as IP addresses and cookies by default, and credentials are removed from error details before they are sent.
• Cloudflare, Inc. — R2 file storage (media library, guest photos, pass PDFs, reports, promotional images, profile pictures and logos) and DNS (Global).
• Hostinger International Ltd. — the server that runs the application, database, cache and job queues, and stores encrypted database backups, Private Concierge files and server logs.

A current list of sub-processors is available on request at privacy@conversaa.in. We will give notice of material changes so controllers may object.

We share personal data only in these limited situations:

• Sub-processors / service providers — as listed in Artificial intelligence and sub-processors, under contracts that restrict their use of the data.
• With the business — customer data is available to the business and its authorized staff, who can export it.
• As part of a booking — for example, guests named by a booker receive their own pass by email, the person who booked can be told which of their guests have arrived, and showcase profiles are shown to the business’s customers.
• Within your organization — with authorized members of your team who use the Service.
• Legal & safety — where required by law, legal process, or to protect the rights, property, or safety of Conversaa, our users, or the public.
• Business transfers — in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.
• With your direction or consent — where you ask us to share data.

We do not sell or “share” personal data for cross-context behavioral advertising as those terms are defined under the CCPA/CPRA, and we do not rent your data or your customers’ data to anyone.

We are based in India. We and our sub-processors may process personal data in other countries, including the United States. Where we transfer personal data out of the EEA, the UK, or other regulated regions, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses (and the UK Addendum / IDTA) or an applicable adequacy decision. You may request a copy of the relevant safeguards at privacy@conversaa.in.

Businesses control retention instructions for their customer data. The standard choice for ordinary customer chat content and AI prompt content is 90 days. An owner must enable this in Settings → Your data & privacy before automatic cleanup starts, including for existing accounts. Each activation has at least 24 hours of notice; cleanup then runs hourly in batches. While disabled, that content remains until the business enables cleanup or requests deletion (see Data deletion and account removal).

We do not routinely read or manually intervene in tenant conversations. Automated systems and AI process them to deliver the enabled features. Limited authorised access may be necessary for support, security or legal obligations. Tenant control does not remove our own security and data-processing responsibilities.

Deleted automatically

• Raw notifications from Meta and Razorpay: after 30 days (7 days for notifications that fail our signature check).
• Guest photos: 90 days after upload, or sooner if removed.
• Private Concierge files: after 30 days.
• The copy of a Concierge request used to hand a chat to staff: stops being used after 30 minutes and is deleted within the following hour.
• Concierge entry codes: within an hour of expiring; code records a day after expiry. A confirmed contact used to find bookings: after 15 minutes.
• Customer memory: after 30 days (90 days for a language preference). Staff examples and examples prepared from past Instagram or Messenger conversations: after 30 days.
• Website import progress data: after 7 days.
• Lists for checking guests in without an internet connection: they expire within 12 hours; our encrypted copy is deleted the next time the venue prepares a list, once it is more than 2 days past expiry.
• Database backups: encrypted, and deleted once they are more than 14 full days old (about 15 days).

Kept until the account is closed or deletion is requested

• Conversation records and delivery identifiers (message content follows the confirmed 90-day policy above), private admin conversations, Instagram comments, notes and tags; customer profiles and labels; journey records; bookings, guest lists, passes and pass PDFs; loyalty records; and links between Instagram posts and conversations.
• Suggested answers saved as knowledge-base drafts, and approved examples added to the knowledge base, until the business deletes them.
• Items removed in the app that are only marked as deleted (see Data deletion and account removal).
• AI usage totals and request metadata (customer prompts, reasons and retrieved content follow the confirmed 90-day policy above), safety-check metadata, and audit logs (including IP addresses and user agents).
• Customer lists and reports created through owner controls on WhatsApp.
• Account, team and integration data.

Invoices and other billing records are kept for as long as tax and accounting law requires. Server logs are kept for as long as we need them to troubleshoot and secure the Service. Retention on Meta’s WhatsApp, Instagram and Messenger systems is subject to Meta’s own practices, which we do not control.

We implement technical and organizational measures designed to protect personal data, including: encryption in transit (HTTPS/TLS); encryption of stored secrets and access tokens; role-based access controls and least-privilege access; tenant isolation so one business cannot access another’s data; audit logging of sensitive actions; validated and signed inbound webhooks; and rate limiting.

• Meta access tokens (WhatsApp, Instagram and Messenger) are stored encrypted at rest and are never exposed to browsers or logs.
• Razorpay key secrets and webhook secrets, Google Analytics tokens, pass tokens, customer memory, teaching examples, Concierge hand-over copies and our server copy of offline check-in lists are also stored encrypted.
• Passwords and owner PINs are stored only as hashes. One-time sign-in codes are created and checked by Twilio and are not stored by us.
• Database backups are encrypted.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we become aware of a personal-data breach that is likely to affect you, we will notify you and the competent authorities as required by law. Report suspected vulnerabilities to security@conversaa.in.

Subject to applicable law, you have the right to: access your personal data; rectify inaccurate data; erase data (“right to be forgotten”); restrict or object to processing; data portability; withdraw consent; and lodge a complaint with a supervisory authority. Under the India DPDP Act you also have the right to grievance redressal and to nominate another person to exercise your rights.

To exercise these rights, contact privacy@conversaa.in. We will respond within the timeframe required by applicable law (generally within 30 days). We will not discriminate against you for exercising your rights, and we may need to verify your identity first.

To request deletion of your data, follow the instructions at conversaa.in/data-deletion.

If you are a customer of a business that uses Conversaa, please contact that business (the controller) first. You can also write to us and we will pass your request to the business and help it respond. Some controls are also available to you directly:

• remove your guest photo while you are completing your booking, or ask the business to remove it afterwards;
• leave a loyalty program using the link the business sent you;
• type “forget my preferences” or “don’t remember me” in the chat to clear the preferences and staff examples learned from that conversation and stop further learning;
• end a Private Concierge chat at any time;
• ask the business to stop sending you marketing messages.

EEA/UK users may also complain to their local Data Protection Authority. If you are in India, you may first raise a grievance with us at privacy@conversaa.in (or with our Data Protection Officer at dpo@conversaa.in); if it is not resolved to your satisfaction, you may complain to the Data Protection Board of India. Our supervisory contact for all privacy matters is our Data Protection Officer at dpo@conversaa.in.

Under the CCPA/CPRA, California residents have the rights to know, access, correct, and delete personal information, and to opt out of the sale or sharing of personal information and limit use of sensitive personal information.

In the preceding 12 months we have collected the following statutory categories of personal information, each collected for the business purposes described in How we use personal data and disclosed only as described in Artificial intelligence and sub-processors and How we share personal data:

• Identifiers — name, email address, phone number, WhatsApp profile name, Instagram username and ID, Messenger ID, Google account ID, IP address, and account identifiers.
• Customer records — contact details, billing name and address, GSTIN, and business profile information.
• Commercial information — bookings, payment and refund records, loyalty records and spending history held for businesses, and records of your use of and subscription to the Service.
• Internet or other electronic network activity — IP address, browser user agent, Private Concierge device description, and audit, log and diagnostic data.
• Audio, electronic, visual or similar information — owner voice notes, guest photos, showcase photos, chat screenshots uploaded for teaching, and images and files shared in chats.
• Professional or employment-related information — your role and organization, and the professional details in showcase profiles.
• Inferences — AI-assigned customer labels (such as “hot lead”) and remembered customer preferences.
• Biometric information — none processed as such: guest photos are viewed by staff only; we create no face templates and do no automated matching.
• Sensitive personal information — account sign-in credentials, and health information that customers of healthcare businesses may include in messages or booking answers. We use it only to provide the Service and not to infer characteristics about anyone.
• Other information you or your customers provide — the content of messages, comments and media, booking-form answers, and your knowledge-base entries.

We have not sold or shared personal information (as those terms are defined by the CPRA) and do not do so, including for consumers we know to be under 16 years of age. To exercise your California rights, contact privacy@conversaa.in. You may use an authorized agent, and we will not discriminate against you for exercising your rights.

If you use Conversaa for a business

• In the app, you can remove knowledge-base entries, media-library items, booking forms, offers, promotional events and showcase photos. Removed items are no longer shown or used by the AI, but stay in our database and file storage, marked as deleted, until the account is closed or you ask us to erase them. Your profile picture, your organization’s logo, promotional images you delete, and a knowledge-base reset are erased. You can also remove a guest photo, cancel follow-ups, remove tags, use “forget and pause” to clear the preferences and staff examples learned from a conversation, and remove team members. You can disconnect Google Analytics, Razorpay, and each messaging channel. Disconnecting a messaging channel deletes our stored access token and stops replies on it, but does not delete conversations already stored. For WhatsApp it also stops new messages reaching us; for Instagram and Messenger, Meta may keep delivering new messages, which we store, until you also remove Conversaa in your Instagram or Facebook settings.
• Conversations, customer records or the whole account cannot yet be deleted from the app. To delete them, the account owner emails privacy@conversaa.in from the registered email address with the subject “Data Deletion Request”. We verify the request, delete or anonymize the data from our live systems within 30 days, and confirm once it is done. Copies in our encrypted backups are deleted as those backups expire, normally within a further 15 days.
• Removed team members lose access. We remove their email address, phone number and Google sign-in link from their user record, but keep the record, marked as deleted, so that past actions in the audit log still show who took them. The record keeps their name, and the audit-log entry recording their removal keeps their email address. A former team member can ask us to erase their remaining details.

If you are a customer of a business that uses Conversaa

Ask the business, or email privacy@conversaa.in with the subject “Data Deletion Request”. Include the WhatsApp number, Instagram username, Messenger name, or booking email or phone number you used, and the name of the business. We will tell the business, which is the controller of your data. Unless the business tells us it must keep the data by law, we will delete your data from our systems within 30 days and confirm by email. Full instructions are at conversaa.in/data-deletion.

We may retain a minimal amount of information where legally required (for example, to comply with tax or anti-fraud obligations). Deletion of data held by Meta, by Razorpay or by the business itself is subject to their own retention and deletion practices.

We use only strictly necessary cookies and browser storage. We do not use advertising, analytics or cross-site tracking cookies, and there is no Google Analytics, Meta Pixel or similar tag on conversaa.in. If we introduce any non-essential cookies in the future, we will update this Policy and, where required, ask for your consent first.

Business users (dashboard)

• __Host-wa_at — keeps you signed in. It is HttpOnly, Secure and SameSite=Lax, and lasts up to 14 days, or until you sign out.
• Local storage — a marker that you are signed in (and, for older sessions, the sign-in token), your theme, your media-rights confirmations, booking form drafts, and the entrance chosen on the door screen.
• Session storage (cleared when you close the tab) — temporary values used while you sign in with Google or connect Instagram or WhatsApp, setup progress, and the offline guest list on the door screen.

Customers in the Private Concierge

Three cookies, all HttpOnly, Secure, SameSite=Strict and limited to that business’s Concierge address:

• concierge_{portal} — the chat session, until it ends (at most 24 hours);
• concierge_entry_{portal} — the invitation, for 15 minutes;
• concierge_browser_{portal} — ties the chat to your browser: 15 minutes while the code is pending, then until the session ends.

Third-party scripts

• The pages where you connect or repair WhatsApp (onboarding, setup and WhatsApp settings) load Meta’s JavaScript SDK to run Meta’s sign-up window. We switch off its automatic event logging. Meta may set its own cookies under Meta’s policies.
• The Private Concierge and dashboard can show images of the business’s Instagram posts loaded directly from Meta’s servers, so Meta receives your IP address and browser details.
• Browser error reporting to Sentry is currently off. If we switch it on, error reports and performance timings for a sample of page loads will be sent from your browser to Sentry, as described in Artificial intelligence and sub-processors.
• The billing page loads Razorpay Checkout when you pay online. Razorpay may set its own cookies under Razorpay’s policies.

You can control cookies through your browser settings, but blocking essential cookies may prevent you from signing in or using the Private Concierge.

The Service is a business tool intended for use by organizations and adults. It is not directed to children. For users in India, we do not knowingly collect personal data from anyone under 18 years of age, as required by the DPDP Act, 2023. In other jurisdictions we do not knowingly collect data from anyone under the age of digital consent (16 in the EEA/UK unless a member state has set it lower, 13 in the United States under COPPA). If you believe a child has provided us personal data, contact privacy@conversaa.in and we will delete it.

Our Terms do not allow businesses to use the Service to process personal data of people under 18 in India. Elsewhere, a business that uses the Service with customers below the local age of digital consent is responsible, as the controller, for any parental consent the law requires.

The Service may link to or integrate with third-party websites and services that we do not control. This Policy does not apply to those third parties, and we are not responsible for their content or privacy practices. Please review their privacy policies before providing them with personal data.

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify you through the Service or by email. Your continued use of the Service after an update takes effect constitutes acceptance of the revised Policy.

If you have questions, requests, or complaints about this Policy or our processing of personal data, contact us:

• Legal entity: SourceKode Technologies LLP
• Entity type: Limited Liability Partnership registered in India under the LLP Act, 2008
• LLPIN: AAB-2848
• Registered office: 1, 46/10, Shakuntal Apartments, Law College Road, Erandwane, Pune, Maharashtra 411004
• GSTIN: 27ACGFS8559J2ZC
• General email: noreply@conversaa.in
• Privacy email: privacy@conversaa.in
• Data Protection Officer (DPO): dpo@conversaa.in
• Grievance Officer (India, per the DPDP Act and the IT Rules 2021, Rule 3(2)):
  • Name: Sumit N (Designated Partner, SourceKode Technologies LLP)
  • Email: grievance@conversaa.in
  • Response SLA: acknowledgement within 24 hours; resolution within 15 days of receipt of a valid complaint
• Website: conversaa.in