Privacy Policy

1. Who We Are

ConvoZap ("we", "our", "us") is a WhatsApp Business API platform operated by Macrova Technologies Pvt. Ltd., registered in India. Our registered address is: Aratt Requzza, Electronics City Phase-1, Bangalore-560100. We are an Official Meta Tech Provider and access the WhatsApp Business Platform on behalf of our customers under Meta's policies. For privacy inquiries, contact us at privacy@convozap.com.

2. Information We Collect

We collect the following categories of data:

• Account data: Name, email address, business name, and phone number provided during registration.
• WhatsApp Business data: Your WhatsApp Business Account (WABA) ID, phone number ID, and access tokens supplied by Meta when you connect your account.
• Contact data: Phone numbers and names of your end-customers that you upload or that message your WhatsApp number. This data is owned by you.
• Message content: Inbound and outbound WhatsApp messages processed through our platform on your behalf.
• Usage data: Logs, feature usage, session duration, IP addresses, browser/device type, and campaign analytics.
• Payment data: Billing name and address. Card details are processed directly by our payment provider (Razorpay) and never stored on our servers.

3. How We Use Your Data

• Provide, operate, and maintain the ConvoZap platform
• Send and receive WhatsApp messages on your behalf via the Meta WhatsApp Cloud API
• Process payments and manage subscriptions
• Provide AI-powered features (auto-reply, campaign suggestions) via third-party AI providers
• Monitor platform health, prevent abuse, and enforce our Terms of Service
• Comply with legal obligations and Meta's policies
• Generate de-identified, aggregated analytics for product improvement (never sold)

We do not sell your personal data or your customers' data to any third party.

4. Third-Party Services We Use

We share data with the following processors to operate the platform:

• Meta Platforms, Inc. — WhatsApp Business Cloud API. Message content and your WABA data are transmitted to Meta to deliver messages. Meta's data policy applies: facebook.com/privacy/policy.
• Google Firebase / Google Cloud — Cloud database (Firestore), authentication, and hosting. Data is stored in Google Cloud data centers.
• Anthropic / OpenAI / Google (AI providers) — Message content may be sent to your chosen AI provider to generate auto-reply suggestions. Only providers you configure in AI Settings are used.
• Razorpay — Payment processing. Card and UPI data is handled by Razorpay under PCI-DSS compliance.

5. Data Retention

• Account data: Retained for the duration of your subscription plus 90 days after account closure.
• Message logs: Retained for 12 months from creation, then automatically purged.
• Contact data: Retained until you delete it or close your account.
• Usage/analytics data: De-identified after 12 months; aggregated data retained indefinitely.
• Billing records: Retained for 7 years as required by tax law.

6. Cookies and Tracking

We use strictly necessary cookies for authentication sessions (2-day expiry, or 14 days if "Remember Me" is selected). We do not use third-party advertising cookies or cross-site tracking. Analytics, if used, are privacy-preserving and do not fingerprint individual users.

7. Your Rights (GDPR / CCPA)

Depending on your jurisdiction, you have the right to:

• Access: Request a copy of all personal data we hold about you.
• Rectification: Correct inaccurate or incomplete data.
• Erasure ("right to be forgotten"): Request deletion of your data, subject to legal retention obligations.
• Portability: Receive your data in a machine-readable format.
• Restriction: Request that we limit processing of your data.
• Objection: Object to processing based on legitimate interests.
• Opt-out of marketing messages: Reply STOP to any WhatsApp message we send on behalf of our platform, or email privacy@convozap.com to be removed from all communications.

To exercise any of these rights, email privacy@convozap.com. We will respond within 30 days.

8. Cross-Border Data Transfers

ConvoZap stores data on Google Cloud infrastructure, which may be located outside your country of residence (including the United States and European Union). By using our platform, you consent to the transfer of your data to these jurisdictions. Where required by GDPR, we rely on Standard Contractual Clauses (SCCs) as the legal basis for such transfers.

9. Children's Privacy

ConvoZap is a business platform not directed at individuals under the age of 16. We do not knowingly collect personal data from minors. If you believe a minor has provided us with data, contact privacy@convozap.com and we will delete it promptly.

10. Account Security

You are solely responsible for maintaining the security of your account credentials and API keys. ConvoZap uses industry-standard TLS encryption in transit and AES-256 encryption at rest. We are not liable for losses resulting from compromised credentials.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or via an in-app notice at least 14 days before changes take effect. Continued use of the platform after that date constitutes acceptance.

12. Contact Us

For privacy requests or questions, contact our Data Protection contact at:
Email: privacy@macrovatech.com
Address: Macrova Technologies Pvt. Ltd., Aratt Requizza, Electronics City-1, Bangalore, India