Privacy policy

Convomatic is a WhatsApp Business software platform operated by Lumoonix Innovation Private Limited, a company registered in India (“Convomatic”, “we”, “us”). This policy explains what information we collect when you visit our website or use the Convomatic app, why we collect it, who we share it with and the choices you have.

We play two roles. For your own account — your name, your email and how you use the app — we decide how the information is used. For the contacts and conversations a business keeps in Convomatic, that business decides, and we process the information on its behalf and on its instructions.

If you are a customer of a business that uses Convomatic and want to know how it uses your details, ask that business first. We will help it answer you.

Information you give us:

• Account details. Your name, email address and profile picture. Sign-in is handled by Google Firebase Authentication: if you use a password we never see or store it, and if you sign in with Google we receive only your name, email and picture.
• Team details. The names, email addresses and roles of the people you invite to a project.
• Business connections. When you connect WhatsApp, Meta ads, a product catalogue, Shopify or Razorpay, the account IDs and access credentials those services issue, so we can act for you.
• Customer data. Contacts you add or import (names, phone numbers, tags and attributes), the messages and media you send and receive, notes, orders and bookings, and the templates, flows and campaigns you build.
• Support and sales. What you tell us when you email or message us.

Information collected automatically:

• Usage and device data. IP address, browser, the pages you open and the actions you take, recorded in server logs and used to run, secure and fix the service.
• Analytics. This website and the app use Google Tag Manager and Google Analytics to count page views. In the app, record IDs are removed from page addresses before they are sent. Pages your customers open from a message link, such as order tracking or an address form, do not load analytics.
• Cookies and local storage. Used to keep you signed in, remember your current project and, through Google Analytics, tell visits apart. You can block analytics cookies in your browser and the app still works.

Information about a business’s customers, collected for that business:

• WhatsApp messages. Messages, media and delivery receipts that Meta passes to us for the business’s number.
• Link clicks. When a customer taps a tracked link in a message, we record the click against that message before sending them on.
• Store events. If the business connects a Shopify store, the store sends us shopper events such as product views, carts and checkouts, tagged with a visitor identifier, so the business’s automations can follow up.
• Forms. Details a customer types into a form the business sends them, such as a delivery address.

We use information to:

• Provide the service: send the messages, run the flows and campaigns, and show the conversations and reports you ask for.
• Create and secure your account, including spotting abuse and access nobody authorised.
• Answer support requests, and tell you about changes to the service, your plan or our terms.
• Bill for paid plans and keep the records tax law requires.
• See which parts of the product are used, through counts and totals, so we can improve it.
• Meet our legal obligations and enforce our terms.

We do not sell personal information. We do not use the contacts or conversations a business keeps in Convomatic to advertise to anyone, or to train AI models.

Convomatic is built on Meta’s official WhatsApp Business Cloud API. Every message a business sends or receives passes through Meta, which processes it under its own terms and privacy policy. We are an independent software provider and not part of Meta.

When you connect with Facebook Login, we ask only for the permissions a feature needs: managing your WhatsApp Business Account and message templates, and, if you use them, your ad accounts, Pages and product catalogues. We use what we receive only to provide those features to you. We do not sell it, use it for our own advertising, or share it beyond the providers listed below.

The access tokens Meta issues to us are encrypted at rest (AES-256-GCM) and are used only from our servers.

You can remove our access at any time from your Facebook settings, under Business Integrations, or by disconnecting the account inside Convomatic.

The Convomatic AI agent answers customers by matching their questions against the knowledge a business gives it: website pages, files, FAQs and products. It does not send conversations to an outside AI provider.

The inbox has optional writing tools that suggest replies, summarise a chat or translate a message. They run only when a team member uses them, and then send the text of that conversation to Anthropic, our AI model provider, to produce the result. Under Anthropic’s commercial terms, that content is not used to train its models.

We share information only with providers that help us run Convomatic, with services you connect yourself, or when the law requires it. Our providers process it on our instructions:

• Meta Platforms. WhatsApp messaging, Facebook Login, ads and product catalogues.
• Google. Firebase Authentication for sign-in, and Google Tag Manager and Google Analytics for analytics.
• DigitalOcean. The cloud servers that host the app and its database.
• Anthropic. Only when a team member uses the inbox writing tools.

When you connect Shopify, Razorpay, Google Sheets, a webhook or our API, information moves between Convomatic and that service because you set it up, and that service’s own terms cover what it receives. Payments made through a payment link are collected by Razorpay; we never receive card, UPI or bank details.

We may also disclose information when a law, court order or government authority requires it, to protect the rights and safety of our users or the public, or as part of a merger or sale of our business, in which case this policy continues to apply to it.

Some of these providers store data outside India. Where they do, we rely on their contractual commitments to protect it.

We keep account and project data while your account is open, because the service needs it. Contacts and messages stay in a project until you delete them or the project.

When you close your account, or ask us to delete it, we delete your account and project data within 30 days. Invoices and billing records are the exception: we keep them for as long as Indian tax and company law requires.

Server logs are kept only as long as we need them to keep the service secure and fix problems.

You can ask us to delete your data at any time. This section is also our data deletion instructions for Facebook Login.

If you have a Convomatic account:

1. 1Email info@convomatic.com from the address on your account, with the subject “Delete my data”.
2. 2Say whether you want your whole account deleted or a single project.
3. 3We confirm the request, may ask you to verify it, and delete the data within 30 days. We email you when it is done.

To remove our access to your Facebook data, open your Facebook settings, go to Business Integrations, select Convomatic and choose Remove. That stops further access; to delete what we already hold, also email us as above.

If you are a customer of a business that uses Convomatic, reply STOP or UNSUBSCRIBE to its WhatsApp number to stop its marketing messages, and ask the business to delete your details. You can also email us with your phone number and the business’s name; we will pass the request on and help the business act on it.

Under India’s Digital Personal Data Protection Act, 2023, and any other law that applies to you, you can ask to:

• See the personal information we hold about you and how it is used.
• Correct or update information that is wrong or incomplete.
• Delete your information, or withdraw a consent you gave.
• Nominate someone to use these rights for you if you cannot.
• Complain to us, and then to the Data Protection Board of India if you are not satisfied with our answer.

Email info@convomatic.com to use any of these rights. We reply within 30 days. You can also change most account details yourself in the app.

Every connection to Convomatic is encrypted with HTTPS. Access tokens and keys for WhatsApp, Meta ads and connected services are encrypted at rest, passwords are held by Google Firebase rather than by us, and a project’s data is visible only to the people its owner invites, according to the role each is given.

No system is perfectly secure. If we learn of a breach that affects your information, we will tell you and the authorities as the law requires.

Convomatic is a tool for businesses and is not meant for anyone under 18. We do not knowingly collect information from children.

When we change this policy we update the date on this page. If a change materially affects how we use your information, we tell account owners by email or in the app before it takes effect.

Lumoonix Innovation Private Limited, India. Email info@convomatic.com for privacy questions, requests and complaints. Our grievance officer reads every complaint and replies within the time the law sets.