Privacy Policy

    Effective Date: July 20, 2026
    Last Updated: July 20, 2026

    This Privacy Policy explains how Convozen Technologies LLC ("ConvoZen", "we", "us", or "our") collects, uses, stores, shares, and deletes information when you use the ConvoZen platform, website, and related services (collectively, the "Service"). By creating an account or using the Service, you agree to the practices described here.

    If you have any questions, contact us at contact@convozen.io.

    1. Who We Are

    Convozen Technologies LLC is the data controller for information processed through the Service. ConvoZen is an AI-powered inbox and CRM copilot that helps businesses manage conversations on Instagram, Telegram, and other supported messaging channels.

    2. Information We Collect

    2.1 Account Information

    When you register we collect your email address, full name, chosen password (stored hashed by our authentication provider), preferred language, and role within your workspace.

    2.2 Instagram Data (via Meta Platforms)

    When you connect an Instagram Business or Creator account through Meta's official OAuth flow, we receive and store, with your explicit consent and only to the extent needed to deliver the Service:

    • Your Instagram Professional Account ID, username, and profile picture
    • A long-lived access token issued by Meta
    • Direct messages, message attachments (images, video, audio, voice notes, shared posts), reactions, edits, and read state
    • Comments on your posts, comment threads, and public metadata of the posts they are attached to
    • Public profile information (name, username, profile picture) of the Instagram users who contact you
    • Aggregated messaging insights derived from your account activity

    2.3 Telegram Data (optional)

    If you connect a Telegram bot, we store the bot token you provide and process the messages, contacts, and media that your bot receives or sends.

    2.4 AI-Generated Derivatives

    To power the copilot experience we generate and store derived data such as voice-message transcriptions, conversation categorization, funnel stage, urgency and importance scores, suggested replies, keyword autoresponses, and AI-assisted post drafts.

    2.5 Product Usage Data

    Contact labels, do-not-disturb lists, saved messages, follow-up campaigns, business profile settings you enter, and push notification subscriptions (device endpoint provided by your browser).

    2.6 Technical Information

    IP address, browser and device information, log timestamps, and diagnostic data automatically collected when you use the Service.

    3. How We Use Information

    We process the information above for the following purposes:

    • Provide, operate, and maintain the ConvoZen inbox and copilot
    • Synchronize messages and comments from connected channels via webhooks and periodic polling
    • Prioritize conversations, categorize leads, and generate AI insights and suggested replies
    • Send push notifications you have opted into
    • Enable team members you invite to collaborate on your inbox under your supervision
    • Detect abuse, secure the Service, comply with legal obligations, and improve product quality

    4. Third-Party Services and Sub-processors

    We rely on the following sub-processors to deliver the Service. Each receives only the data required for its function:

    • Meta Platforms Inc. — Instagram Graph API for message and comment delivery
    • Telegram FZ-LLC — Telegram Bot API (only if you connect a Telegram bot)
    • Supabase Inc. — database hosting, authentication, file storage, and serverless functions
    • OpenAI, L.L.C. — voice transcription, categorization, and draft generation
    • Lovable AI Gateway — AI model routing
    • CloudConvert — media format conversion for voice messages
    • PostHog — privacy-focused product analytics (usage events only; no message content and no contact data)
    • Web-push providers (Google FCM, Mozilla autopush, Apple APNs) — delivery of browser push notifications

    5. How We Share Information

    We do not sell, rent, or trade personal data. We share information only:

    • With the sub-processors listed above, under contractual controls
    • With workspace team members that the account owner explicitly invites
    • When required by applicable law, court order, or to protect the rights, property, or safety of ConvoZen or others
    • With a successor entity in the event of a merger, acquisition, or asset sale, subject to this Policy

    Instagram data obtained through Meta's APIs is used solely to power the features you have enabled in ConvoZen. It is never used for advertising, resold, shared with data brokers, or used to build advertising profiles.

    6. Data Storage and Security

    Data is stored on Supabase infrastructure with encryption in transit (TLS) and at rest. Access to your data is scoped per user through row-level security policies. Access tokens for Instagram, Telegram, and other integrations are kept server-side and are never exposed to the browser. We follow reasonable technical and organizational measures to protect your data, but no system is perfectly secure.

    7. Data Retention and Deletion

    We retain your data while your account is active. When you delete your account or disconnect a channel, all associated data — including messages, comments, contacts, access tokens, media files, and AI-generated insights — is deleted within 30 days.

    How to request deletion of your data:

    • Use the "Delete My Data" Button in Settings → Channels in the app, or
    • Send an email to contact@convozen.io from your registered email address with the subject "Delete My Data"

    We confirm deletion requests within 7 business days and complete deletion within 30 days, except where retention is required by law (for example, financial or fraud-prevention records).

    You may also revoke ConvoZen's access to your Instagram account at any time by visiting Meta Business Integrations settings.

    8. Your Rights

    Depending on your jurisdiction, you may have the right to access, rectify, port, restrict, or delete the personal data we hold about you, and to withdraw consent to processing. You can exercise these rights by contacting contact@convozen.io.

    9. Meta Platform Compliance

    ConvoZen complies with the Meta Platform Terms, Developer Policies, and Instagram Platform Policy. We access Instagram data only through official Meta APIs, only with your explicit authorization, only for the purposes disclosed in this Policy, and only for as long as needed to provide the Service.

    10. Children's Privacy

    The Service is not intended for children under 16 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.

    11. International Data Transfers

    Because our sub-processors operate globally, your data may be transferred to and processed in countries other than the one you reside in. Where required, we rely on appropriate safeguards for such transfers.

    12. Cookies

    We use strictly necessary cookies and local storage to keep you signed in and to remember your preferences. We also use first-party product analytics (PostHog) to understand how features are used. Analytics events record actions such as sign-in, connecting a channel, or sending a message, together with your account identifier — never message content, contact names, or other conversation data. We do not use advertising or cross-site tracking cookies, and we do not record your screen or session.

    13. Changes to This Policy

    We may update this Policy from time to time. Material changes will be communicated by email or in-app notice. The "Last Updated" date at the top reflects the most recent revision.

    14. Contact Us

    Convozen Technologies LLC

    Email: contact@convozen.io

    Website: https://convozen.io