Privacy Policy
Privacy Policy
1. Introduction
Convoup is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform and services. By accessing or using Convoup, you agree to the terms outlined in this Privacy Policy. If you do not agree, you must discontinue use of the platform immediately. Convoup is operated by Upgreatworld Pvt Ltd, a company registered in India.
2. Data Controller
Data Controller: Upgreatworld Pvt Ltd ("ConvoUp"), registered at Welldone Tech Park, Sector 48, Gurugram – 122018, Haryana, India. For data-related inquiries, contact [email protected].
2. Scope of Policy
This policy applies to: website visitors, registered users, API users and integrations, and third-party integrations. It covers all data collected via: the Convoup platform, our website (convoup.com), APIs and integrations, and customer communication systems.
3. Information We Collect
We collect the following types of data: Personal Information: Name, email address, phone number, and business details provided during account creation or usage. Technical Data: IP address, device type, browser information, and usage logs collected automatically when you access our platform. Communication Data: Messages sent via WhatsApp API, campaign data, and chat history processed through our platform. Chat data is processed but not owned by Convoup. Payment Data: Transaction details and billing information. Note: We do NOT store card details; payments are handled by third-party payment gateways.
4. How We Use Your Information
We use collected data for: account creation and authentication; WhatsApp API integration and messaging delivery; campaign execution and analytics; customer support and communication; platform improvement and performance optimization; legal compliance and fraud prevention; and sending technical notices and support messages.
5. Customer Data Ownership
You own your customer data. Convoup acts as a data processor, not a data controller. We process customer data solely to provide the Convoup service. We do not use your customer data for advertising or marketing purposes. Users are solely responsible for the data they upload or process through our platform.
6. Data Sharing & Third-Party Services
We do not sell your personal information. We share data only with the third-party service providers listed below, each of which receives only the data types necessary for its function: • Supabase (database hosting): All stored platform data — messages, contacts, conversations, templates, and configuration. Location: Singapore (ap-southeast-1). • Meta / WhatsApp Cloud API: Outbound message content, phone numbers, media, and templates. Purpose: WhatsApp Business API messaging. Location: Meta global infrastructure. • Groq Cloud (AI inference): Last 20 text messages and up to 5 KB of knowledge base excerpts, only when the account owner has enabled AI auto-reply. Purpose: Generate automated customer-service replies. Location: US (Groq Cloud). Provider retention: Zero Data Retention (ZDR) enabled. Provider does not use customer data for model training. Data Processing Agreement (DPA) in place. • Google (SMTP): Staff and user email addresses only. Purpose: Transactional email (account invitations, notifications). Location: Google global. • Razorpay: Billing name, email, and phone number. Purpose: Payment processing and subscription management. Location: India. • Cloudflare: All traffic in transit. Purpose: CDN, DDoS protection, TLS termination. Location: Cloudflare global network. • Cloudflare R2: Encrypted database backups (contains message and contact data at rest). Purpose: Backup storage. Location: Cloudflare global network. • Self-managed VPS: All runtime data (processed server-side). Purpose: Application hosting. • GitHub Actions / GHCR: CI pipeline artifacts and Docker images (no personal data); and the nightly backup job, which passes a full database dump through an ephemeral GitHub-hosted runner (United States) — the dump is AES-256 encrypted in the same processing pipe and never written to disk in the clear. Purpose: Continuous integration/deployment and encrypted backup transport. By using Convoup, you agree to comply with Meta Platform Policies and WhatsApp Business Policy.
7. WhatsApp & Meta Compliance
Users of Convoup must strictly follow: WhatsApp Business Messaging Policy; opt-in requirements for messaging contacts; anti-spam guidelines; and all applicable Meta policies. Any violation may result in: account suspension on Convoup; permanent termination of your account; and reporting to Meta authorities. Convoup holds no responsibility for bans or restrictions imposed by WhatsApp or Meta. Convoup is an independent technology provider and is not owned, sponsored, endorsed, or certified by Meta Platforms, Inc. or WhatsApp LLC.
8. Data Security
We implement industry-standard security measures including: secure servers with encryption protocols; access control systems; and appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. However, no system is 100% secure, and users are responsible for safeguarding their login credentials.
9. Data Retention
We retain your data only as long as necessary to provide the service and comply with legal obligations: • Message content (message text, metadata, and mirrored media): retained for a maximum of 18 months from the date the message is sent or received, after which it is automatically and permanently purged. • Contacts and other CRM records (names, tags, custom fields, deals, notes): retained for the life of your account. You control this data and can delete any of it at any time. • On account disconnection or a deletion request: all WhatsApp-derived data is hard-deleted from primary storage immediately (in all cases within 7 days), and ages out of encrypted backups within the backup retention window (target: within 35 days). • Connected-business account, profile, and login: retained for the life of the account. Deleted immediately upon self-service account closure, or within 30 days of a deletion request submitted via [email protected]. • WhatsApp access tokens and secrets: retained while the WhatsApp connection is active. Deleted and invalidated immediately upon disconnection or deauthorization. • Invoices and financial records: retained for 8 years as required by Indian tax and accounting law. • Operational logs: application logs are rotated automatically by the container log driver and contain no message content or personal data. Deletion and data-lifecycle audit records are retained for 24 months as evidence of compliance with deletion obligations.
10. Cookies & Tracking
We use cookies and similar technologies for essential functionality (authentication, security, load balancing) and to remember your preferences. We do not use advertising or tracking cookies. Users can disable non-essential cookies via browser settings. Disabling cookies may affect certain platform functionalities.
11. Your Rights
You have the right to access, correct, or delete your personal information. You can manage your account information through your account settings or by contacting us directly. You may also request deletion of your data through Meta's Data Deletion Request mechanism or by disconnecting WhatsApp from Settings, which permanently erases your WhatsApp-derived data while keeping your Convoup account active.
12. Data Deletion
You can delete your data in the following ways: • Self-service data export: Download all your data from Settings > Danger Zone > Export Data. • Self-service WhatsApp data removal: Disconnect WhatsApp from Settings > Danger Zone > Disconnect WhatsApp. This permanently erases all WhatsApp-derived data (messages, contacts, conversations, templates, automations, media) while preserving your ConvoUp account for reconnection. • Self-service full account deletion: Delete your entire ConvoUp account from Settings > Danger Zone > Delete Account. This removes all data including your login, billing, and account configuration. • Meta Data Deletion Request: Submit a deletion request through Meta's platform. ConvoUp processes these automatically via our registered callback at https://app.convoup.com/api/whatsapp/data-deletion. • Email request: Send a deletion request to [email protected]. We will process it within 30 days. See our Data Deletion page for the full process.
13. User Responsibilities
Users agree to: use the platform legally and in compliance with all applicable laws; avoid spam or abusive messaging; maintain proper opt-in consent for all contacts; protect their login credentials; and comply with Meta and WhatsApp Business policies. Violation of these responsibilities may result in immediate account suspension or permanent ban without notice.
14. Account Suspension & Termination
Convoup reserves the right to suspend or terminate accounts, block access without prior notice, and remove data if required. Reasons include: policy violations, fraudulent activity, abuse of services, and violation of Meta or WhatsApp Business policies. suspended or terminated accounts may result in loss of data.
15. Limitation of Liability
Convoup shall NOT be liable for: message delivery failures; WhatsApp/Meta restrictions or bans; data loss due to external systems; business losses or damages arising from use of the platform. Use of the platform is at your own risk.
16. Compliance with Laws
Users must comply with local laws and regulations, data protection laws, and anti-spam laws applicable in their jurisdiction. Convoup is not responsible for legal violations by users. This policy is governed by the laws of India.
17. Changes to This Policy
We may update this Privacy Policy from time to time without prior notice. We will notify you of any changes by posting the new Privacy Policy on this page. Users are responsible for reviewing the policy regularly. Continued use of Convoup implies acceptance of updated terms.
18. Contact Us
If you have any questions about this Privacy Policy, please contact us at [email protected]. Convoup is operated by Upgreatworld Pvt Ltd, Welldone Tech Park, Sector 48, Gurugram - 122018, Haryana, India.
19. AI-Assisted Messaging
When the account owner enables the AI auto-reply feature, ConvoUp uses Groq Cloud API to generate automated customer-service replies. The AI processes the last 20 text messages in a conversation (with personally identifiable information automatically redacted) and up to 5 KB of the business's knowledge base excerpts to generate relevant responses. The AI never receives contact names, phone numbers, email addresses, tags, notes, or account identifiers. Content sent to Groq is subject to Zero Data Retention — it is not stored, logged, or used for model training after the response is generated. The first AI reply in each conversation includes a disclosure message informing the customer they are interacting with an automated system. Customers can opt out of AI messaging at any time by sending a keyword such as "stop" or "unsubscribe." Opting out disables automated replies for that conversation and routes it to a human agent. The AI auto-reply feature is off by default, available only on Growth and Enterprise plans, and requires explicit owner activation.
20. India — Digital Personal Data Protection Act (DPDP)
Data Fiduciary: Upgreatworld Pvt Ltd, Welldone Tech Park, Sector 48, Gurugram – 122018, Haryana, India. Lawful basis for processing: Performance of contract (providing the WhatsApp CRM service) and legitimate use (responding to customer inquiries via WhatsApp). Data principal rights: You can access, correct, export, and delete your data through the self-service tools in Settings, or by contacting [email protected]. Grievance Officer: To be appointed. Contact: [email protected]. Breach notification: In the event of a personal data breach, we will notify the Data Protection Board of India and affected data principals within the time period prescribed under the DPDP Act.