Privacy Policy

1. Introduction

Convoro is operated by TechMasons LTD, a company registered in England and Wales (company number 14843665), with its registered office at 643 Stratford Road, Sparkhill, Birmingham, England, B11 4DY. In this policy "we", "our" and "us" mean TechMasons LTD.

We respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, and protect information when you use Convoro, including its website chat widget, the channels you connect to it, and the convoro.org website.

2. Information We Collect

2.1 Account Information

When you sign up with Google or Facebook, we receive your name, email address and profile picture from that account. When you sign up with an email address and password, we collect your name and email address; sign-in is handled by Google Firebase Authentication. If you add team members, we store their email addresses.

2.2 Business Information

Information you provide about your business, including business name, description, services, operating hours, branch locations, pricing plans, answers to common questions and the names and roles of team members, plus your social content brief, brand kit (such as your logo) and any pictures or videos you upload.

2.3 Payment Information

Your card details are collected and held by our payment processor, Stripe. We store only the card brand, last four digits, expiry date and Stripe’s reference for the card, together with a record of charges for your plan and AI usage.

2.4 Conversation Data

Messages exchanged between Convoro and the people who contact your business: website chat conversations, WhatsApp messages (including voice notes, images, documents, locations and contact cards people send), and comments on the Instagram, Facebook, X and YouTube accounts you connect, with the replies Convoro drafts or posts. This includes lead information people choose to share (such as name, email and phone number, or the public username of a commenter) and booking details.

2.5 Website and Profile Data

When you use the business scan, we read publicly available content from the website and public profiles you give us (such as Facebook, Instagram, Google Business, LinkedIn, TikTok, X or Yelp) and extract your business details into your profile, where you can edit them.

You can also give the business scan text you paste and files you upload (a PDF or a photo); we read them to extract your business details in the same way. An uploaded file is not stored: we keep only the business details read from it and a record of the file’s name and when it was read.

If you ask the scan to look your business up on Google, we send your business name and address to Google’s Places service and read the matching listing’s details, such as its address, phone number and opening hours. We keep Google’s identifier for the listing, so a later scan can look up the same listing, and only the details you save to your profile.

2.6 Connected Accounts

When you connect WhatsApp, Facebook, Instagram, X, YouTube or TikTok, we store the account’s name and ID and an encrypted access token (and, where the platform issues one, a refresh token) so Convoro can reply and post on your behalf. We also keep a record of the posts Convoro publishes for you.

When a business scan includes a Facebook, Instagram or X account you have connected, we also use that access to read what the account says about your business: its profile details (such as its About text or bio, category, address, phone number, email, website and opening hours, where the platform provides them) and, on Facebook and Instagram, the text of its recent posts. The business scan does not read YouTube or TikTok accounts. Each scan shows the connected accounts it will read, and you can switch any of them off before it runs. We extract your business details from these into your profile, where you can edit them.

2.7 Phone Calls

On the Pro plan, calls placed by the Convoro voice agent are recorded and transcribed by our voice provider. We store the number called, the transcript, a link to the recording, and the call’s length, outcome and cost. If you upload contacts for a call campaign, we store the names and phone numbers you provide.

2.8 Auto Outreach Prospects

On the Pro plan, Auto Outreach collects publicly available business contact details (such as business name, category, address, phone number, website and email address) from OpenStreetMap, business websites, public web search and, in some cases, Google Places, and uses them to email or call those businesses in campaigns you launch. You can also upload your own contacts ("My Audience"). Auto Outreach emails carry no tracking images or tracked links. We record when each email was sent and any unsubscribe. When we email businesses about Convoro itself, those emails record when each one is opened and when a link in it is clicked. Anyone who unsubscribes is added to a suppression list and is not emailed again by any Convoro campaign.

2.9 Usage Data

AI usage (such as conversations, images, videos, call minutes and outreach emails), login timestamps, and general service usage metrics.

2.10 Website Analytics

If you accept cookies on convoro.org, Google Analytics records how the site is used. See our Cookie Policy for details.

3. How We Use Your Information

• Service Delivery: To provide, maintain, and improve Convoro
• Replies and Content: Your business information is used to generate replies to the people who contact you, and the captions, images, videos, call scripts and outreach emails Convoro creates for you
• Billing: To process subscription payments and AI usage charges
• Lead Management: To capture, store, and display leads from conversations on your connected channels
• Booking Notifications: To email you when a booking request comes in, and to email you and your customer after a voice confirmation or reschedule call
• Outreach: To send the emails and place the calls in campaigns you launch
• Communications: To send welcome emails, service updates, and important notices
• Analytics: To provide usage statistics on your dashboard, and, with your consent, to measure how convoro.org is used

4. Data Storage & Security

Your data is stored using the following security measures:

• Database hosted on Neon PostgreSQL with SSL encryption in transit
• Access tokens for connected accounts encrypted with AES-256-GCM before storage
• Card details collected and held by Stripe, not by Convoro
• Authentication handled through Google Firebase Authentication (Google, Facebook, or email and password)
• All API communications encrypted via HTTPS/TLS
• Access controls limiting data access to authorized users only

5. Third-Party Services

We use the following third-party services to operate:

• Anthropic (Claude): Generates replies on every channel, reads what the business scan gathers (your website, the text and files you give it, and the details of the Google listing and connected accounts it reads), writes captions, video scripts and outreach emails, describes images sent on WhatsApp, and runs the voice agent’s conversation
• OpenAI: Transcribes WhatsApp voice notes, and can draw images for social posts
• Google: Firebase Authentication (sign-in), Gemini (images), Veo (video), Google Places (business lookup for the business scan and for Auto Outreach), and Google Analytics and Google Ads tags on convoro.org
• Google / YouTube Data API: Publishing videos to and replying to comments on a YouTube channel you connect — see Google & YouTube API Services below
• Meta Platforms: The WhatsApp Business Platform, Facebook and Instagram, for the accounts you connect
• X and TikTok: Posting to the X and TikTok accounts you connect, replying to mentions on X, and reading the profile of an X account when a business scan includes it
• ElevenLabs: Voices for WhatsApp voice-note replies, video narration and music, and phone calls
• Vapi: Places, records and transcribes phone calls, using Deepgram for speech-to-text and Twilio for phone numbers
• fal.ai: Animated video generation
• Stripe: Payment processing
• Resend and SiteGround: Email delivery for notifications, booking emails and outreach campaigns
• Vercel: Application hosting and deployment, putting videos together, and storage of images, videos and uploads
• Neon: Database hosting and management
• OpenStreetMap and public web search: Finding businesses and their websites for Auto Outreach

Each third-party service has its own privacy policy governing their use of data. We encourage you to review their policies.

6. Data Sharing

We do not sell your personal data. We only share information in the following circumstances:

• With third-party service providers as necessary to operate the Service (as listed above)
• To comply with legal obligations, court orders, or government requests
• To protect the rights, property, or safety of TechMasons LTD, our users, or the public
• In connection with a merger, acquisition, or sale of assets (with notice to users)

7. Visitor Data & Consent

When people chat with your website widget, message your WhatsApp number or comment on your connected accounts, Convoro processes their messages and any details they choose to share on your behalf. Visitors voluntarily provide their name, email, and phone number. The chat widget does not display a privacy notice of its own. As the business owner, you are responsible for ensuring your collection and use of this data complies with applicable privacy laws in your jurisdiction, including telling your visitors how it is used.

8. Cookies

We use browser storage to remember your cookie choice, keep you signed in and keep your chat conversation going, and, only if you accept, Google Analytics cookies. For detailed information, please see our Cookie Policy.

9. Your Rights

Depending on your jurisdiction, you may have the following rights:

• Access: Request a copy of the personal data we hold about you
• Rectification: Request correction of inaccurate or incomplete data
• Deletion: Request deletion of your personal data (see our Data Deletion Instructions)
• Portability: Request your data in a machine-readable format
• Objection: Object to processing of your personal data
• Withdrawal of Consent: Withdraw previously given consent at any time

To exercise any of these rights, contact us at support@convoro.org.

10. Data Retention

We retain your data for as long as your account is active. If you cancel your subscription, we will retain your data for up to 30 days before permanent deletion. Chat conversation data and lead data are retained for the duration of your subscription. You may request earlier deletion by contacting support.

11. Children’s Privacy

The Service is not intended for children under 16 years of age. We do not knowingly collect personal data from children. If you become aware that a child has provided us with personal data, please contact us so we can take steps to remove such information.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or through the Service. We encourage you to review this policy periodically.

13. Google & YouTube API Services

If you choose to connect a YouTube channel, Convoro uses the YouTube Data API v3 to publish videos to that channel and to read and reply to comments on the videos Convoro publishes for you. Connecting is entirely optional and nothing happens until you authorise it.

What we access. Only your channel’s public identity (channel name, handle and ID), the videos Convoro itself publishes for you, and the comments on the five most recent of those videos. We do not access your watch history, subscriptions, private playlists, or any other Google product.

What we store. Your channel name and ID; an encrypted access and refresh token so Convoro can post on your behalf without asking you to sign in each time; and, for each comment Convoro handles, the commenter’s display name, the comment text and the reply Convoro drafted or posted, so you can review them in your dashboard.

Limited Use. Convoro’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell this data, do not use it for advertising, and do not allow humans to read it except with your explicit permission, for security purposes, to comply with applicable law, or where the data is aggregated and anonymised.

Revoking access. Disconnect YouTube at any time from Social → Connections in your dashboard: Convoro stops using the channel and deletes its stored access and refresh tokens. Revoking Convoro’s access at myaccount.google.com/permissions also invalidates every token we hold for it.

Your use of YouTube through Convoro is also governed by the YouTube Terms of Service and the Google Privacy Policy.

14. Contact Us

If you have questions or concerns about this Privacy Policy, please contact us at: