Security and data

How Convoro handles your data

Convoro, the AI assistant that answers your website chat, WhatsApp and social comments, handles your customers’ messages. This page says what it stores, which services process it and what it doesn’t do, and only what is true today.

In short

The basics

Run by a UK company

Convoro is operated by TechMasons LTD, registered in England and Wales (company no. 14843665).

HTTPS throughout

The site, the dashboard, the chat widget and Convoro’s API are all served over HTTPS.

Connected accounts encrypted

Access tokens for the WhatsApp, Facebook, Instagram, X, YouTube and TikTok accounts you connect are stored encrypted with AES-256-GCM.

Cards held by Stripe

Stripe collects and holds your card details. Convoro keeps the card brand, last 4 digits, expiry date and Stripe’s reference to the card.

Health data

HIPAA and patient information

Convoro is not designed for HIPAA-regulated patient records and does not sign Business Associate Agreements (BAAs) at present.

If you run a clinic: set Convoro up to take contact details and appointment requests only, and don’t ask patients for medical information in chat, on WhatsApp or on calls. Convoro also doesn't hold SOC 2, ISO 27001 or any other security certification.

What Convoro stores

What is stored

Your account: Name and email, with sign-in handled by Firebase Authentication (Google, Facebook, or email and password).
Your business profile: Services, prices, branches, hours and other details you enter or that the business scan collects from your website and public profiles. You can edit all of it.
Conversations and leads: Messages on website chat and WhatsApp, social comments and Convoro’s replies, and the contact details people choose to give.
Bookings: Booking requests taken in conversations or on calls, with their status.
Calls: For the voice agent (Pro): a link to each call’s recording, and its transcript, length, outcome and cost.
Social posts: Your posts, schedules, brand kit, and the images and videos Convoro makes or you upload.
Auto Outreach: For Auto Outreach (Pro): business names, websites, public email addresses and phone numbers of the businesses found, any contacts you upload, and a list of addresses that have unsubscribed.
Billing: Your plan, AI usage and payment history.

Convoro runs on Vercel, with its database on Neon (Postgres) and images and videos in Vercel Blob.

Service providers

Who processes data

The outside services Convoro uses, and what each is used for. Most only see data for the features you turn on.

Service providers Convoro uses and what each does
Provider	Used for
Anthropic (Claude)	Writes Convoro’s replies on every channel, reads your website during the business scan, writes captions and video scripts, describes images sent on WhatsApp, and runs the voice agent’s side of each call.
OpenAI	Transcribes WhatsApp voice notes (Whisper) and draws images for social posts.
Google	Draws images (Gemini) and realistic video (Veo), connects YouTube channels, handles sign-in (Firebase Authentication), and runs Google Analytics and Google Ads tags on convoro.org, subject to your cookie choices.
fal.ai	Makes animated video (Kling).
ElevenLabs	Voices: WhatsApp voice-note replies, video narration and music, and the voice agent.
Shotstack	Assembles the final video.
Vapi	Places voice agent calls and records them, with Deepgram for speech-to-text and a Twilio number for international calls.
Meta	WhatsApp Business Platform, Facebook and Instagram, for the accounts you connect.
X and TikTok	Their APIs, for the accounts you connect.
Stripe	Card payments.
Resend and an SMTP provider	Send Convoro’s emails: booking emails, account emails and Auto Outreach emails.
Vercel	Hosts Convoro, and stores images and videos (Vercel Blob).
Neon	Hosts Convoro’s Postgres database.
OpenStreetMap	Searched (Nominatim and Overpass) to find businesses for Auto Outreach.

Your controls

What you control

Convoro answers only about your business, from the profile you can see and edit.
The chat widget asks only for the contact details you switch on: name, email and phone can each be turned off.
Comment replies on Instagram, Facebook, X and YouTube wait for your approval unless you switch an account to automatic.
You can pause Convoro in any WhatsApp chat and reply yourself.
You can disconnect any connected account from the dashboard at any time, or revoke Convoro's access from Meta, Google, X or TikTok directly.
Auto Outreach honours unsubscribes across every campaign. Its safeguards are on the Auto Outreach page.

FAQ

Security questions

Is Convoro HIPAA compliant?

No. Convoro is not designed for HIPAA-regulated patient records and does not sign Business Associate Agreements (BAAs) at present. If you run a clinic: set Convoro up to take contact details and appointment requests only, and don’t ask patients for medical information in chat, on WhatsApp or on calls.

Does Convoro have SOC 2 or ISO 27001 certification?

No. Convoro doesn’t hold SOC 2, ISO 27001 or any other security certification.

Is my conversation data used to train AI models?

Convoro doesn’t build or train its own AI models. To write each reply, your business profile and the conversation are sent to the AI provider through its API, and that provider’s terms govern how it handles the data.

Who holds my card details?

Stripe. When you add a card, Stripe collects and holds the card details. Convoro keeps the card brand, last 4 digits, expiry date and Stripe’s reference to the card.

Who on my team can see my data?

Everyone you add as a teammate gets full access to your business in the dashboard. There are no separate roles yet, so add only people you trust.

How do I delete my data?

Email support@convoro.org from the address on your account with the subject “Data Deletion Request”. There is no self-serve account deletion in the dashboard yet. See the data deletion page.

Questions or a security issue?

Email support@convoro.org about data protection, a request to access, correct or delete personal data, or a security problem you have found.

Try Convoro

Start a 7-day free trial. Connect only the channels you want, and disconnect them whenever you like.

Start your 7-day free trial