Privacy Policy

Conversio is a service for businesses. When it is used, the following data is processed:

• Business user accounts: name and email address.
• Connected Instagram and WhatsApp Business accounts (via the Meta APIs): account ID, username, name and profile picture.
• Connected Google accounts (via the Google Calendar API): see Section 5.
• People who write to a business: the content of their messages and sender data (ID, name, profile picture).
• Lead data maintained by the business in Conversio, including appointments booked through Conversio.

We process this data solely to provide and improve the user-facing features of the service to the respective business: the inbox, AI-assisted replies, lead management and appointment booking.

We do not sell data, we do not use it for advertising, and we do not share it with anyone other than the processors listed in Section 7.

Data we receive from the Meta APIs is used only in accordance with the Meta Platform Terms and only to provide the service to the business that connected the respective account.

A business can connect a Google account to let Conversio check availability and book appointments in its Google Calendar.

What we access and why:

• Email address and Google account identifier (openid, userinfo.email): to show which Google account is connected to a board.
• Free/busy information (calendar.freebusy): to find open time slots. We do not read the titles, descriptions or attendees of existing events through this access.
• Calendar events (calendar.events.owned): to create, reschedule and cancel the appointments that leads book through Conversio. Conversio only modifies or deletes events it created itself.

How we use it:

• Google user data is used only to provide and improve the appointment-booking feature for the business that connected the account.
• Available time slots and the details of the appointment being booked, rescheduled or cancelled (date, time, meeting link) are passed to our AI provider solely so the assistant can offer slots and confirm changes in the conversation with the lead. The lead's name from the conversation is used as part of the event title in Google Calendar.

What we do not do:

• We do not sell Google user data.
• We do not use or transfer Google user data for advertising, including retargeting, personalized or interest-based ads.
• We do not use Google user data to determine creditworthiness or for lending purposes.
• We do not use Google user data to develop, improve or train generalized AI or machine-learning models, and our AI providers process it under terms that do not permit training on it.
• We do not transfer Google user data to third parties, except to the processors in Section 7 as needed to provide the feature, to comply with applicable law, or as part of a merger or acquisition with the user's notice.
• No human reads Google user data unless the business gives us explicit consent for specific data (e.g. for support), it is necessary for security purposes (e.g. investigating abuse), or it is required by law.

Conversio's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Revoking access: The business can disconnect Google Calendar at any time in the board settings (Integrations). Disconnecting deletes the token from our systems immediately and revokes it with Google, unless the same Google account is still connected to another board. Access can also be revoked at https://myaccount.google.com/permissions.

To generate replies, message content and the context needed for the conversation (such as lead data and available appointment slots) are processed by our AI providers. We use their APIs under terms that do not allow them to use this data to train their models.

• Meta Platforms: messaging APIs (Instagram, WhatsApp).
• Google: Google Calendar API; Gemini as an AI provider.
• OpenAI and Groq: AI processing of message content to generate replies.
• Cloudflare R2: file storage.
• Vercel Inc., USA: server hosting.

• Encryption in transit: all connections to Conversio and to the APIs we use are encrypted with TLS (HTTPS).
• Encryption at rest: OAuth and access tokens (Google, Meta) are stored encrypted using AES-256-GCM with a key kept separately from the database.
• Access control: a board's data is only accessible to the members of that board; requests to other tenants' data are rejected.
• Least privilege: we only request the Google scopes needed for appointment booking.
• Restricted internal access: production systems and databases are accessible only to authorized administrators via authenticated, encrypted connections.
• Revocation and deletion: disconnecting an integration deletes its tokens from our systems immediately. A Google Calendar token is also revoked with Google, unless the same Google account is still connected to another board.

Data is kept as long as the account is active or until a deletion request is made. After a channel or Google Calendar is disconnected, no new data is received from it and its tokens are deleted immediately; a Google Calendar token is also revoked with Google, unless the same Google account is still connected to another board. Appointment records created through Conversio remain in the lead history until the business deletes the lead or the account. On account deletion, all associated data is deleted within 30 days. Details: Data Deletion Instructions.

You may request access to, correction of, or deletion of your data, object to its processing, or lodge a complaint with a supervisory authority. Contact: info@trsales.net.

We will update this page if our data practices change and adjust the “Last updated” date.