Privacy Policy

• Account details: your name, email, phone number, password (stored hashed) and role.
• Business data: business name, branches, products, prices, stock, suppliers, orders and website content.
• Conversations: WhatsApp messages, images, voice notes and documents exchanged with your customers, plus the customer's name and phone number.
• Payment slips and receipts your customers send, and the payment details you add for them.
• Device data: push notification tokens and basic app diagnostics.
• Billing data: your plan, usage and payment history. Card details are handled by Paddle and never reach our servers.

• To run the service: deliver messages, generate AI replies, create orders, verify payments and update stock.
• To remember context for each customer so replies stay consistent across conversations.
• To send the notifications and emails you have turned on.
• To bill you, prevent abuse, and provide support.

When your customers message your business, you decide what happens with their data and we process it on your behalf. Businesses using Convo are responsible for telling their customers how their messages are handled. Customers who want their data removed should contact the business, which can ask us to delete it.

AI replies, receipt reading and knowledge search are powered by OpenAI through its API. Messages and files needed for a reply are sent to OpenAI for processing. Under OpenAI's API terms that data is not used to train their models. We do not use your data to train any AI model either.

We do not sell personal data. We share it only with the providers we need to run Convo:

• Meta (WhatsApp Business Platform) to send and receive messages.
• OpenAI for AI replies and document reading.
• Supabase for our database and file storage.
• Paddle for card payments, invoices and tax.
• Google Firebase and Expo to deliver push notifications.
• Our email provider to send alerts you have turned on.
• Our cloud hosting provider for the servers that run the service.

We may also disclose data if the law requires it.

Our providers store data in data centres outside Sri Lanka, including the EU and the United States. We use providers that protect data with encryption in transit and at rest and appropriate contractual safeguards.

We keep your data while your account is active. When you delete your account, we delete your business data within 30 days, except billing records we must keep for tax and accounting, which are kept for up to 7 years. Backups roll over within a further 30 days.

You can see and edit most of your data in the app. You can also ask us for a copy, a correction or deletion, or object to how we use it, by emailing support@zudox.online. See delete your account for how to close your account.

Access to business data is limited by role, passwords are hashed, and connections use HTTPS. No system is perfectly secure, so please use a strong password and tell us about anything suspicious.

Convo is a business tool and is not meant for anyone under 18. We do not knowingly collect data from children.

If we change this policy in a meaningful way, we will tell you in the app or by email before it takes effect.