Last updated: March 26, 2026
Ooh Marketing Limited ("Convoo", "we", "us", or "our") is committed to protecting the privacy and security of your personal data. This Privacy Policy explains how we collect, use, store, and protect your information when you use our platform at convoo.io and related services.
We are registered in England and Wales under company number [Company Number]. Our registered office is in London, United Kingdom.
We collect the following categories of information:
Account Information: Name, email address, phone number, business name, and business type when you create an account.
Business Data: Business descriptions, services, FAQs, working hours, and other information you provide to train your AI chatbot.
Customer Contact Data: Phone numbers, names, and message histories of your WhatsApp customers, processed on your behalf.
Usage Data: How you interact with our platform, features you use, pages you visit, and performance metrics.
Payment Information: Processed securely by Stripe. We do not store card details on our servers.
We use your information to provide and improve our services, including:
Operating your AI chatbot and processing WhatsApp messages on your behalf. Managing your account, subscriptions, and billing. Sending service updates, security alerts, and support messages. Analysing platform usage to improve features and performance. Complying with legal obligations and preventing fraud.
We will never sell your personal data or your customers' data to third parties.
We share data only with the following parties and only as necessary:
Meta (WhatsApp): To send and receive messages via the WhatsApp Business API.
OpenAI: To process AI chatbot responses. Messages are sent without identifying information where possible.
Stripe: To process subscription payments.
Clerk: For authentication and user management.
We retain your account data for as long as your account is active. Message data is retained for 12 months unless you request earlier deletion. If you close your account, we will delete your data within 30 days, except where retention is required by law.
Under GDPR and UK data protection law, you have the right to access, correct, delete, or port your personal data. You may also object to or restrict processing. To exercise any of these rights, email us at privacy@convoo.io.
We implement industry-standard security measures including encryption in transit (TLS 1.3), encryption at rest, regular security audits, access controls, and secure infrastructure hosted on SOC 2-compliant providers.
We use essential cookies for authentication and session management. We use analytics cookies only with your consent to understand platform usage. You can manage cookie preferences through your browser settings.
For privacy-related questions or to exercise your data rights, contact our Data Protection Lead at privacy@convoo.io.