Privacy Policy

1. Introduction

Convotic ("Company," "we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Instagram-HubSpot integration service ("Service"). By using the Service, you consent to the data practices described in this policy.

Please read this Privacy Policy carefully. If you do not agree with the terms of this Privacy Policy, please do not access the Service.

2. Information We Collect

2.1 Information You Provide Directly

• Account Information: Email address, name, and password when you create an account
• Payment Information: Billing details processed securely through our third-party payment processor (Stripe). We do not store your full credit card information.
• Communications: Information you provide when you contact us for support

2.2 Information from Third-Party Services

When you connect your accounts, we may receive:

• Instagram Data: Instagram Business account ID, username, profile information, and direct message conversations for the purpose of syncing to HubSpot
• HubSpot Data: Contact records, company information, and CRM data as necessary to provide the integration service

2.3 Automatically Collected Information

• Log Data: IP address, browser type and version, operating system, referring URLs, access times, and pages viewed
• Device Information: Device type, unique device identifiers, and mobile network information
• Usage Data: Features used, actions taken, and interaction patterns within the Service
• Cookies and Tracking Technologies: We use cookies and similar technologies to maintain sessions and analyze usage

3. How We Use Your Information

We use the information we collect for the following purposes:

• To provide, maintain, and improve the Service
• To sync your Instagram conversations to HubSpot as you have authorized
• To process payments and manage your subscription
• To send service-related communications (e.g., updates, security alerts)
• To respond to your requests, comments, and support inquiries
• To detect, prevent, and address technical issues, fraud, or abuse
• To comply with legal obligations
• To analyze usage patterns and improve our Service

4. Legal Basis for Processing (GDPR)

If you are in the European Economic Area (EEA), our legal basis for collecting and using your information includes:

• Contract: Processing necessary to perform our contract with you (providing the Service)
• Consent: Where you have given consent for specific processing activities
• Legitimate Interests: Processing necessary for our legitimate business interests, such as improving our Service and preventing fraud
• Legal Obligation: Processing necessary to comply with applicable laws

5. Data Sharing and Disclosure

We do not sell, rent, or trade your personal information. We may share your information in the following circumstances:

• Service Providers: Third-party vendors who assist us in operating the Service (e.g., Stripe for payment processing, Google Cloud for hosting, Firebase for authentication). These providers are contractually obligated to protect your information.
• Connected Services: Instagram (Meta) and HubSpot as necessary to provide the integration functionality you have authorized
• Legal Requirements: When required by law, court order, or governmental authority, or when we believe disclosure is necessary to protect our rights, your safety, or the safety of others
• Business Transfers: In connection with a merger, acquisition, bankruptcy, or sale of assets, your information may be transferred as a business asset
• With Your Consent: When you have given us explicit consent to share your information

6. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Service. We may also retain information as necessary to comply with legal obligations, resolve disputes, and enforce our agreements. When you delete your account, we will delete or anonymize your personal information within 30 days, except where retention is required by law.

7. Data Security

We implement appropriate technical and organizational security measures to protect your information, including:

• Encryption of data in transit using TLS/SSL
• Encryption of sensitive data at rest
• Secure authentication through Firebase Authentication
• Regular security assessments and updates
• Access controls and audit logging
• Employee training on data protection

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security. YOU ACKNOWLEDGE THAT YOU PROVIDE YOUR INFORMATION AT YOUR OWN RISK.

8. Your Rights and Choices

Depending on your location, you may have the following rights:

• Access: Request access to the personal data we hold about you
• Correction: Request correction of inaccurate or incomplete data
• Deletion: Request deletion of your personal data
• Portability: Request a copy of your data in a portable format
• Restriction: Request restriction of processing in certain circumstances
• Objection: Object to processing based on legitimate interests
• Withdraw Consent: Withdraw consent at any time where processing is based on consent

To exercise these rights, please contact us at privacy@convotic.com. We will respond to your request within 30 days.

9. California Privacy Rights (CCPA)

If you are a California resident, you have the right to:

• Know what personal information we collect, use, disclose, and sell
• Request deletion of your personal information
• Opt-out of the sale of your personal information (we do not sell personal information)
• Non-discrimination for exercising your privacy rights

To exercise your California privacy rights, contact us at privacy@convotic.com or use the data deletion feature in your account settings.

10. Instagram and Meta Data Usage

We access Instagram data solely to provide the integration service you have authorized. Specifically:

• We access direct messages only to sync them to your HubSpot account
• We do not store message content longer than necessary for syncing (typically processed in real-time)
• We do not use Instagram data for advertising, profiling, or marketing purposes
• We do not share Instagram data with third parties except as necessary for the integration (i.e., HubSpot)
• We comply with Meta's Platform Terms and Developer Policies

You can revoke our access to your Instagram data at any time through your Instagram settings or by disconnecting the integration in the Service.

11. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence, including the United States, where data protection laws may differ. By using the Service, you consent to such transfers. We implement appropriate safeguards, including standard contractual clauses, to protect your information during international transfers.

12. Children's Privacy

The Service is not directed to children under 16 years of age. We do not knowingly collect personal information from children under 16. If we become aware that we have collected personal information from a child under 16, we will take steps to delete such information promptly. If you believe we have collected information from a child under 16, please contact us at privacy@convotic.com.

13. Third-Party Links

The Service may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party sites you visit.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new Privacy Policy on this page and updating the "Last updated" date. For significant changes, we may also send you an email notification. Your continued use of the Service after changes constitutes acceptance of the updated Privacy Policy.

15. Data Deletion

To request deletion of your data, you can:

• Delete your account from the Settings page in the Service
• Contact us at privacy@convotic.com
• Use the automated data deletion callback (for Instagram data removal requests from Meta)

Upon receiving a deletion request, we will delete your personal information within 30 days, except where retention is required by law or for legitimate business purposes (e.g., fraud prevention, legal claims).

16. Contact Us

If you have questions, concerns, or complaints about this Privacy Policy or our data practices, please contact us at:

• Email: privacy@convotic.com

If you are in the EEA and believe we have not adequately addressed your concerns, you have the right to lodge a complaint with your local data protection authority.