ConvoraConvora

Privacy Policy

Last updated: October 23, 2026

This Privacy Policy describes how Convora Labs LLP ("we," "us," or "our"), operating Convora CRM (accessible at crm.convora.io), collects, uses, and protects your personal information when you use our platform.

1. Information We Collect

1.1 Account Information

When you create an account or are invited to a workspace, we collect:

  • Full name and email address
  • Password (stored securely using bcrypt hashing)
  • Organization and team membership details
  • Role and permission level within your workspace

1.2 Lead Data

Data submitted through webhooks, lead forms, or third-party integrations (e.g., Meta Lead Ads, Google Ads) is collected on behalf of the workspace owner. This may include:

  • Contact information (name, email, phone number)
  • Form submission data and custom fields
  • Source attribution data (campaign, ad set, platform)
  • Interaction history and status changes

1.3 Integration Data

When you connect third-party services (Meta, Google Ads), we store:

  • OAuth access tokens and refresh tokens
  • Page IDs, Pixel IDs, and ad account identifiers
  • Conversion event data sent via APIs

1.5 Instagram Data

When you connect your Instagram Professional account, we collect and process:

  • Instagram account information (username, user ID, account type, profile picture URL)
  • Instagram Direct Messages (DMs) sent and received through our automation features
  • Instagram comments on your posts that trigger automated responses
  • Commenter and message sender identifiers (Instagram-Scoped User IDs)
  • Email addresses voluntarily provided by Instagram users through our DM automation flows
  • Engagement metrics and automation performance data (messages sent, comments replied, emails captured)

1.4 Usage Data

We automatically collect:

  • Log data (IP address, browser type, access times)
  • Activity within the platform (pages visited, actions performed)
  • Device and browser information

2. How We Use Your Information

We use the information we collect to:

  • Provide, maintain, and improve Convora CRM
  • Authenticate users and manage workspace access
  • Process and route leads according to assignment rules
  • Send conversion events to advertising platforms on your behalf
  • Send transactional emails (OTP codes, notifications)
  • Monitor platform performance and troubleshoot issues
  • Comply with legal obligations
  • Automate Instagram DM responses based on comment keywords and message triggers configured by the workspace owner
  • Display Instagram DM conversations in our inbox for business owners to manage and reply
  • Provide automation performance analytics using aggregated and de-identified data

3. Data Processing & Storage

  • Your data is stored on secure servers hosted on our infrastructure
  • We use PostgreSQL with encrypted connections for all database operations
  • Passwords are hashed using bcrypt and are never stored in plain text
  • Access tokens for third-party integrations are stored securely in our database
  • All data transmission uses HTTPS/TLS encryption

4. Data Sharing

We do not sell your personal information. We may share data with:

  • Third-party platforms — When you connect integrations (Meta, Google), conversion data is sent to those platforms as configured by the workspace administrator
  • Service providers — Hosting (Vercel), database hosting, and email delivery services that help us operate the platform
  • Legal requirements — When required by law, regulation, or legal process
  • Instagram/Meta Platform — When you use Instagram automation features, messages and comment replies are sent through Meta's Instagram API on your behalf. We do not sell, share, or transfer Instagram user data to any third party other than Meta as required for the API to function. Instagram insights and analytics data is used solely in aggregated and de-identified form within your workspace dashboard and is never shared with third parties for advertising or marketing purposes.

5. Data Retention

  • Account data is retained as long as your account is active
  • Lead data is retained as long as the workspace exists or as configured by the workspace admin
  • Activity logs are retained for operational purposes
  • Upon account or workspace deletion, data is permanently removed within 30 days
  • Instagram DM conversations and messages are retained as long as the workspace exists
  • Instagram contact data (captured emails) is retained until deleted by the workspace admin or upon workspace deletion
  • Instagram automation logs are retained for analytics purposes and deleted with the workspace

6. Your Rights

You have the right to:

  • Access the personal data we hold about you
  • Request correction of inaccurate data
  • Request deletion of your account and associated data
  • Export your lead data
  • Withdraw consent for optional data processing
  • Object to processing of your personal data

To exercise these rights, contact us at support@convora.io.

7. Data Security

We implement appropriate technical and organizational measures to protect your data, including:

  • Encryption in transit (TLS) and at rest
  • Role-based access control within the platform
  • Multi-tenant data isolation (each workspace's data is logically separated)
  • Regular security reviews and monitoring
  • Secure authentication with JWT session management

8. Third-Party Services

Convora CRM integrates with third-party services that have their own privacy policies:

  • Meta (Facebook/Instagram) — for lead ads, conversion tracking, Instagram comment automation, and Instagram Direct Message management via the Instagram API with Instagram Business Login
  • Google Ads — for conversion tracking
  • Vercel — for application hosting

We encourage you to review the privacy policies of these services.

9. Children's Privacy

Convora CRM is not intended for use by individuals under 18 years of age. We do not knowingly collect personal information from children.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of material changes by posting the updated policy on this page with a new "Last updated" date.

11. Contact Us

If you have questions about this Privacy Policy, please contact us: