Privacy Policy

1. Who we are

ConvoRail ("ConvoRail," "we," "us," or "our") provides an AI-powered customer messaging platform that lets a business ("tenant," "you") answer questions from its website visitors and customers, and optionally connect email and messaging channels such as Gmail, Outlook, Facebook Messenger, Instagram, and WhatsApp so those conversations can be read and replied to from one inbox. This policy explains what personal data we collect, why, how it is processed and stored, who it may be shared with, and the choices and rights available to you and to the end users who message your chatbot or connected channels.

2. Data we collect

We collect the following categories of data:

• Account data. Name, email address, and password (stored as a salted hash, never in plain text) when you sign up or when a staff member is added to your account.
• Knowledge base content. The Q&A pairs, documents, and other content you add so your AI agent can answer accurately.
• Conversation data. Messages sent by your website visitors and customers to your chatbot, the replies it generates, and — for connected channels — inbound messages received and outbound replies sent through Gmail, Outlook, Facebook Messenger, Instagram, and WhatsApp.
• Connected-channel credentials. OAuth refresh tokens and access tokens for any email or messaging account you connect. These are encrypted at rest and are never shown back to you or anyone else in plain text after you enter them.
• Usage and product data. Message volume, Q&A pairs used, feature usage, and similar counters shown on your dashboard, used to operate the product and enforce plan limits.
• Billing data. Subscription plan, billing history, and payment status. Card and payment details are collected and processed directly by our payment processor (Razorpay) — we do not store your full card number.
• Technical data. IP address, browser type, device information, and log data generated when you or your website visitors use ConvoRail, used for security, debugging, and abuse prevention.

3. How we use this data

We use the data described above to:

• Operate the chatbot and unified inbox, and generate AI replies grounded in your knowledge base.
• Send and receive messages through the email or messaging channels you connect.
• Authenticate you, secure your account, and prevent fraud or abuse.
• Process billing and communicate about your subscription.
• Provide customer support and respond to your requests.
• Maintain, debug, and improve product reliability and performance.
• Meet legal, tax, and regulatory obligations.

We do not use your conversation or knowledge base content to train models for anyone outside your own account, and we do not use it for advertising or ad targeting.

4. Legal basis for processing (EEA/UK users)

Where the GDPR or UK GDPR applies, we rely on the following legal bases: performance of a contract (operating the account and service you signed up for), legitimate interests (security, fraud prevention, and product improvement), consent (where you explicitly opt in, such as connecting a channel), and legal obligation (tax and regulatory recordkeeping).

5. Sub-processors and third parties we use

We share data with the following categories of service providers, each bound by a contract to process data only on our instructions and to appropriate security standards:

• OpenAI — processes chat messages to generate AI replies.
• Google, Microsoft, and Meta — process messages sent and received through Gmail, Outlook, Facebook Messenger, Instagram, and WhatsApp when you connect those channels.
• Razorpay — processes subscription payments and billing.
• Resend — delivers transactional email (verification, password reset, notifications).
• Railway and Supabase — host our application infrastructure and database.
• Vercel — hosts our web application front end.

We do not sell your data, and we do not share it with third parties for their own advertising or profiling purposes.

6. Data storage, isolation, and security

Each tenant's knowledge base, conversation history, and connected-channel data is stored in our database scoped to that tenant; one account's data is never exposed to another account. Passwords are hashed, not stored in plain text. Connected-channel OAuth tokens and other credentials are encrypted at rest. Data in transit is protected with HTTPS/TLS. Access to production data is limited to personnel who need it to operate and support the service.

7. International data transfers

Our infrastructure and sub-processors may process data outside your own country, including in the United States. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses for these transfers.

8. Data retention

We retain account, knowledge base, and conversation data for as long as your account is active. If you close your account, we delete or anonymize this data within a reasonable period thereafter, except where we are required to retain it longer for legal, tax, billing, or security purposes. Disconnecting a channel deletes its stored access token immediately; previously synced messages remain part of your conversation history unless you request their deletion.

9. Cookies

We use only the cookies needed to keep you signed in to the dashboard and to keep the website chat widget session working. We do not set third-party advertising or analytics cookies today. If that changes, this policy will be updated first.

10. Your rights

Depending on where you are located, you may have the right to access, correct, export, or delete your personal data, object to or restrict certain processing, and withdraw consent at any time (for example, by disconnecting a channel). To exercise any of these rights, contact us using the details below. We will respond within the timeframe required by applicable law.

11. End users of your chatbot and connected channels

If you use ConvoRail to talk to your own customers, you are responsible for having a lawful basis to process their messages and for your own privacy notice to them. We act as a data processor on your behalf for that conversation data, processing it only to provide the service to you.

12. Children's privacy

ConvoRail is a business-to-business product and is not directed to children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, contact us and we will delete it.

13. Changes to this policy

We may update this policy from time to time. We will update the "Last updated" date above, and for material changes we will provide additional notice such as an email or an in-product notification.

14. Contact

Questions or requests about this policy, or about your data: convo.rail.ai@gmail.com.