Privacy Policy

Last updated: 5 August 2026

convrt provides AI customer-care software to businesses in Qatar and the wider Gulf. This policy explains what personal data we handle, why, who we share it with, and how you can have it deleted.

1. Who we are

convrt ("convrt", "we", "us") operates the software available at convrt.qa and app.convrt.qa. We are based in Qatar.

For any privacy question or request, contact privacy@convrt.qa.

2. Two different groups of people

It matters which one you are, because our role differs.

Client businesses — businesses that sign up for convrt and connect their Instagram or Facebook account. For their account data, we are the data controller.
Customers of those businesses — people who send a message or comment to a business that uses convrt. For that data, the business is the controller and we are their processor. We handle it on their instructions, and requests about it are usually best directed to the business — though you may also contact us and we will help.

3. What we collect

From client businesses

Account details: name, email address, business name, language preference, time zone.
Business information you provide: description of the business, services, hours, prices, uploaded documents and images, and any other content added to your knowledge base.
Connection credentials: access tokens for the Instagram or Facebook accounts you connect, and the associated account and page identifiers.
Usage and billing records: message counts, plan, subscription status.

From customers who message a business using convrt

We receive this from Meta when you message a business that uses our software:

Your platform user ID, display name, username and profile picture URL.
The content of your messages and comments — text, images, and voice notes — along with timestamps.
Information you volunteer in conversation, such as a booking time or a request. Where a booking is made, we store the appointment details.
AI-generated summaries and sentiment labels derived from your conversation, used to help the business respond.

Please don't send sensitive personal information — ID or passport numbers, payment card details, or health information — in a message to a business using convrt. Our software is not designed to handle it, and we ask businesses not to request it.

4. How we use it

To generate replies. Message content and relevant business information are sent to an AI model to draft a response on the business's behalf.
To understand images and voice notes. Images sent in a conversation are analysed so the reply can address them. Voice notes are transcribed to text.
To summarise conversations so the business can pick up context quickly.
To schedule appointments where the business uses that feature.
To operate and secure the service — authentication, usage limits, billing, diagnostics and abuse prevention.

We do not sell personal data. We do not use the content of customer conversations to train our own AI models, and our AI providers are engaged under terms that do not permit training on this data.

5. Who we share it with

We use a small number of sub-processors. Each receives only what it needs.

Provider	Purpose
Anthropic	Generating replies, summaries and image understanding
OpenAI	Search indexing of business knowledge; document understanding; backup transcription
Google Cloud	Voice note transcription; sign-in with Google
Supabase	Database and file storage
Vercel	Application hosting
Meta Platforms	Source of messages and comments; delivery of replies
Resend	Transactional and alert email
Whop	Subscription payments (card details go to them, never to us)

We may also disclose data where required by law, or to protect our rights or the safety of others.

6. Where data is stored

Our primary database and file storage are hosted with Supabase in the Seoul region (ap-northeast-2). Our application is hosted with Vercel. Our AI and email providers operate primarily in the United States. This means personal data is transferred outside Qatar and processed in other countries.

7. Meta Platform Data

Data we receive through Meta's Instagram and Facebook APIs is used solely to provide the service to the connected business — reading incoming messages and comments, and sending replies. We use it in accordance with Meta's Platform Terms and Developer Policies. We do not sell it, transfer it to data brokers, or use it for advertising.

A business can disconnect its Instagram or Facebook account from convrt at any time in the dashboard settings, or by removing convrt's access in their Meta account settings. Once disconnected, we stop receiving new data from that account.

8. How long we keep it

Conversations and messages are retained for as long as the business's account is active, because the business relies on the history.
Account and billing records are retained while the account is active and for a reasonable period afterwards for legal and accounting purposes.
Access tokens are deleted when an account is disconnected.
When a business closes its account, we delete or anonymise its data — including its customers' conversations — within 90 days, unless we are required to keep it longer.

9. Your rights, and how to delete your data

You can ask us to access, correct, export or delete your personal data, and to object to or restrict certain processing.

To request deletion, email privacy@convrt.qa with the subject line "Data deletion request". Tell us the Instagram or Facebook account you messaged from, and the business you were messaging.

We will confirm receipt within 7 days and complete verified requests within 30 days. There is no charge.

If you are a customer of a business using convrt, we will pass your request to that business, since the conversation is theirs. We will act on it either way.

10. Security

Access tokens and other credentials are stored encrypted. Access to production data is limited to those who need it. Database access is protected by row-level security so that one business cannot read another's data. No system is perfectly secure, and we cannot guarantee absolute security.

11. Children

convrt is a tool for businesses and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child's data has reached us, contact privacy@convrt.qa and we will delete it.

12. Changes to this policy

We may update this policy. We will change the date at the top, and for significant changes we will notify client businesses by email before the change takes effect.

13. Contact

Privacy questions and requests: privacy@convrt.qa
General support: support@convrt.qa