Privacy Policy

1. Two relationships, two roles

• Our customers’ account data — when a business signs up for Convo, we are the Data Fiduciary for that account holder’s details, and this policy governs it.
• End-user conversation data — when a website visitor chats with or calls a customer’s Convo bot, the customer is the Data Fiduciary for that visitor’s data, and HOXE acts as their Data Processor, processing it on their instructions under our Data Processing Agreement.

2. The data we collect

• Account data — business name, your name, work email, and login credentials.
• Knowledge-base content — the product info, FAQs and links a customer provides to train their bot.
• Conversation data — chat messages, voice-call audio/transcripts, and contact details (name, phone, email) a visitor shares, processed on the customer’s behalf.
• Billing data — subscription and credit records. Card details are handled by our payment provider; we do not store them.
• Usage & technical data — device/browser info, IP address and logs. See our Cookie Policy.

3. How we use data

• To run the chat and voice service — understand questions, answer from the customer’s knowledge base, capture and score leads, and hand serious buyers to the customer’s team.
• To manage accounts, process subscriptions and provide support.
• To secure the service, prevent abuse and meet legal obligations.
• To send service and (with consent) marketing messages to account holders, who can opt out anytime.

4. AI & voice processing

Convo uses AI models and a voice provider to generate replies and run calls. Relevant message text, the customer’s knowledge base and call audio are processed by the sub-processors listed below to deliver each answer. Voice calls are disclosed as AI and may be recorded for quality and record-keeping, consistent with the customer’s configuration and applicable law.

5. Who we share data with

We do not sell personal data. We use sub-processors under contracts requiring them to protect it:

• Supabase — Database, authentication & storage (Cloud (confirm region) [VERIFY]).
• Vercel — Application & widget hosting (USA / global edge).
• Google (Gemini) — AI model that powers chat & voice replies (Global).
• Vapi — Voice agent orchestration & telephony for Call-now (USA / global [VERIFY]).
• Sarvam — Speech (STT/TTS) and language model for voice replies (India [VERIFY]).
• LiveKit — Real-time audio transport for voice calls (Global [VERIFY]).
• Upstash — Rate-limiting & ephemeral queue/cache (Redis) (Global [VERIFY]).
• Dodo Payments — Subscription billing as Merchant of Record (handles tax and issues your invoice) (Global).
• Resend — Transactional & notification emails (USA).

We may also disclose data where required by law or lawful authority, and in connection with a business transfer.

6. International transfers

Some sub-processors operate outside India. Transfers are made in line with the DPDP Act and only to destinations not restricted by the Government of India.

7. Retention

Account data is kept while the account is active and as needed for legal and accounting obligations. Conversation data is retained per the customer’s settings and our agreement with them, then deleted or anonymised when no longer needed.

8. Security

We use reasonable safeguards — encryption in transit, access controls, reputable hosting and logging — and will notify the Data Protection Board of India and affected individuals of a personal-data breach where the law requires.

9. Your rights

Under the DPDP Act you can access, correct, complete, update or erase your personal data, nominate someone to act for you, and seek grievance redressal. Account holders can email privacy@hoxe.net. End-users should contact the website they interacted with, or us — we will route the request to the responsible customer.

10. Children

Convo is a business tool not intended for anyone under 18, and we do not knowingly process children’s data or target advertising at children.

11. Grievance Officer

12. Changes & contact

We may update this policy and will change the “Last updated” date above. Questions? Email privacy@hoxe.net.