Convaa privacy policy

Who we are

Convaa is operated by:

This page covers the Convaa product and the convaa.ai website. Data443 publishes a separate corporate privacy policy covering its other products and sites. Where the two overlap, this page is the more specific one for Convaa.

What Convaa collects

• Account details. Your name, email address, and, if you choose to add one, a profile photo and a phone number. A phone number is optional and nothing in Convaa requires one.
• What you write and upload. Your prompts, messages, comments, uploaded files, and the sessions you create. This is the content of your work, and it is the reason the product exists.
• Workspace structure. Who is in a session, who invited whom, roles, and pending invitations.
• Usage and diagnostic data. Page views, errors, and request logs, used to keep the service up and to see which parts of it are used.
• Billing details for paid plans, handled by our payment processor. We do not store full card numbers.

What it is used for

• Running the product: showing your sessions, delivering messages between teammates, and producing answers.
• Notifying you about things that involve you, by email or, only if you turned it on, by text message.
• Keeping the service secure and reliable, including rate limits and abuse prevention.
• Billing, support, and required record keeping.

Your prompts, files and team knowledge are not used to train models, ours or anyone else’s, and are not shared with other customers.

Who else sees it

Convaa passes data to service providers only where it is needed to run the product:

• The model provider for your session (Anthropic by default) receives the prompts and attachments in that session in order to produce the answer.
• Supabase hosts the database, authentication and file storage.
• sent.dm delivers mention alerts and session invite text messages.
• Twilio, through Supabase, delivers login verification codes.
• Payment and email providers handle billing and transactional email.
• Google Analytics counts page views. The address we report is built explicitly rather than read off the browser URL: invite and share tokens are stripped out of the path, the fragment is dropped, and only campaign parameters survive from the query string, so what you typed into the query box does not reach it.

We do not sell personal information, and we do not hand it to anyone for their own marketing. We disclose data to law enforcement or a regulator only where the law requires it.

Phone numbers and SMS

Convaa sends three kinds of text message and nothing else: a login verification code you asked for, a mention alert you switched on and verified a number for, and a session invite sent to a number another user typed in. Each one, with its sender, its exact content, its frequency and the consent it rests on, is set out on the SMS terms page. That page is the authoritative description; this section is a summary.

• Consent. The mention alert is double opt-in: a toggle that is off by default, then a phone number verified by one time code. A login code is only sent to somebody who just typed their own number and asked for it. A session invite text rests on the person sending the invite attesting that they have permission to text that number; the recipient has not opted in with us directly, and we say so on the SMS terms page rather than implying otherwise.
• Frequency differs by message type and is stated per type on the SMS terms page. None of the three is recurring or scheduled, and Convaa runs no marketing SMS at all.
• Use and sharing. A phone number is used solely to deliver those messages. It reaches our messaging provider for that single purpose and reaches nobody else.
• Retention. Your own number stays on your account until you change or remove it. A number on a pending invite is deleted when that invite is revoked, and the invite stops working 14 days after it is created. Opt-out records are kept so that the opt-out keeps being honoured.

Cookies

Convaa sets cookies to keep you signed in and to protect requests against cross-site forgery. Analytics cookies are set by Google Analytics as described above. There is no advertising network on this site and no cross-site tracking for advertising.

Retention and deletion

Your content is kept while your account exists. You can delete a session, or your whole workspace, at any time, and deletions propagate to backups on a fixed schedule. Enterprise plans can set their own retention windows. To have an account and its content removed, write to [email protected].

Security

Data is encrypted in transit and at rest, internal access to production is least privilege and logged, and provider credentials are held server side. The security page has the detail, including the certifications Data443 holds.

Your choices

• Turn email or SMS notifications off in Account settings at any time.
• Remove your phone number from your account, which stops every message that depends on it.
• Export or delete your sessions.
• Ask us what we hold about you, ask for it to be corrected, or ask for it to be deleted, by writing to [email protected]. We do not sell personal information, so there is nothing to opt out of on that front.

Children

Convaa is a workplace tool and is not intended for children under 16. We do not knowingly collect data from them. If you believe a child has given us data, write to [email protected] and we will remove it.

Changes to this policy

When this policy changes, the date at the top of the page changes with it. A change to what Convaa sends by text message is published here and on the SMS terms page before it takes effect.

Contact

For text messages specifically, including how to stop them, see the SMS terms.