Privacy Policy

ConvoCrew (“ConvoCrew”, “we”, “us”, or “our”) is a WhatsApp business automation platform that enables businesses to manage customer conversations, deploy AI-powered responses, and connect human agents — all via the WhatsApp Cloud API.

For questions about this policy, contact us at info+convocrew@anarchylabs.in.

This policy covers two groups:

• Business customers — companies and individuals who sign up for a ConvoCrew account.
• End users — customers of our business customers who send or receive WhatsApp messages through a ConvoCrew-connected number.

ConvoCrew acts as a data processoron behalf of business customers (the data controllers) for end-user data. Each business customer is responsible for their own lawful basis for processing their customers’ data.

From business customers

• Account information: name, email address, company name
• WhatsApp credentials: access tokens, phone number IDs, app secrets (encrypted at rest)
• Knowledge base content you upload (product info, FAQs, documents)
• Billing information (processed by our payment provider; we do not store card details)
• Usage logs, support correspondence

From end users (via WhatsApp)

• WhatsApp phone number
• Display name (if shared by Meta)
• Message content: text, images, audio, video, documents sent to the business number
• Message metadata: timestamps, delivery status, message IDs
• Agent notes added by business staff about the conversation

Automatically collected

• IP addresses, browser type, and device information when accessing the dashboard
• Webhook event logs from Meta
• Error and performance logs (no personally identifiable content)

• To provide and operate the ConvoCrew service
• To route inbound WhatsApp messages to the correct business account
• To generate AI responses — message content is sent to OpenAI’s API (GPT-4o-mini) for processing. OpenAI does not use API data to train its models.
• To display conversation history in the business dashboard
• To send product updates, security alerts, and billing notices to business customers
• To comply with legal obligations and enforce our Terms of Service

We do not sell personal data. We do not use end-user data for advertising.

• Contract — processing necessary to deliver the service to business customers
• Legitimate interest — security monitoring, fraud prevention, product improvement
• Legal obligation — compliance with applicable laws
• Consent — where obtained from end users by the business customer (we process on their behalf under our data processing agreement)

When AI is enabled for a conversation, message content (text, and transcripts of audio messages) is sent to OpenAI’s API to generate a response. This is a core function of the service. Business customers can disable AI per contact at any time from the dashboard.

Media files (images, documents, video) are not sent to OpenAI. Audio voice notes are transcribed first; the transcript (not the audio) is sent.

Since January 15, 2026, Meta requires that AI bots on WhatsApp serve a defined business purpose (e.g. customer support, order tracking). ConvoCrew is designed for this use case.

We use the following third-party services to deliver ConvoCrew:

All sub-processors are under data processing agreements. For EU/EEA data, appropriate transfer mechanisms (Standard Contractual Clauses) are in place.

• Message content: retained for the lifetime of the business account, then deleted within 30 days of account closure
• Media files: Meta CDN URLs expire after 30 days; we store the media ID only
• Account data: retained while the account is active and for 30 days after deletion
• Billing records: retained for 7 years as required by applicable tax law
• Audit logs: retained for 2 years

• All data is encrypted in transit (TLS 1.2+) and at rest (AES-256)
• WhatsApp access tokens and secrets are stored encrypted; masked in the UI
• Access to production systems is restricted to authorised personnel only
• We verify Meta webhook signatures on every incoming request

In the event of a data breach affecting your personal data, we will notify you within 72 hours of becoming aware of it, as required by GDPR Article 33.

Depending on your location, you may have the right to:

• Access — request a copy of the data we hold about you
• Rectification — ask us to correct inaccurate data
• Erasure — request deletion of your personal data
• Portability — receive your data in a structured, machine-readable format
• Objection — object to processing based on legitimate interest
• Restriction — ask us to restrict processing while a dispute is resolved

Submit requests to info+convocrew@anarchylabs.in. We respond within 30 days (GDPR) or 45 days (CCPA). End users should contact the business they messaged — the business customer is the data controller for those conversations.

Indian users: You have rights under the Digital Personal Data Protection Act (DPDPA) 2023, including the right to access, correction, erasure, and grievance redressal.

• ConvoCrew uses the WhatsApp Cloud API. Message delivery is subject to WhatsApp’s Privacy Policy and WhatsApp Business Policy.
• Business customers must obtain valid opt-in consent from end users before initiating conversations, as required by Meta’s messaging policies.
• Meta may independently process message metadata per their own privacy policy. ConvoCrew does not control Meta’s data practices.

The ConvoCrew dashboard uses essential session cookies for authentication (managed by BetterAuth). No advertising or tracking cookies are used. The marketing website does not use cookies beyond session management.

We may update this policy. Material changes will be emailed to business customers at least 14 days before they take effect. The “Last updated” date at the top reflects the most recent revision. Continued use of ConvoCrew after changes take effect constitutes acceptance.

Data protection enquiries: info+convocrew@anarchylabs.in

If you are in the EU/EEA and believe we have violated your rights, you have the right to lodge a complaint with your local data protection authority.