Privacy Policy — Converto PK

1. Introduction

Converto PK ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI-powered Instagram DM assistant service. By using Converto PK, you agree to the terms of this Privacy Policy.

2. Information We Collect

We collect the following types of information:

• Account Information: Your name, email address, brand name, and password when you register.
• Instagram Business Data: Messages, conversations, media, and profile information from your connected Instagram Professional account, accessed via Meta's official APIs.
• Product & Business Data: Product names, prices, sizes, descriptions, images, delivery cities, and COD policies you add to your dashboard.
• Usage Data: Log data including IP address, browser type, pages visited, time spent, and feature interactions.
• Communication Data: Emails and messages you send to our support team.

3. How We Use Your Information

We use your data solely for:

• Providing automated AI replies to customer DMs on your behalf.
• Displaying conversation history and analytics in your dashboard.
• Improving our AI models and response accuracy.
• Sending service-related communications (updates, security alerts, billing).
• Complying with legal obligations and enforcing our Terms of Service.

We do NOT sell, rent, or trade your personal data to third parties for marketing purposes.

4. Data Sharing & Third Parties

We share your data only with:

• OpenAI: Customer messages are processed via OpenAI's API (GPT-4o-mini) to generate replies. OpenAI does not use your data to train their models.
• Meta Platforms: Messages are sent and received through Meta's official Instagram Messaging API.
• Service Providers: Supabase (database hosting) and Lovable (cloud infrastructure). All providers are bound by data processing agreements.
• Legal Authorities: If required by law, court order, or to protect our legal rights.

5. Data Storage & Security

• Data is stored on Supabase and Lovable Cloud with encryption at rest and in transit (TLS 1.3).
• Access tokens and API keys are stored as encrypted secrets, never exposed to client-side code.
• We implement access controls, regular security reviews, and monitoring.
• Despite our efforts, no method of electronic storage is 100% secure. We cannot guarantee absolute security.

6. Data Retention

• Account data is retained as long as your account is active.
• Conversation logs are retained for 90 days unless you request earlier deletion.
• Upon account deletion, all personal data is permanently removed within 30 days.
• Aggregated, anonymized data may be retained for analytics.

7. Your Rights

You have the right to:

• Access your personal data stored by us.
• Correct inaccurate data.
• Request deletion of your account and all associated data.
• Disconnect your Instagram account at any time.
• Export your data in a machine-readable format.

To exercise these rights, email hello@converto.app.

8. Cookies

Converto PK uses essential cookies for authentication and session management. We do not use tracking cookies for advertising or analytics. You can disable cookies in your browser, but some features may not function.

9. Children's Privacy

Converto PK is intended for business use. We do not knowingly collect data from individuals under 13 years of age. If we learn such data has been collected, we will delete it immediately.

10. International Data Transfers

Your data may be processed in countries outside Pakistan, including the United States where our service providers operate. We ensure appropriate safeguards are in place.

11. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be communicated via email. Continued use after changes constitutes acceptance.

12. Data Deletion Instructions

To request full account and data deletion, email hello@converto.app with subject "Data Deletion Request". Include your registered email and brand name. We process requests within 30 calendar days. You may also manually delete products and disconnect Instagram from your dashboard at any time.

13. Contact Us