Data Privacy Notice

In short: businesses use ConvoOK to talk with their customers by chat, email, social messaging and calls, with AI help. For those conversations the business decides what is collected and why, and ConvoOK processes it for them. For our own customers' accounts, ConvoOK decides. We do not sell personal information, we do not use it to train general AI models, and our servers are in Singapore. You can reach our privacy contact at [email protected].

1. About this notice

ConvoOK Technology Solutions Inc. ("ConvoOK", "we", "us") operates ConvoOK, an AI-assisted omnichannel communication and customer relationship management (CRM) platform at convook.com. This notice explains how we collect, use, store, share, protect and dispose of personal information through ConvoOK, our website and our related services, and what rights you have.

It is written to comply with Republic Act No. 10173, the Data Privacy Act of 2012 ("DPA"), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission ("NPC"). Words such as "personal information controller" and "processor" have the meaning the DPA gives them.

2. Who is responsible for your information

• ConvoOK is the personal information controller for information about the people who visit our website, sign up, use the ConvoOK console, pay us, or contact us — our customers, their team members, prospects and suppliers.
• The business you are talking to is the personal information controller for your conversations with it — when you chat on its website, email it, message it on Messenger, Instagram, Telegram, Viber or Discord, or call it — and for the records it keeps about you in ConvoOK. ConvoOK is its personal information processor: we process that information only on the business's instructions and under a written agreement (the Data Processing Terms in Schedule A of our Terms of Service). That business decides why your information is collected and how long it is kept, and its own privacy notice applies.

If you are a customer of a business that uses ConvoOK, please contact that business first about your information. If you contact us, we will pass your request to the business and help it answer (see section 15).

3. What we collect

A. Account, team and contact information

Name, email address, username, password (stored only as a one-way hash), mobile or telephone number, company or organization, job title, role in a workspace, profile photo, language and display preferences, two-factor authentication settings, and messages you send us.

B. Communication information

Processed for the businesses that use ConvoOK, in the channels they connect:

• chat messages, emails (sender, recipients, subject, body and attachments), and messages on Messenger, Instagram, Telegram, Viber or Discord, with the date, time and channel;
• photos, files, voice messages and other attachments you choose to send;
• on calls: the audio while the call lasts, a transcript, and — only where the business's setting and the law allow — a recording;
• the replies of the business, its staff and its AI agent, internal notes, labels, summaries and the history of the conversation;
• the public profile details a messaging platform shares with the business when you message it (for example your name, and profile picture or username);
• later, as we add them: SMS, phone numbers, WhatsApp and other email providers such as Microsoft Outlook.

C. Customer and transaction information

What a business records about its customers in ConvoOK: contact details and identifiers, leads, deals and their stages, tasks, appointments and enquiries, form answers, records in sheets the business designs, cases or tickets, and preferences. If a business lets its customers sign in through its own system, the identity that system confirms.

D. Billing information

Your plan, invoices, payment amounts, dates, references and status, and proofs of payment you upload for bank or e-wallet transfers. Card numbers and wallet credentials are entered on our payment partners' pages; we do not receive or store card numbers.

E. Technical and usage information

IP address, device and browser type, operating system, sign-in times and trusted devices, pages and features used, the security record of actions taken in a workspace (who did what, and when), request identifiers, error reports and system logs, and counts of usage such as AI answers, voice minutes and messages.

F. Sensitive personal information

ConvoOK does not ask for sensitive personal information (for example health, government-issued identifiers, or information about religion, age or marital status) for its own purposes. A business may collect it through ConvoOK — a clinic, for example — and is then responsible for having a lawful basis under Section 13 of the DPA. Businesses can switch on redaction that masks numbers such as card and phone numbers in stored conversations, and choose shorter retention for them.

4. How we collect it

• directly from you — when you sign up, fill in a form, message, email or call, or contact us;
• through the channels a business connects — its website widget, mailboxes, messaging accounts and phone lines;
• from a business using ConvoOK — for example contacts it imports or records it creates;
• from the systems a business connects — its own database, website, documents or API;
• from our payment partners, when a payment is made; and
• automatically, from your browser or device when you use our website, the console or a widget.

5. Why we use it, and on what basis

Purpose	Lawful basis (DPA Sec. 12 and 13)
Providing ConvoOK: accounts and sign-in, workspaces, channels, the inbox, AI agents, CRM, reports and support	Contract with our customer; for conversations, the instructions of the business that is the controller
Billing, invoices, receipts, renewal reminders and collecting payment	Contract; legal obligation (tax and accounting records)
Service messages: security alerts, invitations, sign-in codes, changes to the service or these documents	Contract; legitimate interest
Keeping a record that you accepted our Terms and were shown this notice — which version, when, your IP address and browser, and the workspace	Contract; legal claims
Security: authentication, detecting and preventing fraud, abuse and unauthorized access, investigating incidents, keeping logs and backups	Legitimate interest; legal obligation (security of personal information)
Fixing errors and improving ConvoOK, using aggregated or de-identified information wherever possible	Legitimate interest
Marketing ConvoOK to you, such as product news	Consent, or legitimate interest for our existing customers; you can unsubscribe at any time
Complying with the law, answering lawful requests of authorities, and establishing or defending legal claims	Legal obligation; legal claims

Where we rely on consent, you may withdraw it at any time; this does not affect what was done before. Where we rely on legitimate interest, we have weighed it against your rights and freedoms, and you may object (see section 14).

6. Conversations through ConvoOK

When you contact a business through ConvoOK, your conversation — your messages, its replies, the date, time and channel, and files you send — is stored in that business's workspace so its team can help you and see your history. The business may be answered first by an AI agent, and a person from its team can read the conversation and take over. Each workspace is kept separate: one business cannot see another's conversations. ConvoOK's own platform administrators do not have access to read conversations through the platform; our personnel access a workspace's content only when the business asks for support, to keep the service secure, or when the law requires it.

7. AI and automated processing

ConvoOK uses AI to answer chats, emails and calls from a business's own knowledge; to transcribe and speak on calls; to summarize, title, label and classify conversations; to recognize sentiment; to fill forms and records from a conversation; to suggest replies; and to route conversations to the right queue or person.

• You may be talking to an AI. The business decides when its AI hands you to a person; you can ask for a person at any time.
• No decision with legal or similarly significant effect is made about you by ConvoOK on automated processing alone. If a business uses ConvoOK in a way that does, it is responsible for telling you and for giving you a way to reach a person and contest the decision, as the DPA and the NPC's rules require.
• No training on your information. We do not use personal information in conversations to train general-purpose AI models, and our AI providers may not use it to train theirs. A business may choose to fine-tune a model of its own from examples it selects; that model is used only for that business.
• AI can be wrong. Answers come from the business's own information, but they can contain mistakes; ask the business's team when it matters.

8. Calls and recordings

Calls through ConvoOK are carried by our own call server. A transcript is kept so the business can see what was said. A call is recorded only where the business's setting allows it: by default, only after the caller agrees in the call. A business that records every call must obtain the caller's consent in another way, as the Anti-Wiretapping Act (RA 4200) requires. Recordings are kept in private storage in Singapore. They are played only inside ConvoOK, by the people the business allows — its owners and administrators, and an agent for the calls they took — never through a public link, and every play and download is logged. A recording is deleted when the business's recording period ends (see section 13).

9. Who we share it with

We do not sell or rent personal information, and we do not share it for advertising. We share it only as follows:

• with the business you are communicating with, and the members of its team it authorizes;
• with our service providers (sub-processors) below, who process it only on our instructions and under written agreements that require them to protect it;
• with the platforms a business connects (section 19), to deliver messages you send or receive there;
• with professional advisers — lawyers, auditors, accountants — under confidentiality;
• with government authorities, courts or the NPC, when the law requires it or to protect rights, safety and security; and
• with a successor if ConvoOK's business is merged, acquired or transferred, which will remain bound by this notice, and of which we will inform you.

Our sub-processors

Not every provider is used for every workspace: AI providers depend on the features and models a workspace uses.

Our call server, search index, message queue and error tracking run on our own servers with the hosting provider above, not with additional companies. We announce a new sub-processor here, and to the owners of workspaces, at least fifteen (15) days before it starts, as our Data Processing Terms describe.

10. Where it is stored, and transfers abroad

ConvoOK's servers, database, files, recordings and backups are in Singapore. Some providers above process information in other countries, mainly the United States. Every transfer is made with safeguards that keep the information protected as the DPA requires — written agreements binding the provider to confidentiality and security, to use the information only to serve us, and not to train AI models on it — and we remain responsible for information we transfer. Ask our privacy contact for details of the safeguards for a particular provider.

11. Information from Google (Gmail)

When a business connects a Gmail or Google Workspace mailbox, ConvoOK asks Google for permission to read, send and organize email in that mailbox (gmail.modify) and for the mailbox's email address. We use this only to provide the email channel the business chose: to bring new emails from the inbox into its ConvoOK inbox, to let the AI agent and the team draft and send replies from that mailbox in the same thread, and to keep the conversation's state in step with the mailbox. We do not use Gmail data for advertising, we do not sell it, we do not use it to train general-purpose AI models, and no person at ConvoOK reads it unless the business asks us to for support, it is needed for security or to comply with the law, or it has been aggregated and anonymized for internal operations.

ConvoOK's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

The business can disconnect the mailbox in ConvoOK at any time, or remove ConvoOK's access in its Google Account under Security → Third-party apps with account access. Emails already brought into ConvoOK then follow the business's retention settings.

12. How we protect it

We protect personal information with organizational, physical and technical measures appropriate to the risk, including:

• encryption in transit (HTTPS on every connection); encryption at rest of channel and mailbox access tokens, connection secrets, and contact details such as email addresses and phone numbers; files in private storage, reachable only through temporary links; call recordings in private storage, played only inside ConvoOK by the people the business allows, each play and download logged;
• separation of every workspace's data, checked by automated tests on every change;
• role-based permissions, two-factor authentication, sign-in limits against password guessing, and a record of trusted devices;
• a security record of significant actions in each workspace;
• servers on a private network, reachable for administration only with personal keys, behind firewalls;
• regular backups, kept in Singapore, and tested restores;
• monitoring and error tracking on our own servers, with personal information removed from error reports;
• confidentiality obligations and need-to-know access for our personnel; and
• security reviews of our code, including against common web risks, and prompt patching.

No system is perfectly secure; we keep reviewing and improving these measures. Please keep your password and keys private, and turn on two-factor authentication.

13. How long we keep it

• Conversations and transcripts: for as long as the business's retention setting says — 90 days by default, which a business can change. When the period ends, the content is removed and only counts needed for usage and billing remain.
• Call recordings: for the business's own recording period — 30 days unless it chooses longer, up to what its plan allows (at most 5 years, or a period in a written agreement), and it can choose shorter at any time. Recordings follow their own period, not the transcript's. If the business moves to a plan that keeps recordings for less time, or its plan ends, recordings past the new period are kept 30 more days so it can download them, and are then deleted.
• Account and workspace information: while the account is active; after a workspace is closed, the business can export its data for 30 days, after which we delete it from our live systems within a further 30 days.
• Billing records: as long as Philippine tax, accounting and corporate rules require.
• Records of accepting the Terms and seeing this notice: while the account exists, and afterwards only as long as needed to show what was agreed if a claim about it can still be made.
• Security records and logs: only as long as needed for security and to investigate incidents.
• Exports: files a business exports from ConvoOK are deleted after seven days.
• Backups: database backups are kept for up to 35 days, and monthly backups for up to 12 months, and are used only to recover from a disaster. A backup is not edited to remove one person's data; deleted data in it expires with the backup.

When information is no longer needed, we delete or anonymize it securely. We may keep it longer only where the law requires it, or to establish or defend a legal claim.

14. Your rights

Under the DPA, and subject to its limits, you have the right:

• to be informed whether and how your personal information is processed — including, where it applies, about automated decision-making and profiling;
• to access your personal information and information about its processing;
• to object to processing, including for direct marketing and processing based on legitimate interest, and to withdraw consent;
• to erasure or blocking of information that is incomplete, outdated, false, unlawfully obtained, no longer necessary, or processed without a lawful basis;
• to rectification of inaccurate or incomplete information;
• to data portability — a copy of information you provided, in a structured, commonly used electronic format;
• to damages for harm caused by inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorized use of personal information; and
• to file a complaint with the National Privacy Commission.

These rights may be exercised by your lawful heirs or assigns.

15. How to use your rights, and deleting your data

• Email us at [email protected], with the right you want to use and enough detail for us to find your information (for example the email address or phone number you used, and the business or channel). For a deletion request, write Delete my data in the subject.
• We verify who you are before acting, and may ask for more information to protect you from someone else asking in your name.
• We answer within thirty (30) days of receiving a complete request and verifying who you are — sooner where the NPC's rules require — and tell you if we need longer and why. Using your rights is free; we may refuse requests that are manifestly unfounded or excessive, and will tell you why.
• Information held for a business (your conversations with it): we pass your request to that business, which decides as controller, and help it answer. You may also contact the business directly.
• Messenger and Instagram: if you messaged a business through Facebook Messenger or Instagram and want those messages deleted from ConvoOK, email us as above with the name of the business and your Facebook or Instagram name. We will confirm when your messages are deleted, or when we have passed the request to the business.
• ConvoOK customers can correct their profile in the console, export their workspace's data, and close their account.

16. Personal data breaches

We have procedures to detect, contain, investigate and recover from security incidents. When a breach must be notified under the NPC's rules — for example where sensitive personal information, or information that could enable identity fraud, may have been acquired by an unauthorized person and there is a real risk of serious harm — we notify the NPC and the affected people within seventy-two (72) hours of knowing about it. Where we act for a business as its processor, we notify that business without undue delay and in time for it to meet the same deadline, and help it with the information we have.

17. Cookies and browser storage

• Our website sets two strictly necessary cookies — a session cookie, and a security token that protects our forms from forgery — and Cloudflare, which protects the site, may set a security cookie to tell people from automated attacks. There are no advertising or tracking cookies or scripts. The site loads its fonts from Google Fonts, so your browser shares your IP address and browser details with Google when you visit.
• The ConvoOK console sets two strictly necessary cookies: one that keeps you signed in, and one that remembers a device you trusted for sign-in. It also keeps your preferences — language, theme, layout — in your browser's storage.
• A chat widget on a business's website sets no cookies. It remembers the current conversation in your browser's session storage, which is cleared when you close the tab.

Strictly necessary cookies cannot be switched off without stopping sign-in from working; you can clear them in your browser at any time.

18. Children

ConvoOK is a service for businesses and is not directed at children; you must be 18 or older to create an account. A business that serves minors through ConvoOK — a school, for example — is responsible for obtaining the consent of a parent or guardian where the law requires it. If you believe a child has given us personal information without that consent, contact us and we will delete it.

19. Other companies' services

Businesses can connect ConvoOK to services run by other companies, such as Google (Gmail), Meta (Facebook Messenger and Instagram), Telegram, Viber and Discord, and in time other email providers, SMS and WhatsApp. When you message a business on one of those services, that company also processes your messages under its own privacy policy, which we do not control. Links on our website to other websites are governed by those websites' own policies.

20. Changes to this notice

We update this notice when our services, providers or practices, or the law, change. The date at the top shows the current version, and we keep a copy of every version. We tell our customers about material changes by email or in the console before they take effect, and the console asks each member to confirm they have read the new version.

21. Contact us, and the National Privacy Commission

Data Protection Officer
ConvoOK Technology Solutions Inc.
2F JKSA Commercial Building, 4954-A A. Arnaiz Ave. cor. Mayor St., Pio del Pilar, Makati City, Metro Manila, Philippines
[email protected]

For your conversations with a particular business that uses ConvoOK, you may also contact that business directly.

If you believe your privacy rights have been violated and we have not resolved your concern, you may file a complaint with the National Privacy Commission of the Republic of the Philippines, privacy.gov.ph.