Privacy Policy

This Privacy Policy explains how Clonvo (Sole Proprietor) (operating the Clonvo service, "Clonvo", "we", "us") collects, uses, shares and protects personal information of (a) business customers who subscribe to Clonvo and (b) end-users who interact with our customers' WhatsApp, Instagram and Messenger accounts via Clonvo.

It applies to https://clonvo.chat, all subdomains (including https://app.clonvo.chat and https://api.clonvo.chat), our APIs, webhooks, and any messaging service we provide on behalf of a customer business.

1. Who we are

• Legal entity: Clonvo (Sole Proprietor)
• Country of operation: Pakistan
• Registered address: TICK, UET Lahore
• Privacy contact: privacy@clonvo.chat
• Data Protection Officer: dpo@clonvo.chat

2. Data we collect

2.1 From business customers (account holders)

• Account data: name, work email, organization name, job title, phone number (optional).
• Authentication data: handled by Clerk. We store only the resulting user ID and email; passwords are never sent to our servers.
• Billing data: handled by our PCI-DSS-compliant Merchant of Record. We store the last 4 digits of the card, the billing country, and the subscription status only.
• Usage data: login timestamps, dashboard pages visited, features toggled, conversation volume, AI token spend.
• Integration credentials: Channel-provider API keys and Meta Business credentials you paste into the dashboard. These are encrypted at rest with AES-256-GCM and decrypted only at the moment of an outbound API call.
• Knowledge-base content: documents, FAQs and policies you upload to train your AI agent.

2.2 From end-users (your customers' customers)

• Conversation data: the messages, media (images, voice notes, documents) and metadata exchanged on WhatsApp / Instagram / Messenger between an end-user and the business they contacted.
• Messaging account data: phone number (E.164), display name and channel-specific user ID.
• Technical data: IP address of the channel webhook callback, provider message IDs, timestamps.

2.3 From visitors to our website

• Functional cookies for sign-in (Clerk) and theme preference. With consent: lightweight first-party product analytics. See our Cookie Policy.

3. Why we collect it (purpose & legal basis)

For each category we identify a purpose and the GDPR Art. 6 legal basis we rely on.

4. How we use Meta Platform data

This section governs all data we obtain from the Meta APIs (WhatsApp Business API, Instagram Messaging API, Messenger Platform).

Clonvo uses data obtained from Meta platforms solely to provide the services described in our Terms. We do not use Meta Platform Data to:

• train consumer AI models;
• serve advertisements;
• build user profiles for advertising;
• share with third parties for marketing purposes.

Meta Platform Data is used only to: (1) route messages between businesses and their customers, (2) power AI-assisted responses within Meta's 24-hour customer service window, (3) provide conversation analytics to the business account holder, and (4) enable human-agent handoff when the AI cannot resolve a query or escalation is requested. Data obtained from Meta APIs is not combined with data from other sources for advertising or profiling purposes.

5. AI disclosure

Clonvo provides AI-powered messaging agents that interact with end-users on behalf of businesses. These agents use large-language- model (LLM) inference and retrieval-augmented generation (RAG) to produce responses. End-users may therefore be communicating with an AI rather than a human representative. Our agents are configured to identify themselves as AI when directly asked. Human support agents are available and will take over the conversation when the AI cannot resolve a query or when escalation is requested. This disclosure is provided in compliance with EU AI Act Article 50 and Meta's platform policies.

6. Data retention

We tie every retention period to a specific purpose, in line with GDPR Art. 5(1)(e) (storage limitation). When the purpose ends or the limit is reached, data is deleted.

• Account data: retained for the duration of your active subscription. Deleted within 30 days of account closure, cancellation, or a verified deletion request — whichever comes first.
• Conversation data: retained for the duration of your active subscription so the AI agent has the context it needs to reply. Upon account closure or cancellation, all conversation data is permanently deleted within 30 days. You can request earlier deletion at any time by emailing privacy@clonvo.chat. Inactive conversations within an active account may be moved to cold storage after 90 days of no activity.
• Platform logs (technical): up to 90 days, then deleted.
• Backups: encrypted database backups are retained for 30 days, then overwritten.

7. Storage & security

• Primary database hosted on Supabase (Singapore region by default).
• Encrypted media storage on AWS S3 (private bucket, signed URLs only).
• TLS 1.2+ in transit everywhere.
• AES-256-GCM at rest for all integration credentials and LLM keys.
• Role-based access control with separation between platform staff and business users; enforced 2FA for staff.
• Per-tenant data isolation enforced in every database query.
• Regular vulnerability scans; responsible disclosure at security@clonvo.chat.

8. Sub-processors

We share the minimum personal information necessary with the following sub-processors. We notify customers in writing before adding or replacing a sub-processor that materially changes how their data is handled.

9. International transfers

Where personal data is transferred outside your country (for example from the EU/UK to the United States), we rely on the European Commission's Standard Contractual Clauses (SCCs) or equivalent safeguards offered by our sub-processors.

10. Your rights (GDPR)

Subject to applicable law you have the following rights. To exercise any of them, email privacy@clonvo.chat. We respond within 30 days.

• Access: request a copy of the personal data we hold about you.
• Rectification: ask us to correct inaccurate data.
• Erasure (right to be forgotten): request deletion of your personal data. See also Data Deletion.
• Portability: receive your data in a machine- readable format.
• Restriction / objection: object to processing based on legitimate interest.
• Withdraw consent: at any time, with effect for the future. Use the unsubscribe link in any marketing email.
• Lodge a complaint with the data protection authority in your jurisdiction.

11. California residents (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act gives you the right to know what personal information we collect about you, the right to delete it, the right to correct inaccurate information, and the right to opt out of the "sale" or "sharing" of personal information. Clonvo does not sell personal information and does not share personal information for cross-context behavioural advertising. To exercise these rights, contact privacy@clonvo.chat.

12. WhatsApp opt-in & messaging consent

Clonvo requires its business customers to obtain explicit opt-in consent from end-users before sending business-initiated WhatsApp template messages on their behalf. Acceptable opt-in mechanisms include website forms, WhatsApp keyword reply, and in-person consent. End-users can opt out at any time by replying STOP to any WhatsApp message; opt-out records are kept for at least 5 years and broadcast lists are updated within 24 hours of an opt-out request. Clonvo does not send unsolicited messages.

13. Children

Clonvo is a B2B service and is not directed to children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us so we can delete it.

14. Changes to this policy

We may update this policy from time to time. Material changes will be announced on this page and notified to account owners by email at least 30 days in advance.

15. Contact

Privacy questions, data subject requests, and DPA requests: privacy@clonvo.chat. Postal mail to Clonvo (Sole Proprietor), TICK, UET Lahore.