Privacy Policy

1. Who we are and our role

Convexa Retail operates the Convexa platform at app.convexaretail.com. You can contact us about privacy at support@convexaretail.com, and for general or legal matters at info@convexaretail.com.

Our role depends on whose data it is:

• Merchant account data (the people who sign up for and use Convexa): we are the controller. We decide how this data is used to provide and secure the service.
• Merchants' customer data (shoppers, people who comment on or message a merchant's Facebook Page or Instagram account, people who chat with a merchant's website assistant): the merchant is the controller and we act as their processor (or "service provider" under US state privacy laws). We process this data only to provide the service to that merchant. If you are a merchant's customer, please contact the merchant first; we will help them respond to your request.

2. Data we collect

2.1 Merchant account data

• Name, email address, business name, role and team membership.
• Login and security data handled through our authentication provider (Supabase), such as session tokens.
• Store profile, brand voice and configuration settings you enter.
• Usage and technical data such as log records, IP address, browser type and actions taken in the app (for security, support and audit).
• Billing details for your subscription.

2.2 Data from connected store platforms (Shopify, Magento)

When a merchant connects their store, we sync data the merchant authorises, which can include: products, categories, inventory and prices; customer records (name, email, phone, addresses, marketing consent); orders, order items, refunds and returns; checkouts and abandoned carts; and product reviews.

2.3 Data from Meta (Facebook and Instagram)

When a merchant connects their Facebook Page and Instagram professional account, we receive and store, through Meta's official APIs:

• The Page and Instagram account identifiers, names and the access token Meta issues to Convexa for that Page (stored encrypted).
• Comments posted on the merchant's posts, and direct messages sent to the merchant's Page or Instagram account, including the text, time and the sender's platform-scoped ID, username or display name.
• Replies the merchant drafts, edits, approves or sends through Convexa.

We use this data only to show the merchant their comments and messages, draft suggested replies, publish replies the merchant approves, and report on engagement. We request only the permissions those features need.

2.4 Messaging and communication data

• Website chat (Shopping Co-Pilot) conversations between shoppers and a merchant's store assistant, including messages and session details.
• WhatsApp, SMS and email messages a merchant sends or receives through Convexa (through providers such as Twilio, Meta's WhatsApp Business Platform and the merchant's own email server).
• Email engagement data such as opens, clicks and unsubscribes, collected through tracking links and pixels in emails the merchant sends.

2.5 Demo requests

When you book a demo on convexaretail.com, we collect your name, work email, company, store URL, store platform, approximate monthly order volume and, if you book a time, the time you chose. We also record the page you came from and your time zone. We use this only to arrange and follow up on the demo. You can ask us to delete it at any time by emailing support@convexaretail.com.

3. How we use data

• To provide the platform: syncing store data, analytics (for example customer segments, churn and purchase predictions), customer relationship tools, tasks and inbox features.
• To generate AI-assisted content: suggested replies to comments and messages, campaign and email drafts, and business insights. Suggested social replies are held for review by the merchant's team, except replies that meet the automatic-approval confidence threshold the merchant can configure.
• To send messages and campaigns the merchant creates, on the merchant's behalf.
• To secure the service, prevent abuse, debug problems and keep audit records.
• To improve Convexa, using de-identified data as described in section 5.
• To communicate with merchant users about their account, service changes and support.
• To meet legal obligations.

4. Legal bases (UK and EEA)

Where UK GDPR or EU GDPR applies, we rely on:

• Contract: to provide the service a merchant has signed up for.
• Legitimate interests: to secure and improve the service and to support our customers, where those interests are not overridden by your rights.
• Consent: where required, for example for optional cookies or marketing. You can withdraw consent at any time.
• Legal obligation: where the law requires us to keep or disclose data.

For merchants' customer data, the merchant determines the legal basis as controller.

5. AI processing and service improvement

We use OpenAI's API to generate drafts and analyses. Relevant content (for example a comment and related product details) is sent to OpenAI to produce a response. OpenAI processes this data under its API terms, under which data sent through the API is not used to train OpenAI's models by default.

To improve our product, we keep a dataset of interaction outcomes (for example, whether a suggested reply was edited before sending). Before records enter this dataset we remove direct identifiers, replace record IDs with one-way pseudonyms and do not store which merchant the record came from. We do not use this dataset to identify individuals or to target anyone.

6. How we share data

We share data only with the service providers we need to run Convexa, and with the platforms the merchant connects, acting on the merchant's instructions:

We may also disclose data if required by law, to protect rights and safety, or as part of a merger or acquisition (in which case this policy will continue to apply). We do not sell personal data and we do not "share" it for cross-context behavioural advertising.

7. International transfers

Our providers may process data outside your country, including in the United States. Where UK or EU data protection law applies, we use appropriate safeguards such as the UK International Data Transfer Agreement or Addendum, or the EU Standard Contractual Clauses, or rely on adequacy regulations.

8. How long we keep data

• Merchant account and store data: while the merchant's account is active, then deleted or de-identified on request or after the account is closed, unless the law requires us to keep it longer.
• Meta access tokens: deleted immediately when the merchant disconnects Meta in Convexa.
• Comments, messages and drafts: kept for as long as the merchant keeps their account, unless the merchant deletes them or asks us to.
• Backups: deleted data may remain in encrypted backups for a limited period until they are overwritten.

9. Security

We use access controls with role-based permissions, strict separation of each merchant's data, encrypted connections (HTTPS), and encryption at rest (AES-256-GCM) for stored integration credentials such as access tokens. Webhooks from Meta and Shopify are verified by signature before we process them. No system is perfectly secure, but we work to protect data and will notify affected merchants and authorities of a personal data breach where the law requires.

10. Your rights

Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal data, to object to or restrict certain processing, and to withdraw consent. To exercise these rights, email support@convexaretail.com. We will respond within the time the law requires (for example, one month under UK GDPR, or 45 days under California law). We may need to verify your identity first. We will not discriminate against you for exercising your rights.

• United Kingdom: you can complain to the Information Commissioner's Office (ico.org.uk). We would appreciate the chance to address your concern first.
• United States: residents of California and other states with consumer privacy laws have rights to know, delete and correct personal data, and to opt out of its sale or sharing. We do not sell or share personal data, and we do not use sensitive personal information to infer characteristics. You may use an authorised agent to make a request.
• Pakistan: we process data in accordance with applicable Pakistani law, including the Prevention of Electronic Crimes Act 2016.

If you are a merchant's customer, your request may be best handled by that merchant as controller; we will support them. To have data from your Facebook or Instagram interactions removed, see our Data Deletion Instructions.

11. Cookies and similar technologies

The Convexa app uses browser storage that is strictly necessary to keep you signed in and remember the business you are working in. The website chat assistant a merchant installs uses similar storage to keep a shopper's conversation going. Emails sent through Convexa may contain tracking links and pixels so merchants can measure opens and clicks. We do not use advertising cookies.

12. Children

Convexa is a business tool and is not directed at children. We do not knowingly collect personal data from children under 13 (or under 16 where local law sets a higher age) for our own purposes.

13. Changes to this policy

We may update this policy as our service changes. We will change the "Last updated" date above and, for material changes, notify merchant account holders by email or in the app.

14. Contact

Convexa Retail
Privacy and data requests: support@convexaretail.com
General and legal enquiries: info@convexaretail.com