Legal

Privacy Policy

Effective date: 1 October 2026

This Privacy Policy explains how CONVX TECHNOLOGY LLC ("convX", "we", "us", "our") collects, uses, shares and protects personal data when you visit www.convx-ai.com, contact us, or use our products and platforms, including Estatia and the custom AI systems we build for clients (together, the "Services").

1. Our role: controller and processor
2. Data we collect
3. WhatsApp Business Platform and Meta data
4. How we use data
5. AI processing
6. How we share data
7. International transfers
8. Retention
9. Security
10. Your rights
11. Children
12. Changes and contact

1. Our role: controller and processor

We act as data controller for data about visitors to our website, people who contact us, and the business users who create accounts on our Services.

When our business clients use the Services to communicate with their customers (for example, a real-estate developer answering buyer enquiries on WhatsApp through Estatia), the client is the controller of that end-customer data and we act as a data processor on the client's behalf, following the client's instructions and our agreement with them. If you are an end customer of one of our clients, please contact that business first; we will assist them in responding to your request.

2. Data we collect

Information you give us

• Contact and enquiry details: name, email, company, position, phone number and the content of your message (e.g. through our contact form or when booking a call).
• Account details for business users: name, work email, phone number, company details, role and login credentials.
• Billing and contract information for clients.

Information processed when the Services are used

• Messages and conversation content exchanged between a client business and its customers, including text, media, and metadata such as timestamps, delivery and read status.
• End-customer contact data such as WhatsApp phone number and profile name, and data the client chooses to store (e.g. leads, preferences, inventory interest, pipeline status).
• Configuration data: bot settings, message templates, integrations with CRMs, ERPs, spreadsheets and other tools the client connects.

Information collected automatically

• Technical data such as IP address, browser type, device information, pages visited and timestamps, collected through server logs. Our website does not use advertising cookies.

3. WhatsApp Business Platform and Meta data

Our Services integrate with the WhatsApp Business Platform (Cloud API) provided by Meta Platforms, Inc. and its affiliates ("Meta"). When a client connects its WhatsApp Business Account to our Services (for example through Meta's Embedded Signup with Facebook Login for Business), we receive and store, with the client's permission:

• The client's Meta business portfolio ID, WhatsApp Business Account ID, phone number ID, display phone number and verified business name;
• Access tokens and permissions granted by the client (such as whatsapp_business_management and whatsapp_business_messaging) that allow us to send and receive messages and manage message templates on the client's behalf;
• Messages, message status updates and other webhook events sent by Meta for the connected account.

We use this data only to provide the Services the client has requested: sending and receiving WhatsApp messages, managing templates and phone numbers, and showing conversations and analytics to the client. We do not sell this data, do not use it for advertising, and do not use it for any purpose that is inconsistent with the Meta Platform Terms, the Developer Policies and the WhatsApp Business Policy. Meta processes data it receives under its own privacy policy. A client can disconnect its account at any time from our dashboard or from its Meta Business settings, after which we stop accessing the account.

4. How we use data

• To provide, operate, maintain and support the Services;
• To respond to enquiries, schedule assessments and communicate with clients;
• To secure the Services, prevent fraud and abuse, and troubleshoot problems;
• To produce aggregated, de-identified statistics that help us improve the Services;
• To meet legal, tax and accounting obligations and enforce our agreements.

We rely on the performance of our contract with clients, our legitimate interests in running a secure and useful service, compliance with legal obligations, and, where required, your consent. We process personal data in accordance with the Egyptian Personal Data Protection Law No. 151 of 2020 and other applicable laws.

5. AI processing

Our Services use artificial-intelligence models to understand and draft replies to messages, classify leads and generate analytics. Conversation content may be sent to carefully selected AI model providers acting as our sub-processors, solely to generate these outputs for the client. We require these providers not to use client data to train their general-purpose models. Clients control whether automated replies are enabled and can hand any conversation over to a human at any time.

6. How we share data

We do not sell personal data. We share it only:

• With Meta / WhatsApp, as needed to send and receive messages through the WhatsApp Business Platform;
• With service providers that host, store, process or help us deliver the Services (e.g. cloud hosting, AI model providers, email and form delivery, scheduling tools), under contracts that protect the data;
• With the client business that controls the conversation data;
• When required by law, court order or a competent authority, or to protect rights, safety and security;
• In connection with a merger, acquisition or sale of assets, subject to this Policy.

7. International transfers

Our service providers, including Meta, may process data outside Egypt. Where we transfer personal data internationally we take the steps required by applicable law to ensure it receives an adequate level of protection.

8. Retention

• Conversation and end-customer data is kept for as long as the client's account is active, or for a shorter period the client configures, and is deleted within 30 days after the client closes its account or requests deletion, unless we must keep it longer by law.
• Meta access tokens are deleted as soon as the client disconnects its WhatsApp account or closes its account.
• Enquiry data is kept for up to 24 months after our last contact.
• Billing records are kept for the period required by Egyptian tax law.

9. Security

We use technical and organisational measures appropriate to the risk, including encryption in transit (TLS), encryption of access tokens at rest, access controls with least-privilege, multi-factor authentication for administrative access, and logging and monitoring. No method of transmission or storage is completely secure, but we work to protect your data and will notify affected clients and authorities of a personal-data breach as required by law.

10. Your rights

Subject to applicable law, you may request access to, correction of, or deletion of your personal data, object to or restrict certain processing, withdraw consent, and request a copy of your data. To exercise these rights, follow the steps on our Data Deletion page or email mohamed@convx-ai.com. We will respond within 30 days. You may also lodge a complaint with the Egyptian Personal Data Protection Center.

11. Children

The Services are intended for businesses and are not directed at children under 18. We do not knowingly collect personal data from children.

12. Changes and contact

We may update this Policy from time to time. We will post the new version on this page with a new effective date and, for material changes, notify clients by email or in the product.

Questions? Contact us at mohamed@convx-ai.com or write to CONVX TECHNOLOGY LLC, Office E, 2nd Floor, 53 Capital Mall, behind the Court, Fifth Settlement, New Cairo, Cairo, Egypt.