Privacy Policy

Effective date: June 7, 2026

Convoct ("we", "us", or "our") operates a WhatsApp attribution and conversion tracking platform. This Privacy Policy explains how we collect, use, and protect information when you use our services at convoct.com.

1. Information We Collect

From website visitors (via the Convoct tracking snippet)

• Visitor identity (MTID) — a randomly generated ID stored in the visitor's browser localStorage and a first-party cookie. It does not contain personally identifiable information.
• Session data — landing page URL, referrer, device type, and timestamp.
• Ad click IDs — Google Click ID (gclid), Facebook Click ID (fbclid), and UTM parameters, if present in the URL.
• IP address (hashed) — stored as a one-way SHA-256 hash and never in plain text.
• Phone number — collected only when a visitor sends a WhatsApp message to a connected business number. Used solely for attribution and lead matching.

From dashboard users (business accounts)

• Account information — name, email address, and (if using social login) your Google or Facebook account ID.
• Ad platform credentials — encrypted API tokens for Google Ads and Meta, stored with AES-256 encryption.

2. How We Use Your Information

• Match WhatsApp messages to website sessions for attribution purposes.
• Upload conversion signals to Google Ads and Meta Ads on behalf of our business customers.
• Provide and improve the Convoct platform.
• Authenticate dashboard users and maintain account security.
• Communicate service updates and account notifications.

3. Data Sharing

We do not sell personal data. We share data only in the following circumstances:

• Ad platforms — hashed phone numbers and conversion events are uploaded to Google Ads and Meta Ads at the direction of our business customers.
• Service providers — infrastructure providers (hosting, database) who process data on our behalf under data processing agreements.
• Legal requirements — when required by law or to protect the rights and safety of Convoct and its users.

4. Cookies and Tracking

The Convoct snippet sets one first-party cookie (cvt_mtid) with a 365-day TTL to maintain persistent visitor identity across sessions. This is a functional cookie required for attribution to work. No third-party cookies are set by Convoct.

5. Data Retention

• Session and event data is retained for 12 months.
• Lead and attribution records are retained for as long as the business account is active.
• Account data is deleted within 30 days of account closure.

6. Your Rights

Depending on your location, you may have the right to access, correct, delete, or restrict processing of your personal data. To exercise any of these rights, contact us at privacy@convoct.com.

For data deletion requests related to Facebook Login, please visit our Data Deletion Instructions page.

7. Security

We use industry-standard encryption (AES-256 at rest, TLS in transit) to protect your data. API credentials for ad platforms are encrypted before storage and never exposed in plaintext.

8. Children's Privacy

Convoct is a business tool not directed at children under 13. We do not knowingly collect data from children.

9. Changes to This Policy

We may update this policy from time to time. We will notify users of material changes via email or a notice in the dashboard.

10. Contact

For privacy-related questions, contact us at privacy@convoct.com.