Privacy Policy
Last updated 9 October 2026. What ChatConvert collects, why we collect it, who we share it with, and how you get it removed.
Who this policy covers
ChatConvert is operated by Tabassum Fatima Masoom Husain Sayed as a sole proprietorship. It runs chatconvert.in and the ChatConvert Instagram automation service. This policy explains how we handle personal data in two different roles, which are worth keeping separate because your rights differ between them.
- As a data fiduciary (controller) for people who visit this website, book a call, chat with the assistant, or sign in and use the dashboard. We decide what is collected here and why.
- As a data processor for the brands who use ChatConvert. When a brand connects its Instagram account, the messages and customer details flowing through that account belong to the brand, and we only act on its instructions.
If you messaged a brand on Instagram and reached this page looking for how your data is handled, the brand you messaged is the one responsible for it. We can still help you get it deleted, and the Data Deletion page explains how.
What we collect from website visitors
We collect only what a specific feature on this site needs in order to work.
| What | When it is collected | Why |
|---|---|---|
| Name, phone number, email, Instagram handle, brand name, the plan you are interested in, and anything you type into the message box | When you submit the Book a call form | To reply to you and prepare for the call |
| Email address | When you subscribe or leave your email in the chat assistant | To send you the reply or follow-up you asked for |
| The messages you type into the chat assistant | While you use the chat widget | To generate a useful answer and to see which questions come up often |
| Account email, name, and password, which is stored only as a one-way hash we cannot turn back into the password | When you create an account | To sign you in and open your ChatConvert workspace |
| Sign-in records: the device name (such as "Chrome on Mac"), network address and time of each sign-in or code request | Each time you sign in or ask for a code | To keep each session to one device for 24 hours, to stop password guessing, and to show you which devices are signed in. Kept for up to 30 days |
| Google account email and profile name | Only if you choose Sign in with Google, where it is offered | To sign you in and open your ChatConvert workspace |
| Anonymous session ID, page path, and interaction events (page views, button and link clicks, chat opens, form submissions) | Automatically as you use the site | To understand which parts of the site are useful. This is a random ID stored in your browser, not a name or an email |
| Visit records: a random visitor ID kept in your browser, the pages you open on this site and how long each stays open, the site or campaign that sent you, your device type and browser, and your approximate country | Automatically as you use the site. The country is looked up from your IP address at the moment of the visit, using a database kept on our own server; the address itself is not stored with the visit | To understand how people find the site and which pages help them. Only the ChatConvert owner account can see these records. Automated browsers, and browsers that send a Global Privacy Control or Do Not Track signal, are not counted |
| IP address and browser user agent | Automatically, by our hosting and backend providers | Standard server logging, abuse prevention, and rate limiting |
We do not collect payment card details on this website. We do not buy contact lists, and we do not run advertising trackers or third-party analytics pixels on this site.
What we keep for your ChatConvert account
When you sign in and set up a workspace, we keep what the dashboard needs in order to work:
- Your account email and name, and the settings you enter, such as your website, niche, business details and reply settings
- Your Instagram connection: the account ID, username and profile details, and the access token Meta issues to us. The token is stored encrypted and used only to run your automations
- API keys you add for AI replies, stored encrypted. Only the last four characters are ever shown back to you
- What we read from your website: products, prices, and the text of your FAQ and policy pages
- The automations, answers and product links you set up
What we process on behalf of client brands
When a brand connects its Instagram Business or Creator account, ChatConvert reads and sends messages on that account through Meta's official APIs. In the course of that, we process:
- Instagram usernames, user IDs, and profile names of people who message the brand or comment on its posts
- The content of those direct messages and comments
- Products viewed, wishlisted, or compared inside the conversation, and any contact detail a customer volunteers to the brand
- Derived signals such as intent classification, sentiment, and lead score, which exist so the brand can prioritise who to reply to
- On Max and Bespoke builds that include them: WhatsApp phone numbers, names and messages received through the WhatsApp Business API, and for voice call agents, the number called and a transcript of the call
This data is held for the brand in its own workspace, used only to run the automations and dashboard it has set up, and never sold, rented, or used to train any model of our own. We do not combine one brand's customer data with another's.
Meta and Instagram platform data
Our access to a client's Instagram account is granted by that client through Meta's permission flow and can be revoked by them at any time from their Meta or Instagram settings. Revoking it stops our access immediately.
We use Instagram platform data only to provide the automation features the client has asked for. We comply with the Meta Platform Terms and Developer Policies, including the requirements not to sell platform data, not to use it for advertising targeting, and to delete it on request. If a client closes their account, the platform data we hold for them is deleted on the timeline set out under Retention below. If they remove ChatConvert from their Instagram settings, Meta sends us a deletion request and we delete that account's data and conversations at once.
Who else touches your data
We keep the list of third parties deliberately short, and every one of them is a service provider bound by its own contract and privacy terms rather than a party we sell data to.
| Provider | What it handles | Where |
|---|---|---|
| Supabase | Database, authentication, and the backend functions this website calls | Cloud hosting, region set per project |
| Contabo | The server that runs the ChatConvert dashboard's database and automations, where client workspaces live | India (Mumbai) |
| OpenAI, Anthropic or Google | Only when a brand turns on AI replies: the customer message being answered and the facts needed to answer it, sent with the brand's own API key, or with ours for Managed AI | United States |
| n8n | Runs the workflow behind the website chat assistant | European Union |
| Groq | Runs the language model behind the website chat assistant | United States |
| Sign in with Google, and the web fonts this site loads | Global | |
| Resend | Sends the notification emails triggered by a form submission | United States |
| Meta Platforms | The Instagram APIs the client automation runs on, and on Max and Bespoke the WhatsApp Business API | Global |
| Calling provider | Only on Max and Bespoke builds with voice call agents: the number called and the call audio, to place and transcribe the call | Named in the build plan |
We will also disclose data where the law requires it, for example in response to a valid order from a court or a government authority with jurisdiction over us. If a business is sold or merged, data may transfer as part of it, and we will say so on this page before that happens.
Cookies and browser storage
This site does not use advertising or cross-site tracking cookies. What it does store in your browser is:
- A random session ID in localStorage, so repeat visits in the same browser can be counted as one session rather than many. It contains no personal information and you can clear it by clearing site data.
- A random visitor ID in localStorage and a visit ID in sessionStorage, for the visit records described above. They contain no personal information and you can clear them by clearing site data.
- A flag in sessionStorage recording that you have already seen the loading screen once this tab, so it does not replay on every page you open.
- A sign-in key in IndexedDB, once you sign in. Your browser keeps it in a form that cannot be exported or copied to another device, and uses it to renew your 24-hour session. Signing out removes it.
- A Supabase authentication token, only if you sign in with Google. Signing out removes it.
Blocking or clearing this storage does not break the site. You will simply be signed out and counted as a new session.
How long we keep things
- Call bookings and contact enquiries: up to 24 months from your last contact with us, so we have context if you come back, then deleted.
- Website chat transcripts and activity events: up to 12 months.
- Website visit records: 180 days.
- Data in a ChatConvert workspace, including the customer conversations processed for a brand: for as long as the account is open, then deleted within 30 days of it closing unless the brand asks us in writing to hand it over or hold it longer.
- Records we are required to keep for tax or accounting reasons: for the period Indian law requires, which is currently eight years for books of account.
A deletion request under the section below is honoured ahead of these periods wherever we are not legally required to retain the record.
Your rights
Under the Digital Personal Data Protection Act, 2023, you can ask us to:
- Tell you what personal data of yours we hold and who we have shared it with
- Correct anything that is inaccurate or incomplete
- Erase data we no longer need for the purpose you gave it for
- Withdraw a consent you previously gave, at any time, with the same ease you gave it
- Nominate someone to exercise these rights on your behalf if you are unable to
Send any of these to the contact below and we will act on it within 30 days. There is no charge. We may ask you to confirm your identity first, purely so we do not hand your data to someone else. If you are unhappy with how we handled a request, you can escalate it to the Data Protection Board of India.
If you are in the EEA or the UK, the equivalent rights under GDPR apply to you and the same contact handles them.
Security
Data is stored on managed cloud infrastructure with encryption in transit over HTTPS and encryption at rest. Access to client dashboards sits behind authentication, database access is governed by row-level security policies, and the API keys used by our backend functions are held as server-side secrets that are never shipped to a browser.
No system is perfectly secure and we will not claim otherwise. If a breach occurs that is likely to affect you, we will notify you and the Data Protection Board of India as required, without undue delay.
Children
ChatConvert is a business tool and is not directed at children. We do not knowingly collect data from anyone under 18. If you believe a child's data has reached us, tell us and we will delete it.
International transfers
Some of the providers listed above process data outside India. Where that happens, the transfer is to a country not restricted by the Central Government under the DPDP Act, and the provider is contractually bound to protect the data to a standard consistent with this policy.
Changes to this policy
We will update this page when what we do changes, and the Last updated date at the top will change with it. Material changes affecting existing clients will also be sent to them directly rather than left to be noticed here.
Contact and grievances
Data protection queries, rights requests, and grievances all go to the same place, and are handled by the person responsible for data protection at ChatConvert.
Questions about this policy, or a request you would like us to act on, can go to Chatconvert12@gmail.com or WhatsApp +91 93726 14010. We aim to acknowledge every message within two working days.
- Email: Chatconvert12@gmail.com
- WhatsApp: +91 93726 14010
- Phone: +91 95944 41233