Privacy policy

01Introduction

This policy explains how Aurvah handles personal data through this website, xconversions.com, and through the xconversions platform, at app.xconversions.com.

It describes what actually happens. Where the site does not do something, and there is a good deal it does not do, the policy says so rather than reserving the right to do it later.

02Who we are

xconversions is a product of Aurvah General Trading - L.L.C - S.P.C, a technology company operating between Morocco and the United Arab Emirates.

The company behind this website is identified on our legal notice.

03What this website collects

Personal data reaches us through this website in four ways, and only four: the contact form, the waitlist form, a question you leave in the FAQ panel, and the request data every website receives.

04The contact form

The contact form asks for what we need to reply to you:

• Your full name
• Your email address
• Your company or agency name
• A subject, and your message

It also records the language of the page you sent it from, so that we can answer in it.

Your message is received and stored by Netlify, which hosts this website, and read by our team so that we can answer you. We use it to reply and to keep a record of the enquiry. We do not add you to a mailing list.

Please do not put passwords, payment details or other sensitive information in the form.

05The waitlist form

The waitlist form asks for what we need to write to you when a place opens:

• Your full name
• Your email address
• Your WhatsApp number
• Your business name

It also records the language of the page you sent it from, so that we can write to you in it.

Your entry is received and stored by Netlify, which hosts this website, and read by our team. We use it to contact you about your place on the waitlist, and for nothing else.

06Questions typed into the FAQ panel

The FAQ panel answers on the page itself, from answers written in advance: choosing a listed question, or typing one it has an answer for, sends nothing anywhere.

When it has no written answer, or you ask to speak to someone, it asks for what our team needs to answer you, one at a time:

• Your full name
• Your phone number
• Your position and company name

It sends them with your question, and the language of the page, to our team. They are received and stored by Netlify, which hosts this website, and read by our team. We use them to answer your question, and for nothing else.

Please do not type passwords, payment details or other sensitive information into the panel.

07Information collected automatically

This website sets no cookies and stores nothing in your browser. It runs no analytics, no tag manager, no advertising pixel, no session recording and no visitor tracking of any kind. We do not build profiles of visitors, and we make no automated decisions about them.

As with any website, our host processes standard request data, including your IP address, your browser’s user agent and the page requested, to serve the page and keep the service secure and available. We do not use that data to identify visitors. From the IP address, our host also tells the page which country a visit comes from, so that a visitor from Morocco sees prices in Moroccan dirhams; that country is not stored.

The cookie policy has the detail.

08How we use information

• To answer your message
• To contact you about your place on the waitlist
• To answer a question typed into the FAQ panel
• To keep this website secure and available
• To meet legal and regulatory obligations

We do not sell personal data. We do not share it for anyone else’s marketing, and we do not send marketing to people who have only written to us.

09Legal basis

Where the EU or UK GDPR applies to our processing, we rely on:

• Legitimate interests: answering a message or a question you sent us, and keeping this website secure.
• Steps before a contract: where you ask us about plans, the pilot or putting the product to work for your business.
• Legal obligation: where the law requires us to keep records.

10Service providers for this website

One provider handles data in connection with this website:

Netlify acts on our instructions and may not use the data for its own purposes.

We use no analytics provider, no advertising network and no other form service.

11The xconversions platform

Everything above is about this website. This part is about the platform itself, at app.xconversions.com, where businesses connect their WhatsApp number, their Facebook Page and the Instagram professional account linked to it, and run their agent.

When a business uses the platform, it decides what happens to its customers’ data: it is the controller. Aurvah processes that data on its behalf and on its instructions, as its processor. If you wrote to a business that uses xconversions, that business’s own privacy notice applies, and requests about your conversation go to it first; we help it answer them.

For the business’s own account on the platform (its team’s names, email addresses and roles), Aurvah is the controller, and relies on the contract with the business.

12What the platform processes

When a business connects its WhatsApp number, its Facebook Page or its Instagram account and uses the platform, we process:

• Its WhatsApp Business account details: the account, business and number identifiers, the phone numbers it connects and the name each one shows, and what Meta reports about them, such as their quality rating and messaging limit
• Its Facebook Page’s and Instagram professional account’s details: their identifiers, their names, the account’s @username and their profile pictures
• Its message templates, as it writes them and as Meta reviews them
• Its customers’ contacts: names, phone numbers and, where the business has them, email addresses; their language; the tags and fields the business adds; and whether each has agreed to be messaged
• For customers who write on Messenger or Instagram: the identifier Meta gives each person for that Page or account and, where Meta provides them, their name, their Instagram @username and their profile picture. We keep a copy of the picture so that the inbox can show it, and refresh it when Meta’s link expires
• The conversations between the business and its customers on WhatsApp, Messenger and Instagram, every message in both directions, including the earlier conversations WhatsApp brings across when a number also stays on the WhatsApp Business app
• Attachments sent in those conversations, such as images, voice notes, videos and documents, and, on Instagram, the stories a customer replies to or shares
• The access tokens Meta issues when the business connects its number, its Page or its Instagram account, which let the platform act for that business alone
• Its team’s names, email addresses and roles

We use this only to run the service for that business: answering its customers, sending the messages it asks us to send, and showing it its conversations and reports.

13What we receive from Meta, and why

When a business connects its WhatsApp number, it grants the platform two permissions through Meta:

• whatsapp_business_messaging: to receive the messages its customers send, and to send its replies and templates.
• whatsapp_business_management: to read its WhatsApp Business account, numbers and templates, and to submit new templates for Meta’s review.

When a business connects its Facebook Page, and the Instagram professional account linked to it, through Facebook Login for Business, it grants these:

• pages_show_list: to list the Pages the business manages, so that it can choose the one to connect.
• business_management: to find the business portfolio the Page belongs to, and to keep the connection working through that business.
• pages_manage_metadata: to subscribe the Page to the notifications that bring us its messages, and to unsubscribe it when the business disconnects it.
• pages_messaging: to receive the messages people send to the Page, and to send the business’s replies.
• pages_read_engagement: to read the Page’s name, picture and basic details.
• Business Asset User Profile Access: to show the name and profile picture of the people who message the Page.
• instagram_basic: to read the Instagram professional account linked to the Page: its identifier, @username, name and profile picture.
• instagram_manage_messages: to receive the direct messages people send to the Instagram account, and to send the business’s replies.

We use what these permissions give us only to provide the service to that business, answering its customers in its inbox. We never post on the Page or the Instagram account, never read or answer posts or comments, and never use any of it for advertising or to build profiles. We never sell it, and share it only with the providers below, to run the service.

14Who helps us run the platform

No payment provider handles personal data today. If we add one, it will be listed here before it does.

Each receives only what its purpose needs.

15How long the platform keeps data

• Messages are kept in full, in both directions, for as long as the business keeps its workspace, so that whoever takes over a conversation can read it.
• A contact file a business uploads is deleted as soon as its import finishes, and within a day if the import is abandoned.
• An opt-out is kept for as long as the workspace exists, so that someone who asked not to be messaged never is again.
• When a business disconnects a Facebook Page or an Instagram account, or removes xconversions from its business integrations at Meta, we delete the access token at once and stop receiving its messages. Its conversations stay in the workspace until the business has the workspace deleted.
• When a business asks us to delete its workspace, all of it is deleted: see data deletion.

16How the platform protects data

• Each business’s data sits in its own workspace, and no business can see another’s.
• The access tokens Meta issues and the platform’s API keys are encrypted at rest, and an API key is never shown again once it has been issued.
• Inside a workspace, access follows the roles its owner gives the team.
• We never sell this data, and never use it for advertising.

17Deleting your data

A business can have its workspace and everything in it deleted. How to ask, what is deleted, what is kept and how long it takes are on our data deletion page.

18Data sharing

We share personal data only with the providers above, with professional advisers where necessary, and where the law requires it. We do not sell or rent it.

19International transfers

Aurvah operates between Morocco and the United Arab Emirates, and our providers operate internationally, so personal data may be processed outside the country you are in.

Where a transfer is subject to the EU or UK GDPR, we put an appropriate safeguard in place, such as standard contractual clauses. If where your data is stored matters to you, ask us before you send it and we will tell you.

20How long this website keeps data

We keep a message sent through the contact form for as long as we need it to deal with your enquiry and to keep a record of it, and delete it when it is needed for neither. A specific retention schedule is being written; until it is published, ask us and we will tell you what we hold.

We keep a waitlist entry for as long as we need it to offer you a place, and delete it when you ask us to.

We keep a question left in the FAQ panel, with the details you gave, for as long as we need it to answer you, and delete it when you ask us to.

21How this website protects data

Access to what you send us is limited to the people who need it to answer you. No way of sending information over the internet is completely secure, so please do not send passwords or highly sensitive material through the form or the panel.

22If you messaged a business that uses xconversions

If you wrote to a business on WhatsApp, Messenger or Instagram, and that business uses xconversions, the business decides what happens to your conversation, and you can ask it first.

You can also email contact@xconversions.com with the business’s name, the channel you used, and the name, number or account you wrote from. Within 30 days we pass your request to the business and delete your conversation and the details we hold about you, unless the business must keep them by law. We email you when it is done.

23Your rights

Subject to the law that applies to you, you can ask us to:

• Confirm what personal data we hold about you, and give you a copy
• Correct data that is wrong or incomplete
• Delete data we no longer have a reason to keep
• Restrict or object to how we process it
• Provide it in a portable format

Ask at contact@xconversions.com. We will reply within the time the applicable law requires. If you are in the EU or the UK and are unhappy with our reply, you can complain to your local supervisory authority.

24GDPR and other frameworks

Where the EU or UK GDPR applies to a processing activity, we apply it. Aurvah does not hold, and does not claim, any form of GDPR certification: none is required to comply, and we would rather be accurate than reassuring.

25Children’s privacy

This is a business website. It is not directed at children, and we do not knowingly collect personal data from anyone under 16. If you believe a child has sent us personal data, tell us and we will delete it.

26Changes to this policy

If we change this policy, we update the date at the top of the page. The date changes only when the text does.

27Contact

Privacy questions and requests: contact@xconversions.com.