Privacy policy

01Introduction

This policy explains how Aurvah handles personal data through this website, xconversions.com, and through the xconversions platform, at app.xconversions.com.

It describes what actually happens. Where the site does not do something, and there is a good deal it does not do, the policy says so rather than reserving the right to do it later.

02Who we are

xconversions is a product of Aurvah General Trading - L.L.C - S.P.C, a technology company operating between Morocco and the United Arab Emirates.

The company behind this website is identified on our legal notice.

03What this website collects

Personal data reaches us through this website in four ways, and only four: the contact form, the waitlist form, a question you type into the FAQ panel, and the request data every website receives.

04The contact form

The contact form asks for what we need to reply to you:

• Your full name
• Your email address
• Your company or agency name
• A subject, and your message

It also records the language of the page you sent it from, so that we can answer in it.

Your message is received and stored by Netlify, which hosts this website, and read by our team so that we can answer you. We use it to reply and to keep a record of the enquiry. We do not add you to a mailing list.

Please do not put passwords, payment details or other sensitive information in the form.

05The waitlist form

The waitlist form asks for what we need to write to you when a place opens:

• Your full name
• Your email address
• Your WhatsApp number
• Your business name

It also records the language of the page you sent it from, so that we can write to you in it.

Your entry is received and stored by Netlify, which hosts this website, and read by our team. We use it to contact you about your place on the waitlist, and for nothing else.

06Questions typed into the FAQ panel

The questions already listed in the FAQ panel are answered on the page itself: choosing one sends nothing anywhere.

A question you type yourself is sent to this website’s own function, which passes it to Google’s Gemini service to write the answer from the facts on this page. This website does not store the question.

To stop the panel being flooded, the function counts how many questions come from each visitor in an hour. It does this with a scrambled form of your IP address, held in memory only and never written down.

Please do not type personal information into the panel.

07Information collected automatically

This website sets no cookies and stores nothing in your browser. It runs no analytics, no tag manager, no advertising pixel, no session recording and no visitor tracking of any kind. We do not build profiles of visitors, and we make no automated decisions about them.

As with any website, our host processes standard request data, including your IP address, your browser’s user agent and the page requested, to serve the page and keep the service secure and available. We do not use that data to identify visitors.

The cookie policy has the detail.

08How we use information

• To answer your message
• To contact you about your place on the waitlist
• To answer a question typed into the FAQ panel
• To keep this website secure and available
• To meet legal and regulatory obligations

We do not sell personal data. We do not share it for anyone else’s marketing, and we do not send marketing to people who have only written to us.

09Legal basis

Where the EU or UK GDPR applies to our processing, we rely on:

• Legitimate interests: answering a message or a question you sent us, and keeping this website secure.
• Steps before a contract: where you ask us about plans, the pilot or putting the product to work for your business.
• Legal obligation: where the law requires us to keep records.

10Service providers for this website

Two providers handle data in connection with this website:

Netlify acts on our instructions and may not use the data for its own purposes. Google processes a typed question to produce its answer, under its terms for the Gemini service.

We use no analytics provider, no advertising network and no other form service.

11The xconversions platform

Everything above is about this website. This part is about the platform itself, at app.xconversions.com, where businesses connect their WhatsApp number and run their agent.

When a business uses the platform, it decides what happens to its customers’ data: it is the controller. Aurvah processes that data on its behalf and on its instructions, as its processor. If you wrote to a business that uses xconversions, that business’s own privacy notice applies, and requests about your conversation go to it first; we help it answer them.

For the business’s own account on the platform (its team’s names, email addresses and roles), Aurvah is the controller, and relies on the contract with the business.

12What the platform processes

When a business connects its WhatsApp number and uses the platform, we process:

• Its WhatsApp Business account details: the account, business and number identifiers, the phone numbers it connects and the name each one shows, and what Meta reports about them, such as their quality rating and messaging limit
• Its message templates, as it writes them and as Meta reviews them
• Its customers’ contacts: names, phone numbers and, where the business has them, email addresses; their language; the tags and fields the business adds; and whether each has agreed to be messaged
• The conversations between the business and its customers, every message in both directions, including the earlier conversations WhatsApp brings across when a number also stays on the WhatsApp Business app
• Media sent in those conversations, such as images, voice notes and documents
• The access token Meta issues when the business connects its number, which lets the platform act for that business alone
• Its team’s names, email addresses and roles

We use this only to run the service for that business: answering its customers, sending the messages it asks us to send, and showing it its conversations and reports.

13What we receive from Meta, and why

When a business connects its WhatsApp number, it grants the platform two permissions through Meta:

• whatsapp_business_messaging: to receive the messages its customers send, and to send its replies and templates.
• whatsapp_business_management: to read its WhatsApp Business account, numbers and templates, and to submit new templates for Meta’s review.

We use what these permissions give us only to provide the service to that business. We never sell it, never use it for advertising or to build profiles, and share it only with the providers below, to run the service.

14Who helps us run the platform

No payment provider handles personal data today. If we add one, it will be listed here before it does.

Each receives only what its purpose needs. Anthropic and Google process what they receive to produce the reply or the reading, under their terms for those services.

15How long the platform keeps data

• Messages are kept in full, in both directions, for as long as the business keeps its workspace, so that whoever takes over a conversation can read it.
• A contact file a business uploads is deleted as soon as its import finishes, and within a day if the import is abandoned.
• An opt-out is kept for as long as the workspace exists, so that someone who asked not to be messaged never is again.
• When a business asks us to delete its workspace, all of it is deleted: see data deletion.

16How the platform protects data

• Each business’s data sits in its own workspace, and no business can see another’s.
• The access tokens Meta issues and the platform’s API keys are encrypted at rest, and an API key is never shown again once it has been issued.
• Inside a workspace, access follows the roles its owner gives the team.
• We never sell this data, and never use it for advertising.

17Deleting your data

A business can have its workspace and everything in it deleted. How to ask, what is deleted, what is kept and how long it takes are on our data deletion page.

18Data sharing

We share personal data only with the providers above, with professional advisers where necessary, and where the law requires it. We do not sell or rent it.

19International transfers

Aurvah operates between Morocco and the United Arab Emirates, and our providers operate internationally, so personal data may be processed outside the country you are in.

Where a transfer is subject to the EU or UK GDPR, we put an appropriate safeguard in place, such as standard contractual clauses. If where your data is stored matters to you, ask us before you send it and we will tell you.

20How long this website keeps data

We keep a message sent through the contact form for as long as we need it to deal with your enquiry and to keep a record of it, and delete it when it is needed for neither. A specific retention schedule is being written; until it is published, ask us and we will tell you what we hold.

We keep a waitlist entry for as long as we need it to offer you a place, and delete it when you ask us to.

This website keeps no copy of a question typed into the FAQ panel.

21How this website protects data

Access to what you send us is limited to the people who need it to answer you. No way of sending information over the internet is completely secure, so please do not send passwords or highly sensitive material through the form or the panel.

22Your rights

Subject to the law that applies to you, you can ask us to:

• Confirm what personal data we hold about you, and give you a copy
• Correct data that is wrong or incomplete
• Delete data we no longer have a reason to keep
• Restrict or object to how we process it
• Provide it in a portable format

Ask at contact@xconversions.com. We will reply within the time the applicable law requires. If you are in the EU or the UK and are unhappy with our reply, you can complain to your local supervisory authority.

23GDPR and other frameworks

Where the EU or UK GDPR applies to a processing activity, we apply it. Aurvah does not hold, and does not claim, any form of GDPR certification: none is required to comply, and we would rather be accurate than reassuring.

24Children’s privacy

This is a business website. It is not directed at children, and we do not knowingly collect personal data from anyone under 16. If you believe a child has sent us personal data, tell us and we will delete it.

25Changes to this policy

If we change this policy, we update the date at the top of the page. The date changes only when the text does.

26Contact

Privacy questions and requests: contact@xconversions.com.