Government Data Request Policy

1. Purpose

This policy sets out how Convotra AI Technologies Pvt. Ltd. ("Convotra", "we") handles requests from governments, courts, law enforcement agencies and other public authorities ("authorities") for personal data or other information about our customers and their end users. It applies to Convotra AI (convotra.website) and convotra.com, including data we receive through Meta Platforms (Facebook, Instagram, the WhatsApp Business Platform and the Marketing API).

2. Principles

• Legal process only. We disclose data only when we are legally required to, under a valid and binding order, notice or request issued under applicable law.
• No voluntary disclosure. We do not give authorities data voluntarily or in bulk, and we do not give any authority direct access to our systems.
• Minimum necessary. When we must disclose, we disclose only the specific data the request legally requires.
• Transparency. We tell the affected customer about the request unless the law or the order prohibits it.
• Challenge where appropriate. We push back on requests that are unclear, overly broad or not legally valid.

3. Who handles requests

All requests are handled by the Director of Convotra AI Technologies Pvt. Ltd., or a person they appoint in writing, with external legal counsel where needed. Employees who receive a request in any form must not disclose any data and must forward it to the Director the same day.

Requests should be sent to support@convotra.com, Convotra AI Technologies Pvt. Ltd., Gurgaon, Haryana, India.

4. Review of every request

Before any data is disclosed, the request is checked for:

1. Authenticity: it really comes from the stated authority, verified through official channels.
2. Legal basis: it is issued under a law that applies to Convotra, such as the Information Technology Act, 2000 and its rules, the Bharatiya Nagarik Suraksha Sanhita, 2023, the Digital Personal Data Protection Act, 2023, or a court order.
3. Authority and jurisdiction: the official is empowered to issue it, and it is within that authority's jurisdiction.
4. Scope: it clearly identifies the account or person and the data sought, and is limited in time and content.
5. Form: it is in writing and issued through an official channel.

Requests from authorities outside India must come through the proper international legal process, such as a Mutual Legal Assistance Treaty or letters rogatory, unless Indian law requires otherwise.

5. Challenging requests

If a request fails any check above, or is overly broad, we ask the authority to clarify or narrow it, decline it in writing, or, where appropriate, challenge it before the competent court or authority. We do not disclose data while a valid challenge is pending, unless the law requires us to.

6. Data minimisation

• We disclose only the data fields and time period the request legally requires.
• Where possible we provide account details instead of message content, and aggregated or anonymised data instead of personal data.
• Data is sent through a secure channel, and a copy of exactly what was sent is kept with the request record.
• Access tokens, passwords and keys for Meta or any other platform are never disclosed.

7. Data received from Meta

Data we receive through Meta's platforms (for example WhatsApp messages, Page and Instagram details, and ad performance figures) is held only to provide our service to the business that connected its account. If an authority asks for such data, we apply this policy in full and also follow Meta's Platform Terms. Where the request is really for data held by Meta, we direct the authority to Meta's own law enforcement process.

8. Notifying the customer

We notify the affected business customer (and, where relevant, the end user) before disclosing data, so they can seek legal advice or challenge the request, unless the law or the order prohibits notice, or notice would put someone's life or safety at immediate risk. If notice was delayed for these reasons, we notify the customer once the restriction ends.

9. Emergency requests

If an authority states that there is an immediate risk of death or serious physical harm, the Director may disclose the minimum data needed to address that risk, after verifying the requester. Written legal process must follow, and the case is recorded as below.

10. Records

For every request we record the date received, the authority and official, the legal basis cited, the data requested, our review and decision, any challenge, the data actually disclosed (if any), and whether and when the customer was notified. Records are kept for at least three years and are accessible only to the Director and legal counsel.

11. Cyber security incident reporting

Separately from data requests, we comply with mandatory cyber security reporting duties under Indian law, including the CERT-In directions issued under section 70B of the Information Technology Act, 2000. Such reports cover the incident and do not include customer content beyond what the directions require.

12. Training and review

Every employee and contractor with access to customer data is told about this policy when they join. This policy is reviewed at least once a year, and whenever relevant laws change.

13. Contact

Questions about this policy can be sent to support@convotra.com. See also our Privacy Policy.