Security & data privacy

Your business data stays yours.

When you hand us your brand, your customers and your campaigns, you need to know exactly what happens to them. Here it is in plain words - what we promise, how we protect it, and what we do not claim.

Five promises

  1. 1.Your data is yours

    Your brand files, customer lists, leads and campaign results belong to you. We never sell them, rent them or share them with another business.

  2. 2.Used only for your work

    We use what you give us to build and run your website, marketing and ads - nothing else. One client's data is never used for another client.

  3. 3.Seen only by who needs it

    Your account, and the Convotra team members working on it. Every time one of our staff opens a customer account, it is recorded.

  4. 4.Yours to take or delete

    Ask for a copy or for deletion at any time. When you leave, we delete your data within 30 days of your written request.

  5. 5.If something goes wrong, we tell you

    If your data is ever involved in a security incident, we will tell you within 72 hours of confirming it: what happened, what was affected and what we are doing.

How it is protected

In transit

  • Every Convotra page and every website we host is served over HTTPS.
  • Old, weak encryption versions are switched off.

Sign-in

  • Passwords are stored as one-way hashes; nobody, including us, can read them.
  • An account locks for 15 minutes after five wrong passwords.
  • You can sign in with Google instead of a password.

Connected accounts

  • When you connect Google, Facebook, Instagram, LinkedIn or another account, you approve it on that platform's own page - we never see your password there.
  • The access keys those platforms give us are stored encrypted.
  • Disconnect at any time and our access ends.

Your website

  • Each client website runs in its own separate container with its own database - one site cannot read another's.
  • Common attack routes into WordPress are switched off on every site we build.

Our servers

  • A firewall admits only web and mail traffic. The database is not reachable from the internet.
  • Repeated break-in attempts are banned automatically.
  • Security updates are installed automatically.

Watching and recovery

  • The server is checked every five minutes; anything suspicious alerts our team by email at once.
  • Every database is backed up daily and kept for seven days.

Who else handles your data

Only the services needed to do the work, and only the part each one needs.

The platforms you connect

Google, Meta (Facebook, Instagram, WhatsApp), LinkedIn, Pinterest, Snapchat, X and Telegram receive only what is needed to publish your posts and run your ads - and only after you connect them.

OpenAI

When you ask for AI-written text or a campaign plan, the text you typed for that request is sent to OpenAI to produce the result. Some AI tasks run on our own server instead.

Razorpay

Handles payments. Your card and bank details go to Razorpay directly; we never see or store them.

Our hosting provider

Runs the server our software lives on. They do not have access to your account.

Questions businesses ask us

We are giving you our brand and customer data. Will you sign an NDA?+

Yes. We sign a mutual non-disclosure agreement before any branding or marketing work starts, and a data processing agreement on request. You stay the owner of the data; we only process it on your instructions.

Will our designs or campaigns appear in your portfolio?+

Only with your written permission. By default, client work is confidential.

Who at Convotra can see our data?+

The team members assigned to your account and our administrators. Each time a staff member opens a customer account it is logged with who, when and which account.

Do you use our data to train AI?+

No. We do not train any AI model on your data. Text you submit for a generation request is sent to the AI provider only to produce that result.

Where is our data stored?+

On a server we rent and manage ourselves, plus the platforms you choose to connect. Ask us and we will tell you the provider and location in writing.

Are you ISO 27001 or SOC 2 certified?+

Not yet, and we would rather say so plainly. What we do instead is on this page, and we are glad to answer a security questionnaire from your team.

Need this in writing?

We sign an NDA and a data processing agreement before work starts, and we answer security questionnaires. To report a security concern, write to the same address - a person reads it.

support@convotra.com

This page describes our practices in plain language. The legal terms are in our Privacy Policy and Terms of Service.