Privacy Policy
Our privacy policy and how we use your data
Last updated: August 20, 2026
This Privacy Notice describes how Voltaflow LLC, a Wyoming, USA company ("Voltaflow", "we"), collects, uses, shares and protects your personal data in connection with the Connver service. We are the data controller for the personal data of our direct users.
We comply with the Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP, a new law published in the Official Gazette on March 20, 2025), whose supervisory authority is the Secretaría Anticorrupción y Buen Gobierno; with the European Union General Data Protection Regulation (GDPR); and with applicable laws of the State of Wyoming. In the event of any conflict between translated versions, the Spanish version prevails.
1. Who We Are
Data controller: Voltaflow LLC, with registered address at 1021 E Lincolnway, 7729, Cheyenne, WY 82001, US.
Contact for privacy matters and to exercise your rights (DPO): hi@connver.com.
2. Data We Collect
Account data: name, email address, tenant name (team account), roles and permissions within the tenant.
Service usage data: messages exchanged through connected channels (WhatsApp and others), product catalog you upload, automations you configure, images you upload to the catalog, content generated by the AI agent on your behalf.
Technical data: IP address, browser and OS type, session identifiers, activity logs, strictly necessary and functional cookies (see Cookie Policy).
Billing data: processed directly by Paddle as Merchant of Record. We do NOT store or view full card data; we receive only payment confirmation and minimal billing details (name, billing address, last 4 digits).
3. Legal Basis for Processing
Contract performance: processing the data needed to provide the Service under the Terms of Service.
Legitimate interest: Service security, fraud prevention, product improvement with aggregated and anonymized metrics, B2B prospection (identifying trial accounts with usage signals that may convert to paying customers), indispensable transactional communications. You may object to prospection and aggregate-based improvement by writing to hi@connver.com.
Consent: marketing communications (explicit opt-in), non-essential cookies where they exist (none apply today).
Legal obligation: tax data retention and responses to competent authority requests.
4. How We Use the Data
To operate the Service: processing messages with the AI agent, running automations, storing your catalog, letting you manage your team.
For transactional communications: account notifications, credit usage alerts, billing, legal notices.
To improve the product: aggregated and anonymized usage metrics (never the identifiable content of your messages). We do NOT use your message or catalog content to train third-party models or for purposes unrelated to operating the Service for you.
For our own B2B prospection: usage signals from your account (enabled features, conversation volume, onboarding progress) to offer you the right plan. Only over your account metadata, never over your end contacts' personal data. Object at hi@connver.com.
For security: abuse detection, fraud prevention, acceptable use policy enforcement.
5. Subprocessors
We share data with the following subprocessors, each under confidentiality and security obligations equivalent to ours. The specific models within each family may vary for cost or availability reasons; the current list of families and providers is this section:
Supabase (USA): database, authentication and storage.
Vercel Inc. and Vercel AI Gateway (USA): Service hosting, gateway to AI models, and anonymous page-view analytics plus Core Web Vitals (Vercel Web Analytics and Speed Insights, with no cookies or personal identifiers).
OpenAI (USA, via Vercel AI Gateway): embeddings for semantic knowledge search (text-embedding-3-small) and voice-note transcription (gpt-4o-transcribe). By default OpenAI does not train models on API data and retains abuse logs for up to 30 days.
Meta Platforms, Inc. — WhatsApp Cloud API (USA / EU depending on the WhatsApp Business account region): official messaging channel.
DeepSeek (People's Republic of China): deepseek-v4-flash language model used for the agent and validators. This international transfer is material and expressly disclosed; it is supported by your consent to these Terms and by contractual clauses equivalent to SCCs with our gateway provider.
Google LLC — Gemini (USA): gemini-2.5-flash model used for the Enki (catalog) copilot.
Cloudflare, Inc. — R2 (global edge): storage of catalog images.
Envia.com (Mexico): generation of shipping labels in Mexico, only when the tenant enables this feature.
MercadoPago (Mexico/Argentina): processing of payments the tenant receives from their end customers within conversations. NOT the SaaS billing processor.
Paddle.com Market Ltd (United Kingdom / EU): Merchant of Record for SaaS billing. Processes all charges and card data.
Resend (USA): transactional email delivery (magic-link sign-in, alerts, confirmations).
6. International Transfers
Data may be transferred outside your country of residence to jurisdictions where our subprocessors operate (primarily USA, EU, UK, Mexico, and China for DeepSeek specifically).
For transfers from the European Economic Area or UK to countries without an adequacy decision (including USA and China), we rely on the Standard Contractual Clauses (SCCs) approved by the European Commission or equivalent mechanisms.
By accepting these Terms, you expressly acknowledge and consent to the transfer of data to the subprocessors listed in section 5, including China for processing by DeepSeek.
7. Data Retention
Account data and profiles: retained while the account is active and for up to 90 calendar days after cancellation, to allow reactivation.
Conversation messages, catalog, automations: same criterion — 90 days post-cancellation.
Agent records (agent_runs, credit_debits, AI logs): identifiable data for 90 days post-cancellation; afterwards anonymized and retained only as aggregates without personally identifiable information.
Tax data and payment records: retained for 5 to 10 years under applicable tax laws for Voltaflow and Paddle. Paddle is the primary custodian of this retention.
Backups: 30 additional calendar days of rotation on top of the main retention period.
8. Your Rights
Under GDPR (EU / EEA / UK residents): rights of access, rectification, erasure, restriction of processing, portability, objection, and not to be subject to automated decisions with significant legal effects.
Under LFPDPPP (Mexico residents): ARCO rights (Access, Rectification, Cancellation, Opposition), as well as the right to object to automated processing (LFPDPPP 2025, Art. 26) and the right to revoke consent granted.
Under CCPA (California, USA residents): right to know what personal information is collected, right to request deletion, right to opt out of the sale or sharing of personal data (note: we do NOT sell or share personal data).
To exercise any of these rights, write to hi@connver.com with subject "Data rights request" stating your identity, the right you exercise and the specific data. We will respond within 20 business days of receiving the complete request and will make the right effective within the following 15 business days after our response (LFPDPPP 2025, Art. 31).
9. Security
We apply reasonable technical and organizational measures including: encryption in transit (TLS) and at rest, available multi-factor authentication, tenant isolation via Postgres Row Level Security, least-privilege principle in internal accesses.
No system is 100% secure. In the event of a data breach affecting personal data, we will notify affected users and competent authorities within the applicable legal deadlines.
10. Minors
The Service is not directed at persons under 18 and we do not knowingly collect personal data from minors. If you discover that a minor has provided us with data, contact us at hi@connver.com so we can delete it.
11. Changes to This Notice
We may update this Notice periodically. For material changes we will give at least 30 calendar days' prior notice by email or in-Service notification. The last-updated date appears at the top of the document.
12. Contact
Voltaflow LLC · 1021 E Lincolnway, 7729, Cheyenne, WY 82001, US.
DPO contact and rights requests: hi@connver.com.