Privacy Policy
Our privacy policy and how we use your data
Last updated: August 13, 2026
This Privacy Notice describes how Voltaflow LLC, a Wyoming, USA company ("Voltaflow", "we"), collects, uses, shares and protects your personal data in connection with the Connver service. We are the data controller for the personal data of our direct users.
We comply with the Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP, a new law published in the Official Gazette on March 20, 2025), whose supervisory authority is the Secretaría Anticorrupción y Buen Gobierno; with the European Union General Data Protection Regulation (GDPR); and with applicable laws of the State of Wyoming. In the event of any conflict between translated versions, the Spanish version prevails.
1. Who We Are
Data controller: Voltaflow LLC, with registered address at 1021 E Lincolnway, 7729, Cheyenne, WY 82001, US.
Contact for privacy matters and to exercise your rights (DPO): hi@connver.com.
2. Data We Collect
Account data: name, email address, tenant name (team account), roles and permissions within the tenant.
Service usage data: messages exchanged through connected channels (WhatsApp and others), product catalog you upload, automations you configure, images you upload to the catalog, content generated by the AI agent on your behalf.
Technical data: IP address, browser and OS type, session identifiers, activity logs, strictly necessary and functional cookies (see Cookie Policy).
Billing data: processed directly by Paddle as Merchant of Record. We do NOT store or view full card data; we receive only payment confirmation and minimal billing details (name, billing address, last 4 digits).
3. Legal Basis for Processing
Contract performance: processing data necessary to provide the Service under the Terms of Service.
Legitimate interest: Service security, fraud prevention, product improvement without using identifiable content, indispensable transactional communications.
Consent: marketing communications (explicit opt-in), non-essential cookies where they exist (not applicable today).
Legal obligation: retention of tax data and responses to legitimate requests from competent authorities.
4. How We Use the Data
To operate the Service: process messages with the AI agent, execute automations, store your catalog, allow you to manage your team.
For transactional communications: account notifications, credit consumption alerts, billing, legal notices.
To improve the product: aggregate and anonymized usage metrics. We do NOT use the content of your messages or catalog to train third-party models or for purposes unrelated to operating the Service for you.
For security: abuse detection, fraud prevention, enforcement of the acceptable use policy.
5. Subprocessors
We share data with the following subprocessors, each bound by contractual confidentiality and security obligations equivalent to ours:
Supabase (USA): database, authentication and storage.
Vercel Inc. and Vercel AI Gateway (USA): Service hosting, gateway to AI models, and anonymous page-view analytics (Vercel Web Analytics, with no cookies or personal identifiers).
OpenAI (USA, via Vercel AI Gateway): embeddings for semantic knowledge search (text-embedding-3-small) and voice-note transcription (gpt-4o-transcribe). By default OpenAI does not train models on API data and retains abuse logs for up to 30 days.
Meta Platforms, Inc. — WhatsApp Cloud API (USA / EU depending on the WhatsApp Business account region): official messaging channel.
DeepSeek (People's Republic of China): deepseek-v4-flash language model used for the agent and validators. This international transfer is material and expressly disclosed; it is supported by your consent to these Terms and by contractual clauses equivalent to SCCs with our gateway provider.
Google LLC — Gemini (USA): gemini-2.5-flash model used for the Enki (catalog) copilot.
Cloudflare, Inc. — R2 (global edge): storage of catalog images.
Envia.com (Mexico): generation of shipping labels in Mexico, only when the tenant enables this feature.
MercadoPago (Mexico/Argentina): processing of payments the tenant receives from their end customers within conversations. NOT the SaaS billing processor.
Paddle.com Market Ltd (United Kingdom / EU): Merchant of Record for SaaS billing. Processes all charges and card data.
Resend (USA): transactional email delivery (magic-link sign-in, alerts, confirmations).
6. International Transfers
Data may be transferred outside your country of residence to jurisdictions where our subprocessors operate (primarily USA, EU, UK, Mexico, and China for DeepSeek specifically).
For transfers from the European Economic Area or UK to countries without an adequacy decision (including USA and China), we rely on the Standard Contractual Clauses (SCCs) approved by the European Commission or equivalent mechanisms.
By accepting these Terms, you expressly acknowledge and consent to the transfer of data to the subprocessors listed in section 5, including China for processing by DeepSeek.
7. Data Retention
Account data and profiles: retained while the account is active and for up to 90 calendar days after cancellation, to allow reactivation.
Conversation messages, catalog, automations: same criterion — 90 days post-cancellation.
Agent records (agent_runs, credit_debits, AI logs): identifiable data for 90 days post-cancellation; afterwards anonymized and retained only as aggregates without personally identifiable information.
Tax data and payment records: retained for 5 to 10 years under applicable tax laws for Voltaflow and Paddle. Paddle is the primary custodian of this retention.
Backups: 30 additional calendar days of rotation on top of the main retention period.
8. Your Rights
Under GDPR (EU / EEA / UK residents): rights of access, rectification, erasure, restriction of processing, portability, objection, and not to be subject to automated decisions with significant legal effects.
Under LFPDPPP (Mexico residents): ARCO rights (Access, Rectification, Cancellation, Opposition), as well as the right to object to automated processing (LFPDPPP 2025, Art. 26) and the right to revoke consent granted.
Under CCPA (California, USA residents): right to know what personal information is collected, right to request deletion, right to opt out of the sale or sharing of personal data (note: we do NOT sell or share personal data).
To exercise any of these rights, write to hi@connver.com with subject "Data rights request" stating your identity, the right you exercise and the specific data. We will respond within 20 business days of receiving the complete request and will make the right effective within the following 15 business days after our response (LFPDPPP 2025, Art. 31).
9. Security
We apply reasonable technical and organizational measures including: encryption in transit (TLS) and at rest, available multi-factor authentication, tenant isolation via Postgres Row Level Security, least-privilege principle in internal accesses.
No system is 100% secure. In the event of a data breach affecting personal data, we will notify affected users and competent authorities within the applicable legal deadlines.
10. Minors
The Service is not directed at persons under 18 and we do not knowingly collect personal data from minors. If you discover that a minor has provided us with data, contact us at hi@connver.com so we can delete it.
11. Changes to This Notice
We may update this Notice periodically. For material changes we will give at least 30 calendar days' prior notice by email or in-Service notification. The last-updated date appears at the top of the document.
12. Contact
Voltaflow LLC · 1021 E Lincolnway, 7729, Cheyenne, WY 82001, US.
DPO contact and rights requests: hi@connver.com.