Privacy Policy
1. Who we are
Converse is operated by Converse. You can contact us at [email protected].
2. What data we collect about you (the customer)
When you sign up for Converse, we collect:
- Your email address and a hashed password.
- Your business name and the website URL you provided.
- The industry you picked from our signup form.
- Your chosen subscription tier.
- Your billing email and the last 4 digits of the card on file with Stripe (Stripe stores the rest; we never see your full card number).
3. What data we collect about your website visitors
When a visitor opens a chat with your Converse widget, we collect:
- The chat messages they send and our agent's responses.
- If the agent captures a lead, the visitor's name, email, phone number, and any service-interest text they provided.
- The visitor's browser user-agent string and the origin of the page (the website they were on).
- A random anonymous identifier stored in their browser's localStorage so the chat can resume across page reloads.
We do not collect IP addresses from visitors at this time, beyond what is logged by Heroku as part of normal HTTP request handling.
4. How we use that data
- To provide the chat-widget service to you and your visitors.
- To send captured leads to the webhook URLs you configure in the Integrations tab.
- To charge your subscription fee via Stripe and to manage your account.
- To send you service announcements (outages, billing events, security alerts).
- To respond to your support requests.
We do not sell, rent, or share your data (or your visitors' data) with any third party for marketing purposes.
5. Sub-processors
We use the following sub-processors to provide Converse:
- Heroku (Salesforce) — hosts the application, database, and cache. Data resides in the United States.
- Google (Gemini API) — processes chat messages to generate the agent's responses. The visitor's messages and your system prompt are sent to Google. Google's data-use policy for the Gemini API is "no data used for training".
- Stripe — processes payments and stores your card information (PCI-DSS compliant; Converse never sees the full card number).
- Resend — sends transactional email (welcome, password reset, email verification, booking confirmations, billing receipts, and platform announcements).
- Cloudflare — provides DNS management and bot protection (Cloudflare Turnstile CAPTCHA on the signup form).
6. Data retention
- Account data (email, business name, billing history): retained while your account is active and for 30 days after cancellation.
- Chat transcripts and captured leads: retained while your account is active. You can delete individual leads from the dashboard. Bulk deletion is available on request.
- Operational logs (Heroku platform logs): retained by Heroku per their retention policy (typically 7 days for app logs).
7. Your rights (under Jamaica's Data Protection Act, 2020)
- Right of access: request a copy of the personal data we hold about you and your visitors.
- Right of correction: ask us to fix inaccurate data.
- Right of deletion: ask us to delete your data (subject to legal retention obligations like tax records).
- Right to opt out of marketing: we don't send marketing email today, so this isn't applicable.
To exercise any of these rights, email [email protected]. We will respond within 30 days.
8. Security
- All data in transit is encrypted with TLS 1.2+ (Heroku ACM / Cloudflare-managed certificates).
- Tenant integration secrets (webhook URLs, API keys) are encrypted at rest with Fernet symmetric encryption (AES-128 in CBC mode with HMAC-SHA256).
- Database access requires Heroku Postgres credentials, which are stored as environment variables and never in code.
- Passwords are hashed with bcrypt (cost factor 12).
- Tenant data is logically isolated by a tenant_id column on every row. Cross-tenant access is blocked by the application code.
9. Cookies
Converse uses session cookies (one per dashboard user, signed with a server secret, httpOnly, SameSite=Lax). The embed widget optionally sets a localStorage identifier on the visitor's browser to support chat continuity across page reloads. We do not use third-party analytics or advertising cookies.
10. Children
Converse is not intended for use by anyone under 18. We do not knowingly collect data from children. If you believe a child has used Converse, contact us and we will delete the data.
11. Changes to this policy
We may update this policy. Material changes will be emailed to customers at least 30 days before they take effect.
12. Contact
Email [email protected].