Privacy & Cookie Policy

Konvuno determines why and how account administration, service security, operational, and billing data is processed and is normally the controller for that data. For visitor messages, leads, handoffs, and widget interaction records collected for a business, that business normally determines the purpose and is the controller; Konvuno processes the data to provide the service.

The business that installed the widget is responsible for its own privacy notice, legal basis, consent choices, and responses to its visitors. If you are a widget visitor, contact that business first about your conversation or lead data.

• Account and team data — email address; if you sign in with Google, your Google account identifier and the name Google provides; sign-in records (a hashed one-time code with its send and attempt counts, your sign-in sessions and their expiry, and a keyed hash of the client IP address used for sign-in rate limits); organization name, membership, role, invitations, and timestamps.
• Business profile and files — business and website details, industry, description, contact details, address, timezone, hours, public logos or widget avatars, and catalog-import CSV files, which are kept only until the import finishes, fails or is rolled back.
• Business content and configuration — FAQs, sources, catalogs and product/service fields, allowed domains, published widget versions, widget drafts (saved to the account and in the browser), and browser-local catalog mapping templates.
• Website analysis — URLs you submit, public pages fetched from those sites, extracted business/contact details, page metadata, generated FAQ candidates, errors, and scan history. Raw crawled page text is used during the scan but is not stored in the completed analysis row.
• Visitor and conversation data — a randomly generated visitor identifier, host origin and source origin (new records omit URL paths, queries and fragments), messages, AI replies, conversation timestamps and status, language, summaries, tags, internal notes, handoff requests, and any lead details submitted, including name, email, phone, company, message, and recorded consent choice.
• Security and usage data — a salted hash of the client IP address (not the raw IP in application tables), risk score and reasons, rate-limit and abuse events, historical widget opens, catalog searches/clicks, link clicks and event URLs (new optional widget analytics are disabled), token counts, provider/model names, estimated costs, allowances, and audit events.
• Analytics data — if you accept analytics cookies, Google Analytics receives page URLs and titles, referrer information, timestamps, browser and device information, approximate location derived from network data, interaction and campaign-attribution data, and Google Analytics identifiers. Konvuno does not intentionally send names, email addresses, conversation content, FAQ or catalog content, or an authenticated user ID to Google Analytics.
• Billing data — Stripe customer and subscription identifiers, plan, subscription status and periods, cancellation status, and entitlements. Payment-card details are provided to Stripe and are not stored in Konvuno's database.

The current applications do not include PostHog, Sentry, session replay, or advertising pixels.

Konvuno currently calls the OpenAI API for chat completions and text embeddings. Depending on the feature, OpenAI receives some or all of: visitor messages and recent conversation history, assistant replies, business profile and widget instructions, matched FAQs, catalog categories and search results, FAQ/catalog text for embeddings, a transcript requested for summarization, and public website text used to generate FAQ suggestions.

Konvuno's code contains no model-training or provider data-sharing opt-in flow. OpenAI states that API data is not used to train its models unless the API customer opts in. Under OpenAI's default API controls, prompts and responses may be retained in abuse-monitoring logs for up to 30 days unless different approved controls apply. See OpenAI's API data controls.

• Authenticate users and operate organizations, roles, invitations, settings, content, publishing, export, and deletion.
• Crawl submitted public sites, generate and store embeddings, retrieve relevant content, generate assistant replies, create optional summaries, and show catalog results.
• Store conversations, capture leads and consent choices, create handoffs, and email the business when configured.
• Enforce allowed domains, rate limits, plan allowances, cost ceilings, and anti-abuse controls; investigate failures and protect tenants and the service.
• Measure business-facing widget outcomes and maintain internal usage, cost, billing, and audit records.
• Comply with legal obligations and enforce the Terms.

Konvuno does not sell personal data or use it for cross-context behavioral advertising. Where applicable law requires a legal basis, processing is based on providing the service or taking requested pre-contract steps, legitimate interests in operating and securing it, legal obligations, or consent where the business chooses or law requires consent.

• Railway — hosting for Konvuno's API, background worker, PostgreSQL database (including vector search) and Redis queue, in Amsterdam, the Netherlands. It stores and processes the account, business, visitor, content, usage, security, and billing records described above. See Railway's Privacy Policy.
• OpenAI — chat generation, summaries, website-analysis suggestions, and embeddings, as detailed in section 3. See OpenAI privacy.
• Google Analytics — consent-based measurement of visits and page use across the Konvuno marketing site and dashboard under measurement ID G-DGFC7E63NX. Google may process the analytics data described in section 2 in the United States and other countries. See Google's Privacy Policy and Google's business-data privacy information.
• Resend — sign-in code emails, invitations, transactional lead or handoff notifications, and billing notifications. Authentication, invitation and billing emails contain the information needed for those transactions. New lead, handoff and support notifications contain a generic notice and a dashboard link; they do not include visitor contacts, submitted text or transcripts. Older emails may remain in recipient mailboxes. See Resend privacy.
• Stripe — subscription billing: Stripe-hosted checkout and customer-portal pages, payment processing, and subscription events for paid plans. Stripe receives the account owner's email, payment and transaction data, and may act as an independent controller for some activities. See Stripe privacy.
• Cloudflare — network and hosting infrastructure for Konvuno's surfaces: it hosts the dashboard and the marketing site, delivers the widget loader and iframe assets from R2/CDN, stores uploaded logos and widget avatars in R2 object storage under the EU jurisdiction, and provides DNS for Konvuno's domains. Requests to the dashboard, the marketing site and the widget assets expose ordinary network request data such as IP address and request metadata to Cloudflare; API requests go directly to Railway. When a visitor opens the chat, the widget runs a Turnstile check before starting the conversation session and sends its result for server verification. It does not load the challenge on ordinary passive page views. See Cloudflare's Privacy Policy and Cloudflare's Turnstile Privacy Addendum for that feature.

Data may also be disclosed when required by law, to protect rights and security, or in a business transaction, subject to applicable safeguards. Konvuno does not currently publish a separate sub-processor change-notification service.

• Conversations and derived text — a recurring bounded purge deletes conversations started more than 90 days earlier, or 30 days for organizations classified as clinics. Messages, summaries and linked unanswered/declined questions are deleted with them; orphan questions follow the same creation-based cutoff. A large backlog may require multiple scheduled runs.
• Contacts and support — lead records remain until deleted by the business or a verified request; support tickets remain until account/organization deletion or a verified request. These records are separate from the conversation cutoff. Businesses should delete contacts when no longer needed.
• Operational records — automatic windows are 13 months for widget events and 6 months for abuse events. Cost and consumed-allowance records are kept as billing and accounting evidence without the erased conversation link, so deleting personal data does not reset purchased usage; after organization deletion they remain only as numbers under a pseudonymous identifier, without names or content.
• Business data and files — business content, configuration and uploaded files remain until removed or the organization is deleted. Organization deletion removes stored branding images before final database cleanup, which also removes any catalog-import file still being processed; an interrupted operation remains pending for retry. Cached copies of public images may take time to expire; copies already downloaded cannot be recalled.
• Request records and backups — minimal erasure case references, scope hashes and completion counts are retained to prevent restoration of erased records and document handling. Provider copies, older emails and backups require separate review under their applicable retention terms; database deletion is not a promise of immediate deletion from every provider backup.
• Browser storage — described in section 7. Offline devices and copies downloaded by users are outside immediate server control.

Konvuno uses cookies and browser storage as follows:

• Consent choice — the marketing site and dashboard set the first-party cookie konvuno.analytics-consent to remember whether analytics was accepted or rejected. It lasts up to six months, is shared across Konvuno subdomains, and is necessary to honor the choice.
• Google Analytics — the Google tag is not downloaded and analytics is not activated unless analytics is accepted. After acceptance, Google Analytics may set first-party cookies including _ga and a property-specific _ga_* cookie to distinguish browsers and sessions. Advertising storage and ad-personalization signals remain denied. The choice can be changed at any time through “Cookie settings” in the marketing-site footer; rejecting after acceptance disables further analytics collection and attempts to remove those Google Analytics cookies.
• Sign-in — signing in sets an HttpOnly cookie, __Host-konvuno.refresh, on api.konvuno.com that keeps the session signed in. It is necessary for the service, cannot be read by page scripts, lasts at most 7 days from the last renewal (30 days for a whole sign-in session), and is removed on sign-out. During Google sign-in, a second necessary cookie, __Host-konvuno.google, binds the attempt to the browser for at most 10 minutes. The short-lived access token is kept only in page memory.
• Dashboard — local storage holds a non-secret marker that coordinates sign-in between open tabs (it contains no token), the selected organization, locale, theme preference, unpublished widget drafts, and saved catalog-column mapping templates. These values remain until the application removes or replaces them or the user clears site data; signing out does not remove every preference or draft.
• Host website — after an explicit chat opening, the loader stores a random identity under konvuno.session:WIDGET_ID in the host website’s tab-scoped session storage. It is specific to the widget and expires after 30 minutes of inactivity. If storage is blocked, it is kept in page memory. Passive loads and proactive teasers do not create this identity. The legacy persistent konvuno.visitor key is removed without reusing it.
• Widget iframe — session storage on the widget/CDN origin holds the conversation ID and up to 50 visible visitor/assistant messages, keyed by widget and visitor. The application treats the record as expired after 30 minutes of inactivity and clears stale data when it is read; session storage is also scoped to the browser tab/session.
• Cloudflare Turnstile — runs when a visitor opens the chat, before the conversation session starts. No Turnstile pre-clearance cookie is implemented.

The chat session supports the service the visitor opens. Optional widget visitor/click analytics are disabled. The installing business must describe this behavior and assess any applicable local storage/consent requirements.

Konvuno's API checks the organization and the user's role on every request, keeps secrets and privileged operations on the server, and uses allowed-domain checks, origin-validated iframe messaging, rate limits, salted IP hashing, and storage credentials that only the API holds. Public branding images are intentionally public to render on websites. No internet service can guarantee absolute security.

The primary database is hosted by Railway in Amsterdam, the Netherlands; stored images are in Cloudflare R2 under the EU jurisdiction. Engineers Space LLC is US-based; the operator accesses production from Serbia. These facts do not mean all processing stays in the EU.

The providers listed above may process data in the United States and other countries outside the visitor's or account holder's country. Their contractual transfer mechanisms and locations are governed by their own data-processing terms. Konvuno does not currently offer a customer-selectable data-residency region in the application.

Depending on applicable law, people may have rights to access, correct, delete, restrict, object to processing, receive certain data, withdraw consent and complain to a supervisory authority. Withdrawing consent does not affect earlier lawful processing. Widget visitors should contact the installing business first; Konvuno assists that business after verifying identity and scope.

The owner’s JSON export uses checked pagination with collection counts and a consistency manifest. It includes the listed organization collections and storage metadata, but excludes file bytes, authentication secrets, embeddings, some operational/security records and provider copies; exclusions appear in the manifest. Individual requests may need a separate verified scope and operator-assisted export.

Organization deletion removes its database records and uploaded branding/catalog files, with a pending result if cleanup needs retry. It does not delete other members’ login accounts or instantly recall offline browser copies, downloaded files, older emails or provider backups. Account deletion additionally removes the user’s login and support records, subject to the documented ownership restrictions.

Privacy requests can be sent to support@konvuno.com. We verify the requester and scope, track the applicable response deadline and explain any retained exceptions. A whole-organization export is not automatically a complete response to an individual request.

Konvuno is a business service and is not directed to children. The service does not implement age verification. Businesses must not knowingly configure the widget to collect children's data without the permissions and safeguards required by law.

Do not submit payment-card data, passwords, government identifiers, health records, or other highly sensitive data through chat, lead messages, FAQs, catalogs, imports, website analysis, or free-text fields. The service is not designed for regulated professional advice or storage of special-category records.

Clinic widgets are limited to general information topics, with no free-text patient intake or lead form. Appointments and medical matters must use the clinic’s existing contact channels. Clinics must also keep patient data out of uploaded knowledge and configuration.

This policy will be updated when the implemented data flows or providers change, and the effective date above will be revised. The repository currently has no automated legal-change email workflow, so account holders should review this page periodically until such a channel is implemented.