Privacy Policy.

1. Who we are

This Privacy Policy explains how Alite Projects Pty Ltd (ABN 38 698 554 148), trading as ConvoHut (“ConvoHut”, “we”, “us”) handles personal information. We are based in Melbourne, Victoria, Australia.

We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth), and, where they apply to us, other privacy laws including the EU and UK General Data Protection Regulation, the New Zealand Privacy Act 2020 and US state privacy laws.

2. What this policy covers

This policy covers personal information we handle for our own purposes, such as information about our customers’ account users, website visitors, people who contact us and partners. For this information we are the “controller” or responsible organisation.

It does not cover the personal information our customers upload to or process in ConvoHut about their own customers and contacts (“Customer Data”). For Customer Data we act on our customer’s instructions as a service provider or “processor”, under our Terms of Service and Data Processing Addendum. The business that messaged you is responsible for that information. If you received a WhatsApp message from a business that uses ConvoHut, please contact that business about your information. If you contact us, we will pass your request on.

3. Information we collect

• Account information: your name, work email, phone number, business name, role and password (stored as a secure hash).
• Billing information: billing contact, plan, invoices and payment status. Card details are handled by our payment processor; we don’t store full card numbers.
• Connection information: identifiers and access tokens needed to connect your Meta WhatsApp Business Account, Google account, Shopify store or Zapier account, and the names of the spreadsheets, tabs and columns you connect.
• Usage information: how you use the ConvoHut app, such as features used, settings, log data, device and browser information and IP address.
• Support and communications: messages, calls and emails with us, and your feedback.
• Website and enquiry information: details you send through our forms, such as your name, email, business and message. Our marketing website does not use advertising or analytics cookies.
• Partner information: if you apply to or join a partner or affiliate programme, your contact, business and payment details.

We collect this information from you, from your use of our services, and from services you connect, such as Meta, Google, Shopify and Zapier, with your permission.

We need your account and billing information to provide ConvoHut. Without it, we can’t open or run an account.

4. How we use it

We use personal information to:

• provide, maintain, secure and support ConvoHut;
• create and manage accounts, including free trials;
• process payments and send invoices;
• connect the services you choose, and act on your instructions;
• communicate with you about your account, service changes, security and billing;
• send you marketing about ConvoHut, where the law allows, with a way to opt out;
• improve our services, including by analysing how features are used;
• prevent fraud, abuse and breaches of our Acceptable Use Policy;
• meet our legal obligations and resolve disputes.

Where the GDPR or UK GDPR applies, our lawful bases are:

5. Customer Data and WhatsApp messages

When our customers use ConvoHut, we process Customer Data, such as their contacts’ names, phone numbers, consent status and message history, only to provide the service to them and as instructed.

We don’t sell Customer Data, don’t use it to build profiles of WhatsApp users, don’t use it to train AI models, and don’t use it for our own marketing or advertising.

ConvoHut’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google Sheets data only to run the journeys and campaigns you set up. We don’t use it for advertising, don’t sell it, don’t let people read it except for support, security or legal reasons or with your permission, and don’t use it to train AI models.

Messages are sent and received through Meta’s WhatsApp Business Platform (Cloud API). Meta processes message content on behalf of our customer under Meta’s own terms and, according to Meta, retains message content for up to 30 days to provide the service.

6. Who we share it with

We share personal information only as needed with:

• service providers who help us run ConvoHut, such as cloud hosting, email and payment providers, listed on our Sub-processors page;
• services you choose to connect, such as Meta, Google, Shopify and Zapier, when you connect them;
• professional advisers, such as lawyers and accountants;
• authorities, when the law requires it;
• a buyer or successor if our business is sold or restructured, subject to this policy.

We don’t sell personal information, and we don’t share it for cross-context behavioural advertising.

7. Overseas disclosure

We host ConvoHut with Amazon Web Services (AWS). Our service providers and connected services may process personal information in other countries, including the United States, member states of the European Union and other countries where Meta, Google, Zapier and Shopify operate. ConvoHut is built and supported by Alite Projects’ team, including its related company in India, whose engineering and support staff may access data from India where needed to build and support the Service.

Where we disclose personal information overseas, we take reasonable steps to make sure it is protected, including contractual protections. For transfers from the EU and UK, we use the European Commission’s Standard Contractual Clauses and the UK Addendum or equivalent safeguards.

8. Security

We use technical and organisational measures to protect personal information, described on our Security page. No system is completely secure. If a data breach is likely to result in serious harm, we will notify affected people and regulators as the law requires, including under Australia’s Notifiable Data Breaches scheme.

9. How long we keep it

• Account information: while your account is active, and for up to 2 years afterwards to deal with questions or disputes.
• Billing records: at least five years, as required by Australian tax law.
• Customer Data: for 30 days after an account ends, the customer can ask us to export it. We then delete it from our live systems within 30 days, and backups roll off on their normal cycle, unless the law requires us to keep it.
• Log data: up to 12 months.
• Enquiries and marketing lists: until you opt out or the information is no longer needed.

10. Your choices and rights

You can ask to access or correct the personal information we hold about you. Depending on where you live, you may also have rights to delete it, restrict or object to its use, receive a copy in a portable format, withdraw consent, and not be discriminated against for using your rights.

To make a request, email abhishek@convohut.com. We’ll verify your identity and respond within 30 days, or tell you if we need more time. Access and correction are free.

You can use an authorised agent to make a request. If you’re in the United States and we decline your request, you can appeal by emailing us with “Appeal” in the subject line; we’ll respond within 45 days, and if we deny your appeal you can contact your state Attorney General.

You can opt out of our marketing emails or messages at any time using the unsubscribe link or by replying STOP.

11. Automated decisions

ConvoHut doesn’t make decisions about individuals that are based solely on automated processing and that significantly affect their rights. Journeys and campaigns send messages according to rules our customers set, and our customers decide who to message.

If we introduce features that make or substantially assist such decisions, we’ll update this policy to describe the kinds of information used and decisions made, as required in Australia from 10 December 2026.

12. Children

ConvoHut is a business service and isn’t intended for people under 18. We don’t knowingly collect personal information from children.

13. Complaints

If you have a concern, contact us first at abhishek@convohut.com. We’ll acknowledge it within 5 business days and aim to respond within 30 days.

If you’re not satisfied, you can complain to a regulator: in Australia, the Office of the Australian Information Commissioner (oaic.gov.au); in the UK, the Information Commissioner’s Office (ico.org.uk); in the EU, your local data protection authority; in New Zealand, the Privacy Commissioner (privacy.org.nz); in Singapore, the Personal Data Protection Commission (pdpc.gov.sg); in South Africa, the Information Regulator (inforegulator.org.za).

14. Changes to this policy

We may update this policy. We’ll post the new version here with a new date, and tell customers by email about significant changes.

15. Contact us

Alite Projects Pty Ltd (ABN 38 698 554 148), trading as ConvoHut. Email: abhishek@convohut.com. Melbourne, Victoria, Australia.