Privacy policy

1. Our role

Tovvana is software that businesses ("our customers") use to talk to their own customers. We have two roles:

• For our customers’ account details, billing and website visitors, we decide how data is used (we are the controller).
• For the messages, contacts, orders and bookings our customers handle in Tovvana, we process data on their behalf and on their instructions (we are a processor). The business you chatted with is responsible for that data, and you can contact them directly.

2. Data we collect

• Account data: name, email, phone number, business name, team members and their roles.
• Business content: products, offers, prices, delivery zones, calendar settings and auto-replies.
• Customer conversations: messages, photos and files exchanged on WhatsApp, Instagram or web chat, the sender’s name, phone number or social media ID, and profile name as provided by Meta.
• Orders, bookings and payments: items ordered, delivery address, appointment times, amounts paid or due, and payment proof screenshots uploaded by the customer or the business. We do not collect or store card numbers.
• Marketing consent: whether a person agreed to receive offers from a business.
• Website forms: details you send through our demo, contact or implementation forms.
• Technical data: IP address, device and browser type, and basic logs needed to keep the service secure and working.

3. Data from Meta (WhatsApp, Instagram, Facebook)

When a business connects its WhatsApp Business account or Instagram account, we receive messages and basic profile information through Meta’s official APIs. We use this data only to show conversations to that business, run its chat bot, and send replies, order updates and reminders the business has set up.

We do not sell Meta platform data, use it for advertising, or share it with data brokers. We follow the Meta Platform Terms and WhatsApp Business policies.

4. How we use data

• To provide the service: show the inbox, run the bot, process orders and bookings, create meeting links and send notifications.
• To understand typed messages: if a business turns on the AI assistant, the text of incoming messages may be sent to an AI provider (currently Google Gemini) to understand what the customer means. It is not used by us to train AI models.
• To support and improve Tovvana, fix problems and keep the service secure.
• To bill our customers and communicate with them about their account.
• To answer demo, contact and implementation requests sent through our website.

5. Service providers

We use trusted providers to run Tovvana. They may process data only to provide their service to us:

• Supabase (database, authentication and file storage)
• Vercel (hosting)
• Meta Platforms (WhatsApp and Instagram messaging)
• Google (Gemini AI, and Google Calendar / Meet when a business connects them)
• Email and notification providers used to send account emails and push notifications

Some providers are located outside Jordan. When data is transferred abroad, we rely on providers with appropriate security and contractual safeguards.

6. How long we keep data

We keep account and business data while the account is active. When a business closes its account, we delete or anonymise its data within 90 days, unless we must keep some records longer by law (for example invoices). Backups are overwritten on a rolling basis. Website form submissions are kept for up to 24 months.

7. Security

Each business’s data is separated from other businesses with access rules at the database level. Data is encrypted in transit (HTTPS), payment proof screenshots are stored privately, and only authorised team members of a business can see its conversations. No system is perfectly secure, but we work to protect your data and will notify affected customers of serious incidents as required by law.

8. Your rights

Depending on where you live, including under Jordan’s Personal Data Protection Law, you may have the right to access, correct, delete or object to the processing of your personal data, and to withdraw consent at any time. If you chatted with a business that uses Tovvana, please contact that business first; we will help them respond.

To make a request, email tovvana.app@gmail.com. See also our data deletion page.

9. Marketing messages

Businesses using Tovvana may only send offers to people who agreed to receive them. You can stop marketing messages at any time by replying "stop" or asking the business directly.

10. Cookies

Our website uses only the cookies needed for it to work and to remember your language. We do not use advertising cookies. If we add analytics in the future, we will update this policy.

11. Children

Tovvana is a business tool and is not directed at children under 16. Businesses must not use Tovvana to knowingly collect data from children without the consent required by law.

12. Changes

We may update this policy. We will post the new version here with a new date, and tell our customers about important changes.

13. Contact

[Company legal name], Amman, Jordan. Email: tovvana.app@gmail.com.