Privacy Policy

1. Overview

IVAR is a WhatsApp AI receptionist built by Galvaniq Group. This Privacy Policy explains what personal data we collect, how we use it, and your rights over it.

IVAR operates as a data processor on behalf of businesses (our clients) who use the platform to handle their WhatsApp conversations. The businesses are the data controllers for their customers' data. This policy covers both our clients and end-customers who interact with IVAR-powered WhatsApp numbers.

2. Who we are

Galvaniq Group
Harare, Zimbabwe
Email: hello@galvaniq.com

For the purposes of POPIA (Protection of Personal Information Act, South Africa) and GDPR (General Data Protection Regulation, EU), Galvaniq Group is the responsible party / data processor for the IVAR platform.

3. Data we collect

3.1 Business clients (dashboard users)

• Name, email address, and business details provided during sign-up
• WhatsApp Business API credentials (phone number ID, access token — stored encrypted)
• Business profile: products, FAQs, pricing, operating hours, bot personality
• Billing information (processed by Stripe or Paynow — we do not store card numbers)
• Usage data: conversation counts, token consumption, handover events
• Google Calendar OAuth tokens (if Calendar integration is enabled — see Section 4)

3.2 End-customers (WhatsApp users who message your business)

• WhatsApp phone number and display name (provided by Meta)
• Message content — text, voice notes (transcribed), images analysed
• Conversation history for AI context (retained per client's subscription)
• Lead qualification data: intent signals, sentiment scores, lead status
• Consent records: whether and when the customer consented to automated communication
• Appointment/booking data (if the booking feature is enabled by the business)

3.3 Data we do NOT collect

• We do not collect payment card details directly — these go to Stripe or Paynow
• We do not access WhatsApp contacts outside of the conversations initiated with IVAR-connected numbers
• We do not track end-customers across different businesses on the IVAR platform

4. Google user data (Calendar integration)

4.1 What we access

When a business enables the Google Calendar integration in their IVAR dashboard, we request the following OAuth scope:

• https://www.googleapis.com/auth/calendar — read and write access to the business owner's Google Calendar

4.2 Why we need this scope

IVAR uses Google Calendar access to:

• Read existing calendar events to check availability before booking appointments
• Create new calendar events when a customer books an appointment via WhatsApp
• Update or cancel events when appointments are rescheduled or cancelled through IVAR

We request only the permissions listed above. We do not access contacts, Gmail, Drive, or any other Google services.

4.3 How we store Google data

• OAuth refresh tokens are stored encrypted in our database, scoped to the individual business account
• We never store your Google account password
• Google Calendar event data is processed in memory and not permanently stored by IVAR beyond what is needed for the appointment record

4.4 How to revoke access

You can disconnect Google Calendar at any time from your IVAR dashboard under Settings → Calendar → Disconnect. You can also revoke access directly in your Google Account permissions. Upon disconnection we immediately delete your stored OAuth tokens.

4.5 Data sharing

Google Calendar data obtained through the OAuth integration is used exclusively to provide the appointment booking feature. It is not shared with any third party, not used for advertising, and not transferred to humans except as part of the appointment notification sent to the business owner.

5. How we use your data

• Provide the IVAR service — generate AI responses, qualify leads, trigger handover alerts
• Improve the service — aggregated, anonymised usage analytics to improve response quality and reliability
• Billing and subscriptions — track usage against plan limits, process payments
• Security and fraud prevention — detect abuse, rate limiting, audit logs
• Legal compliance — retain records as required by applicable law

We do not use conversation content to train AI models or share conversation data with OpenAI for training purposes. Our OpenAI API calls use the standard API which, per OpenAI's policy, does not use API data for model training by default.

6. Data sharing

We share data only with the following categories of processors, and only to the extent necessary to deliver the service:

• OpenAI — message content is sent to OpenAI's API to generate AI responses. OpenAI processes this as a data processor under their API terms.
• MongoDB Atlas — database hosting for all stored data (encrypted at rest)
• Upstash / Redis — message queue processing
• Stripe — payment processing for international card payments
• Paynow — payment processing for EcoCash and Zimbabwe local payments
• Resend — transactional email delivery (handover alerts, system notifications)
• Sentry — error monitoring (error traces may contain truncated message fragments)
• Railway — cloud hosting infrastructure

We do not sell data. We do not share data with advertisers. We do not share data with any parties not listed above without your explicit consent.

7. Retention & deletion

• Conversation history — retained for the duration of an active subscription, then deleted 30 days after account closure
• Lead data — retained while a business account is active
• Billing records — retained for 7 years as required by financial regulations
• Google Calendar tokens — deleted immediately upon disconnection or account closure
• WhatsApp API credentials — deleted within 7 days of account closure

End-customer data deletion

End-customers can request deletion of their data by sending the command /delete or /privacy to any IVAR-powered WhatsApp number. IVAR will delete all conversation history, lead records, and consent records for that phone number within 30 days, and confirm deletion via WhatsApp.

Business owners can also request bulk deletion of customer data by contacting hello@galvaniq.com.

8. Security

• All data is encrypted in transit (TLS 1.2+)
• Optional encryption at rest for phone numbers and message content (AES-256-GCM)
• WhatsApp API tokens stored encrypted in the database
• Google OAuth tokens stored encrypted
• Multi-tenant data isolation — each business's data is fully separated
• Webhook signature verification on all incoming Meta webhooks
• JWT-based authentication for all dashboard access

If you believe you have found a security vulnerability in IVAR, please report it responsibly to hello@galvaniq.com.

9. Your rights (POPIA / GDPR)

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you
• Correction — request correction of inaccurate data
• Deletion — request deletion of your personal data (see Section 7)
• Portability — receive your data in a machine-readable format
• Objection — object to processing of your data in certain circumstances
• Withdrawal of consent — withdraw consent to automated communication at any time by messaging /stop to any IVAR-connected number

To exercise these rights, contact us at hello@galvaniq.com. We will respond within 30 days.

10. Cookies

The IVAR dashboard uses session cookies for authentication only. We do not use third-party tracking cookies or advertising cookies. The landing page (ivar.ai) does not use analytics cookies.

11. Children

IVAR is a business tool not directed at children under 13. We do not knowingly collect data from children. If you believe a child has provided data through IVAR, contact us at hello@galvaniq.com and we will delete it promptly.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. For material changes, we will notify business clients via email at least 14 days before the change takes effect. Continued use of IVAR after the effective date constitutes acceptance of the updated policy.

13. Contact