Privacy Policy

Merchants who create a Vontaara workspace, and customers of those merchants who send a message to a merchant through a connected channel. For customer messages, the merchant decides why the data is collected and we process it on the merchant’s behalf; if you are a customer and want to exercise your rights, you can contact the merchant or contact us and we will help.

• Merchant account data: name, business name, email address, password (stored hashed), billing and plan details, and workspace settings.
• Connected channel data: for WhatsApp, the linked phone number; for email, the connected mailbox address; for Instagram, the connected Instagram professional account’s ID and username, and an access token that lets Vontaara read and send messages for that account (stored encrypted).
• Conversation data: the messages exchanged between a merchant and its customers, message timestamps, the customer’s channel identifier (for Instagram, an Instagram-scoped user ID), and any name or contact details the customer shares. We also store orders and notes the merchant records.
• Usage and technical data: log data such as IP address, device and browser information, and actions taken in the dashboard, used for security and reliability.

When a merchant connects an Instagram Business or Creator account, they authorise Vontaara through Instagram’s official login to access basic account information and to read and send direct messages for that account. We use this access only to:

• receive messages customers send to the merchant’s Instagram account;
• draft and send replies (automatically by the AI agent, or manually by the merchant’s staff) in response to those customers; and
• show the conversation to the merchant in their inbox.

We do not sell Instagram data, use it for advertising, or use it to build profiles unrelated to serving the merchant. Merchants can disconnect Instagram at any time from Settings → Channels, or revoke access from their Instagram account settings under Apps and websites.

• To provide the service: route messages, generate AI-assisted replies, hand conversations to staff, and manage orders and catalogues.
• To secure and maintain the service, prevent abuse, and troubleshoot problems.
• To bill merchants and communicate about their account.
• To meet legal obligations.

AI processing. Message content is sent to third-party AI model providers so the agent can generate replies. We do not use merchants’ or customers’ message content to train our own models.

We share data only as needed to run the service, with:

• the merchant whose customer conversation it is (and that merchant’s authorised team members);
• service providers that host our infrastructure, send email, process payments, and provide AI models, under contractual confidentiality and security obligations;
• the messaging platforms themselves (for example Meta, for Instagram) as required to send and receive messages; and
• authorities where required by law, or to protect rights, safety and security.

We do not sell personal data.

Each merchant’s data is isolated from other merchants at the database level. Access tokens and other secrets are stored encrypted, traffic is encrypted in transit, and access to production systems is restricted. No system is perfectly secure, and we cannot guarantee absolute security.

We keep merchant and conversation data while the merchant’s workspace is active. When a merchant closes their workspace or a valid deletion request is verified, we delete or anonymise the related data within 30 days, except where we must keep certain records (for example billing records) to meet legal obligations. Backups are overwritten on their normal cycle.

You can ask us to delete your data at any time:

• Merchants: disconnect Instagram (or any channel) in Settings → Channels to remove our stored access token and stop receiving messages. To delete your workspace and all its data, email us from your account email address.
• Customers who messaged a merchant on Instagram: email taher@vontaara.com with the subject “Data deletion request”, your Instagram username, and the business you messaged. We will verify the request and delete your messages and contact record within 30 days, and confirm by reply.
• Removing the app from Instagram: removing Vontaara under Instagram → Settings → Apps and websites revokes its access. Email us if you also want stored data deleted.

Depending on where you live, you may have the right to access, correct, delete, or export your personal data, to object to or restrict certain processing, and to complain to your data protection authority. Contact us to exercise these rights.

Vontaara is not directed to children under 18, and we do not knowingly collect their personal data.

We and our service providers may process data in countries other than your own. Where we do, we take steps to protect it consistent with this policy and applicable law.

We may update this policy and will change the “Last updated” date above. For material changes we will notify merchants by email or in the dashboard.

Vontaara · taher@vontaara.com