Privacy Policy

Merchants who create a Vontaara workspace, and customers of those merchants who send a message to a merchant through a connected channel. For customer messages, the merchant decides why the data is collected and we process it on the merchant’s behalf; if you are a customer and want to exercise your rights, you can contact the merchant or contact us and we will help.

• Merchant account data: name, business name, email address, password (stored hashed), billing and plan details, and workspace settings.
• Connected channel data: for WhatsApp, the linked phone number; for email, the connected mailbox address; for Instagram, the connected Instagram professional account’s ID and username, and an access token that lets Vontaara read and send messages for that account (stored encrypted).
• Conversation data: the messages customers send to a merchant and the replies, message timestamps, the customer’s channel identifier (for Instagram, an Instagram-scoped user ID), and any name or contact details the customer shares. This data is processed on the merchant’s behalf so the service can reply and so the merchant can see and manage their conversations. Merchants can also record orders and notes in their workspace.
• Usage and technical data: log data such as IP address, device and browser information, and actions taken in the dashboard, used for security and reliability. On our website this also includes analytics data, described below.

When a merchant connects an Instagram Business or Creator account, they authorise Vontaara through Instagram’s official login to access basic account information and to read and send direct messages for that account. We use this access only to:

• receive messages customers send to the merchant’s Instagram account;
• draft and send replies (automatically by the AI agent, or manually by the merchant’s staff) in response to those customers; and
• show the conversation to the merchant in their inbox.

We do not sell Instagram data, use it for advertising, or use it to build profiles unrelated to serving the merchant. Merchants can disconnect Instagram at any time from Settings → Channels, or revoke access from their Instagram account settings under Apps and websites.

• To provide the service: route messages, generate AI-assisted replies, hand conversations to staff, and manage orders and catalogues.
• To secure and maintain the service, prevent abuse, and troubleshoot problems.
• To bill merchants and communicate about their account.
• To meet legal obligations.

AI processing. Message content is sent to third-party AI model providers so the agent can generate replies. We do not use merchants’ or customers’ message content to train our own models.

On our marketing website (vontaara.com) we use Google Analytics to understand how the site is used. Google Analytics uses cookies and similar identifiers and collects information such as the pages viewed, how visitors arrive, device and browser details, and approximate location derived from the IP address. We use it to improve the website. It does not see conversation content or anything inside a merchant’s workspace. When you click a “Start free” button we also record which button it was, and if you arrived through a campaign link we carry its campaign tags and the referring website over to the sign-up page, so we can tell which of our marketing is working. Google acts as our service provider for this; see how Google uses data from sites that use its services.

If you are in the European Economic Area, the United Kingdom or Switzerland, analytics cookies are switched off by default. Elsewhere, you can block analytics cookies in your browser settings or use Google’s Analytics opt-out browser add-on.

We share data only as needed to run the service, with:

• the merchant whose customer conversation it is (and that merchant’s authorised team members);
• service providers that host our infrastructure, send email, process payments, provide AI models and website analytics, under contractual confidentiality and security obligations;
• the messaging platforms themselves (for example Meta, for Instagram) as required to send and receive messages; and
• authorities where required by law, or to protect rights, safety and security.

We do not sell personal data.

Each merchant’s data is isolated from other merchants at the database level. Traffic between you and Vontaara is encrypted in transit (HTTPS), passwords are stored hashed, and access tokens and payment credentials are stored encrypted. Access to production systems is restricted to authorised personnel. No system is perfectly secure, and we cannot guarantee absolute security.

Merchant and conversation data is retained on the merchant’s behalf while the merchant’s workspace is active. When a merchant closes their workspace or a valid deletion request is verified, we delete or anonymise the related data within 30 days, except where we must keep certain records (for example billing records) to meet legal obligations. Backups are overwritten on their normal cycle.

You can ask us to delete your data at any time:

• Merchants: disconnect Instagram (or any channel) in Settings → Channels to remove our stored access token and stop receiving messages. To delete your workspace and all its data, email us from your account email address.
• Customers who messaged a merchant on Instagram: email hello@vontaara.com with the subject “Data deletion request”, your Instagram username, and the business you messaged. We will verify the request and delete the related conversation data and contact record within 30 days, and confirm by reply.
• Removing the app from Instagram: removing Vontaara under Instagram → Settings → Apps and websites revokes its access. Email us if you also want stored data deleted.

Depending on where you live, you may have the right to access, correct, delete, or export your personal data, to object to or restrict certain processing, and to complain to your data protection authority. Contact us to exercise these rights.

Vontaara is not directed to children under 18, and we do not knowingly collect their personal data.

People can apply to our partner (referral) program. When they apply we collect their name, contact details, and either a national ID or passport number and a copy of the document (individuals), or the business name, registration number or KRA PIN and a copy of the KRA PIN or registration certificate (companies). We use this to confirm who the partner is, to prevent fraud, to pay commission correctly and to meet tax and legal requirements. Identity numbers are stored encrypted, the documents are kept in private storage that only authorised Vontaara staff can open, and every time they are opened it is recorded. If an application is declined, the documents are deleted within 30 days. If it is approved we keep them while the person is a partner and for as long as the law requires afterwards.

A merchant who signs up through a partner’s link or code may be visible to that partner: once the merchant makes its first payment, the partner can see the business name, plan, setup progress, usage and the owner’s contact details, so they can help. Partners agree to use this only to support the business and never to share it or contact the merchant’s own customers. The merchant’s customers’ conversations and orders are never shown to partners.

We and our service providers may process data in countries other than your own. Where we do, we take steps to protect it consistent with this policy and applicable law.

We may update this policy and will change the “Last updated” date above. For material changes we will notify merchants by email or in the dashboard.

Vontaara · hello@vontaara.com