Privacy Policy

Last Updated: 12-May-2026

This Privacy Policy (“Policy”) governs the collection, use, processing, storage, and sharing of data by Humain Enterprises (“Convika,” “we,” “us,” or “our”), provider of the Convika AI SaaS platform.

This Policy applies to our Business Customers (“you,” “Customer,” or “Client”) – the business entities that take our services.

Note: If you are an individual visiting a website with a Convika chat widget, this Policy does not directly govern your data. Your data is governed by the website owner’s Privacy Policy. Convika acts strictly as a data processor on their behalf.

1. The B2B2C Data Relationship (Roles & Responsibilities)

  • You (The Business Customer) are the “Data Fiduciary”: You determine the purpose and means of collecting personal data from your website visitors (End-Users). You are solely responsible for obtaining valid, specific, and informed consent from End-Users, providing transparent privacy notices on your website, and complying with all sector-specific laws applicable to your industry (e.g., ART Act/PCPNDT for healthcare, RBI guidelines for fintech, etc.).
  • Convika is a “Data Processor”: We process End-User data strictly on your documented instructions to provide the SaaS platform, host the AI agent, and deliver the chat transcripts and analytics back to you. We do not determine the purpose of End-User data processing.
  • Convika as a “Data Fiduciary” for its own operations: For data related directly to your business (e.g., your billing details, admin login credentials, B2B sales interactions), Convika acts as a Data Fiduciary.

2. Data We Collect Directly From You (The Business Customer)

To provide and manage your account, we collect:

  • Account Data: Business name, address, GST number, and authorized representative details.
  • Payment Data: Billing emails, invoices, and transaction records (processed securely via third-party payment gateways; we do not store credit card details).
  • Access Data: Admin login IDs, hashed passwords, and IP addresses for security logging.
  • Configuration Data: The knowledge base documents, FAQs, brand prompts, and workflow rules you upload to train/customize your specific Convika AI Agent.

3. Data We Process on Your Behalf (End-User Data)

When an End-User interacts with the Convika widget on your website, we process the data you instruct the widget to collect. This typically includes:

  • Identifiers: Name, email address, phone number.
  • Conversation Data: The text of the chat between the End-User and the AI.
  • Metadata: Timestamps, browser type, device ID, and page URLs where the interaction occurred.
  • Sensitive Data (Conditional): Depending on your industry, the bot may collect sensitive data (e.g., health information for fertility clinics, financial data for fintech). You acknowledge that Convika is not designed to process highly sensitive data (e.g., Aadhaar, explicit medical records, passwords) unless expressly agreed upon in a separate Data Processing Addendum (DPA).

4. How We Use Your Data

A. Business Customer Data:

  • To provision, maintain, secure, and bill your SaaS account.
  • To provide customer support and send critical service notifications (e.g., maintenance downtimes).
  • To comply with Indian tax and corporate laws.

B. End-User Data (Processed on your behalf):

  • To generate AI responses based on your configured knowledge base.
  • To route leads, appointment bookings, or support tickets to your designated systems (e.g., CRM, email).
  • To provide you with aggregated analytics and chat logs in your admin dashboard.

C. Platform Improvement:

  • We may use anonymized, PII-stripped, interaction data to apply security algorithms and improve Convika platform.

5. Data Sharing and Sub-Processors

We do not sell or share your data or your End-Users’ data to third parties for marketing purposes. We share data only as follows:

  • Cloud Infrastructure Providers: To host the SaaS platform (e.g., AWS, GCP) located in India or approved jurisdictions.
  • Sub-processors: We may use vetted third-party tools for analytics, error monitoring, and CRM integrations (e.g., Odoo, Zoho). A current list of sub-processors is available upon request.
  • Legal Mandates: We may disclose data if required by Indian law, court order, or government regulation, provided we notify you unless legally prohibited from doing so.

6. Data Retention and Deletion

  • Active Account: We retain your data and End-User data for as long as your SaaS subscription is active.
  • Termination: Upon termination of your account, you have a 30-day grace period to export your data. Thereafter, we will securely delete all Business Customer Data and End-User Data from our active servers as per our compliance policies.
  • Legal Holds: Data may be retained longer if required by applicable Indian laws.

7. Security Measures

In compliance with applicable laws, Convika implements “reasonable security practices and procedures,” including:

  • Encryption: TLS 1.3 for data in transit.
  • Access Controls: Role-based access control (RBAC) for our personnel. Strict principle of least privilege.
  • Infrastructure Security: Regular vulnerability assessments, penetration testing, and network firewalls.
  • Audit Logs: Comprehensive logging of all administrative and data-access actions.

8. Data Breach Notification

In the event of a personal data breach affecting the data we process on your behalf:

  • We will notify you within 24 to 72 hours of becoming aware of the breach, providing details of the nature of the breach, data categories involved, and our remedial actions.
  • You are solely responsible for notifying your End-Users, the Data Protection Board of India, or any sector-specific regulator (e.g., NMC, CDSCO, RBI) as required by law. We will provide reasonable assistance in your notification efforts.

9. International Data Transfers

Convika’s primary servers are located in India. If, for technical or support reasons, data is transferred outside India, we ensure such transfers comply with the applicable laws.

10. Your Obligations as a Business Customer

By using Convika, you represent and warrant that:

  • You will comply with all applicable Indian data protection laws, including the DPDP Act and IT Act.
  • You will obtain all necessary, legally valid consents from End-Users before their data is submitted to the Convika widget, clearly disclosing that an AI is being used.
  • You will not use Convika for unlawful activities, including but not limited to: violating the PCPNDT Act, unauthorized credit scoring, or generating deepfakes/misleading content violating the IT Rules 2021.
  • You are responsible for the accuracy and legality of the knowledge base and prompts you feed into the AI.
  • You will ensure your use of Convika does not classify it as a “Medical Device” or “Software as a Medical Device” (SaMD) under CDSCO rules, unless explicitly licensed as such.

11. Changes to this Policy

We may update this Policy to reflect changes in Indian data protection laws or our data practices. We will notify Business Customers via email or the admin dashboard at least 15 days before material changes take effect. Continued use of the SaaS constitutes acceptance of the updated Policy.

12. Governing Law

This Policy shall be governed by the laws of India. Any disputes arising out of this Policy shall be subject to the exclusive jurisdiction of the courts in New Delhi, India.

For Questions or to execute a Data Processing Addendum (DPA):
Please contact our Data Protection Officer at: Contact our DPO

Scroll to Top