Your data, in plain words

1Who this policy covers

OmniConva is a product and service operated by BitCommerz Marketing, Dhaka, Bangladesh. In this policy, “we”, “us” and “our” mean BitCommerz Marketing. Online stores use OmniConva to bring their website chat widget, their Facebook Page's Messenger inbox and comments, their Instagram messages and comments, and their WhatsApp Business number into one inbox, answer customers with AI and take orders inside the conversation. This policy explains what information we collect, why we collect it, who we share it with, how long we keep it and what rights you have.

We handle information about two groups of people:

• Merchants and their teams: people who create an OmniConva account, connect a store, connect a Facebook Page, Instagram account or WhatsApp number, and use the dashboard. BitCommerz Marketing is the data controller for this information.
• Shoppers and customers: people who use the chat widget on a merchant's website, or who message or comment on a merchant's Facebook Page, Instagram account or WhatsApp number. We process this information on behalf of, and on the instructions of, that merchant, as a data processor. The merchant is the controller of it and is accountable to their own customers.

2Information we collect

Merchant accounts

• Your name and mobile number. The number is your login and is verified with a one-time code (OTP) sent by SMS.
• Your password, stored only as a bcrypt hash; we never see the password itself. OTPs are hashed too, along with failed-attempt counts and lockout times.
• An optional profile photo, and the billing email you enter at checkout so it can be filled in next time.

Stores and teams

• Store name, website URL, address, description and logo.
• WooCommerce connection keys and secrets, stored encrypted.
• Your product catalog: title, SKU, description, price, images, categories, tags, stock and variants. Only products are synced from WooCommerce; we do not import your store's customer list or past orders.
• The text you add to the knowledge base, such as delivery or return policies.
• Team invitations: the invitee's mobile number, role and invitation status.

Shopper information from the chat widget

• Chat messages and attachments: photos, voice notes or other files, up to 10 MB each.
• Name, email and phone number, if the shopper provides them.
• For orders placed in chat: name, phone, delivery address and the items ordered. We also keep a running purchase total per phone number.
• Ratings and comments left at the end of a chat, and thumbs up/down or reactions on AI replies.
• Information the AI generates: the chat's language, sentiment, a summary of the conversation, image descriptions and voice-note transcripts.

Device and browsing information

When a shopper starts a chat, the widget sends the following so the merchant and the AI can see what the shopper was looking at:

• An anonymous visitor ID.
• The current page URL, the referring page and time spent on the site.
• Up to 50 recently viewed pages on that store, with URL, title, time, scroll depth and time spent. The list keeps updating while the chat is open.
• Browser language, user agent, platform, screen and window size, device type, connection type, timezone and colour depth.

Payments

• Payments in taka: plan, billing period, amount, coupon, PayStation transaction ID, payment method and the paying mobile number. PayStation's verification response is stored as well.
• Payments in US dollars (USD): plan, billing period, amount, billing email, the Dodo Payments subscription ID, and the status of each payment and refund.
• Card numbers, CVVs and mobile wallet PINs never reach us. They are entered directly on PayStation's or Dodo Payments' payment page.

Notifications and technical data

• If you turn on browser push notifications: the push subscription endpoint, its encryption keys and your browser's user agent.
• Your IP address is used briefly in memory to limit abusive request rates. We do not store IP addresses in our database.

3Meta Platform Data (Facebook, Messenger, Instagram, WhatsApp)

We receive data from Meta's platforms only when a merchant chooses to connect their own Facebook Page, Instagram professional account or WhatsApp Business number to OmniConva. The connection is made through Meta's own sign-in (Facebook Login, Instagram Login or WhatsApp Embedded Signup), where the merchant reviews and grants each permission. As a Meta Tech Provider we act only on behalf of the business that connected its assets, and we use Meta Platform Data only to run that business's inbox.

The permissions we ask for, and why

What we store

• Connection details: the IDs, names and display phone number of the connected Page, Instagram account, WABA and phone number, which permissions were granted, and the app-scoped ID of the Facebook or Instagram user who made the connection.
• Access tokens (Page, Instagram or WhatsApp tokens), stored only encrypted with AES-256-GCM and bound to their platform. Tokens are never sent to the browser.
• Messages customers send and the replies the business sends: text, photos, videos, voice notes and files, reactions, and delivery and read status. Attachments are copied into our own storage, because Meta's links stop working after a while.
• Basic profile of the person messaging: name or username, profile photo (copied into our storage), their Page-scoped Messenger or Instagram ID, and for WhatsApp their phone number and WhatsApp profile name.
• Comments on Page or Instagram posts: the comment text and attachment link, the commenter's name and ID, the post's text, image and link, and the replies we sent.
• WhatsApp message templates (name, language, content and approval status).
• If the merchant uses the WhatsApp Business app together with the Cloud API (Coexistence): the chat history and contact list Meta shares at connection time are imported into the inbox.

How we use Meta Platform Data

• To show the merchant and their team conversations and comments in one dashboard inbox, and to send their replies.
• When the merchant turns it on, to generate automatic AI replies, find products and take orders.
• To check regularly that the connection, token expiry and messaging limits are healthy, and to alert the merchant when they are not.

We do not sell, license or rent Meta Platform Data, use it for advertising or ad targeting, pass it to data brokers, show one business's data to another, or use it for eligibility decisions or surveillance. Messages and comments are visible only to the business whose Page, account or number they were sent to.

Who it is shared with

• AI model providers (OpenAI primarily; OpenRouter or DeepSeek where we configure them), only when the merchant has AI replies on: the customer's name, the recent part of the conversation (with photos and voice notes in it), the comment and the relevant product details are sent so a reply can be generated.
• Our hosting, database and file storage providers (such as Cloudflare R2), which hold data only on our behalf.
• Meta itself, because replies are sent through Meta's APIs.

Retention and deletion

• Disconnecting a channel (dashboard → Settings → Connection → Disconnect) immediately deletes that connection and its encrypted token, removes our webhook subscription from the Page or WABA, and stops new messages. Past conversations stay read-only as the merchant's record until the merchant asks for them to be deleted.
• If you remove the app in your Facebook or Instagram settings, Meta notifies us through the deauthorize callback; we delete the connection's encrypted access token and mark the connection as needing to be reconnected, and no further calls are made with it.
• If you request deletion through Meta, our Data Deletion Callback (https://api.omniconva.com/webhooks/messenger/data-deletion) (for Instagram, https://api.omniconva.com/webhooks/instagram/data-deletion) deletes every Page and Instagram connection you made, with its token, and also deletes the conversations, messages, attachments, comments, posts, Meta-sourced customer profiles (where the store has orders for a customer, only their Meta details are removed), notifications and raw webhook records that came through those connections — usually within minutes. It returns a confirmation code and a status link that shows whether the request is in progress or complete and what was deleted; completed requests are kept for 90 days. WhatsApp numbers are not covered by this callback; they are deleted on email request.
• To delete everything, including conversations, comments, attachments and customer profiles, email [email protected]. We delete the data within 30 days of verifying the request and confirm by email. When we delete an account on request, all Meta Platform Data held for it is deleted with it.
• Otherwise, messages and comments are kept while the account is active so the merchant can look back at past conversations and orders. Raw WhatsApp, Messenger and Instagram webhook records are deleted automatically after 14 days.

If you messaged or commented on a business that uses OmniConva

Your messages belong to that business and we hold them on its behalf. To see or delete them, contact the business first. You can also write to [email protected] directly, naming the business (its Page, Instagram account or WhatsApp number) and giving your name, username or phone number. We will tell the business and delete your messages, comments and profile details within 30 days. Copies held on Facebook, Instagram or WhatsApp are kept by Meta and have to be deleted in those apps.

4How we use information

• To create accounts, sign you in, verify your number and reset passwords.
• To answer shopper questions, find products, take orders and hand a chat to a human when needed.
• To send orders taken in chat to the merchant's WooCommerce store as cash-on-delivery orders.
• To show merchants their inbox, reports and notifications.
• To take subscription payments, remind you before a plan expires and apply plan limits.
• To keep the service secure, prevent abuse, and monitor AI cost and quality.

We do not sell information, and we do not use merchants' or their customers' information for advertising. Only our marketing website, omniconva.com, runs analytics and advertising tags, to measure visits and our own ads (see “Cookies and browser storage” below).

5AI processing

OmniConva's AI features run primarily on OpenAI's API; depending on our settings some requests may go through OpenRouter or DeepSeek instead. The following is sent to these AI providers for processing:

• Shopper and customer messages (from the chat widget, Messenger, Instagram and WhatsApp), post comments, chat summaries and order details, to write replies and prepare orders.
• Photos and voice notes shoppers send, to describe and transcribe them.
• Product details, product images and knowledge-base text, so the AI can find the right product and policy.

The embeddings we build for search are stored in our own database. Under OpenAI's API terms, data sent through the API is not used to train their models by default, and we do not train models on it ourselves. AI can make mistakes, so check important details, especially prices and order details.

6Who we share information with

We use the following providers to run the service. Each receives only what its job requires:

Shopper chats and orders are visible in the dashboard to the merchant and the team members they invite. We may disclose information when the law requires it, or when needed to protect our users or the security of the service. If the business changes hands, information may transfer to the new owner under the protections of this policy.

7Cookies and browser storage

• Dashboard: two httpOnly cookies keep you signed in, access_token (1 hour) and refresh_token (7 days). Scripts on the page cannot read them.
• Chat widget: uses no cookies. It keeps a visitor ID, the chat session and the recently viewed pages list in the browser's localStorage. Clearing the browser's site data removes them.
• This website (omniconva.com): remembers your chosen language and theme in localStorage, and runs Google Tag Manager, Google Analytics, the Meta Pixel and the TikTok Pixel, which set their own cookies to measure visits and how our ads perform.

These analytics and advertising cookies are used only on omniconva.com — never in the dashboard or in the chat widget on merchants' websites. You can block them in your browser settings or with an ad blocker.

8Security

• Passwords and OTPs are hashed. Five wrong OTPs lock the account for 10 minutes.
• WooCommerce keys and secrets, and Facebook, Instagram and WhatsApp access tokens, are encrypted with AES-256-GCM.
• Login cookies are httpOnly and, in production, sent only over HTTPS.
• Profile photos and logos live in private storage and are shown through links that expire after 1 hour.
• Webhooks from Meta are verified with Meta's signature (app secret), and the data deletion callback acts only on a verified Meta signed request.
• Chat attachments are served through unguessable links. Anyone who has a link can open that file, so don't share attachment links elsewhere.
• Access is limited by each team member's role (owner, staff or viewer), and the owner decides who can see invoices.

No system is perfectly secure. If you notice a security problem, please tell us straight away.

9How long we keep information

• Accounts, stores, products, chats, messages, comments and attachments (including those from Facebook, Instagram and WhatsApp) are kept while the account is active, so merchants can look back at past conversations and orders. They are not currently deleted automatically. See “Meta Platform Data” above for what disconnecting a channel or Meta's deletion callback removes.
• OTP codes expire after 5 minutes and team invitations after their set period. Chat widget sessions expire after 24 hours.
• Payment and AI usage records may be kept after an account closes, for accounting, tax and audit purposes.

To delete your account or specific information, contact us. We will delete or anonymise it within 30 days of verifying the request, except records we are legally required to keep.

10Your rights and choices

Merchants

• Change or remove your name, mobile number (with OTP verification), password, profile photo and store details from the dashboard.
• Disconnect WooCommerce or any Facebook Page, Instagram account or WhatsApp number, remove team members or invitations, delete knowledge-base entries and turn off push notifications.
• Ask us for a copy of your information, a correction, or deletion of your account.

Shoppers and customers

• For chat, message, comment or order information, contact the store you chatted with first; they can see your information and have us delete it. You can also write to us directly at [email protected] (see “Meta Platform Data” for messages sent on Facebook, Instagram or WhatsApp).
• Sharing personal details in chat is optional, although an order needs a name, phone and address.
• Clear your browser's site data to reset the visitor ID and the viewed-pages list.

11Merchant responsibilities

If you put the chat widget on your website, say in your own privacy policy that you use AI chat, that browsing information is collected during chats, and that information is processed by OmniConva and its providers. If you connect a Facebook Page, Instagram account or WhatsApp number, you must have the right to do so and must follow Meta's terms and policies (including WhatsApp's Business and Commerce policies) when messaging customers. You are responsible for following the laws that apply to you, and for not asking shoppers for sensitive information such as passwords, card numbers, national ID or health details through the widget.

12International transfers

Meta and providers such as OpenAI and Cloudflare may process or store information outside Bangladesh. By using the service you agree to these transfers, and we only choose providers that maintain appropriate safeguards.

13Children

OmniConva is built for businesses. People under 18 should not open a merchant account, and we do not knowingly collect children's information. If you believe we hold a child's information, tell us and we will delete it.

14Changes to this policy

When the service changes, this policy will be updated and the “last updated” date above will change. Merchants will be told about significant changes through a dashboard notification or SMS.