Privacy Policy

This Privacy Policy explains what personal data Volvex Chat ("Volvex Chat", "the Service", "we", "us", "our") collects when you connect an Instagram account and use our AI-powered direct-message assistant, and how we use, store, share, and delete it. Volvex Chat is a product of Volvex AI Oy, a company registered in Finland.

• Data controller: Volvex AI Oy (business ID / Y-tunnus 3507135-1)
• Registered address: Kurbölentie 130, 06200 Porvoo, Finland
• Data protection contact: ilya@volvex.ai

By connecting your Instagram account to Volvex Chat, you agree to the collection and use of information in accordance with this policy.

1. Who this policy covers

This policy applies to three groups of people:

• Operators: business owners who sign up, connect their own Instagram Business or Creator account, and configure an AI assistant to reply to their direct messages.
• Message senders: people who send a direct message to an operator's connected Instagram account and whose messages are processed to generate a reply.
• Demo visitors: people we invite to try a temporary demo agent through a shared demo link (see section 2.5).

We act as a data controller for operator account data and as a data processor acting on the operator's behalf for the Instagram content (including direct messages) that flows through a connected account.

2. What data we collect

2.1 Operator account data

• Your email address (used for one-time-passcode login and account communication).
• An internal workspace identifier and a workspace name (automatically derived from your connected Instagram profile).
• Billing data for paid plans: subscription status, plan, and a customer reference held with our payment processor, Stripe. Card details are collected and stored by Stripe; we never see or store full card numbers.

2.2 Instagram data collected via Meta OAuth

When you connect an Instagram account, you authorize Volvex Chat through Instagram's official OAuth flow. We request only the permissions needed to operate the assistant:

• instagram_business_basic: your Instagram account ID, username, account type, profile picture, and your media (posts and captions). Used to display your connected account and, if you choose, to build your assistant's knowledge base.
• instagram_business_manage_messages: the contents of direct-message conversations on your connected account, including message text, the sender's Instagram-scoped user ID, and timestamps. Used to read incoming messages and send replies on your behalf.

We also store, on your behalf, an encrypted OAuth access token issued by Meta so the Service can call the Instagram Graph API. We never request your Instagram password.

2.3 Knowledge sources you provide

• PDF documents you upload.
• Website URLs you paste, the public contents of which we fetch and extract.
• Free text you type or dictate.
• An optional scan of your own Instagram account (your bio and posts).

2.4 Direct messages processed in real time

Once your account is connected and the assistant is enabled, incoming Instagram direct messages are delivered to us by Meta via webhook. For each message we process and store the message text, the sender's Instagram-scoped ID and display name/handle where available, timestamps, and the reply our assistant generates.

2.5 Demo conversations

We sometimes create temporary demo agents to show a business what the Service can do. To build a demo we fetch publicly available information (the business's public website and public social profiles) and turn it into the demo agent's knowledge base. If you chat with a demo agent through a shared demo link, no account or login is needed; we store the messages you send, the demo agent's replies, and timestamps. Demo chats are capped and each link expires automatically. We process this data on the basis of our legitimate interest in demonstrating the Service. Please don't share sensitive personal data in a demo chat; to have a demo conversation deleted, email ilya@volvex.ai.

3. How and why we use your data

We do not sell your personal data, and we do not use the contents of your Instagram messages or knowledge base to train general-purpose AI models.

4. AI processing and automated replies

• Reply generation: message contents and relevant knowledge-base excerpts are sent to our LLM providers (routed through OpenRouter to vetted model providers such as Anthropic) to draft a reply. Under our configuration, these providers do not retain the data to train their models.
• Search indexing: knowledge-source text is sent to OpenAI to generate vector embeddings that power semantic search over your knowledge base.

Human handoff

Replies are generated by an automated assistant, not a human. If a sender asks to speak to a human, the assistant pauses automated replies for that conversation and flags it for the operator, who then replies personally.

5. Who we share data with (sub-processors)

We share data only with infrastructure and service providers that help us run the Service, each bound by a data-processing agreement:

• Supabase: database, authentication, file storage, and vector search
• Vercel: application hosting and content delivery
• Inngest: durable background job processing
• OpenRouter and its underlying model providers (such as Anthropic): LLM inference to generate replies
• OpenAI: text embeddings for knowledge-base search
• Resend: transactional email delivery (sign-in codes and account notifications)
• Stripe: payment processing for paid plans
• Meta Platforms (Instagram): source of the connected account and message data; recipient of the replies we send

We may also disclose data where required by law, or to protect the rights, safety, and security of Volvex AI Oy, our users, or the public.

Limited Use of Meta platform data

Our use and transfer of information received from the Meta APIs adheres to the Meta Platform Terms and Developer Policies, including the Limited Use requirements. We use data obtained through the Meta APIs only to provide and improve the Service for the operator from whom it was collected. We do not sell or license it, use it for advertising or to build user profiles for unrelated purposes, transfer it to data brokers, or use it for surveillance.

Message-sender content (the contents of DMs people send to a connected account) is used only to generate replies within that same conversation. It is never added to any knowledge base or embeddings, and is never used to answer other people or other businesses.

6. Data retention

• Direct messages and conversations: retained while your Instagram connection is active; deleted within 30 days of disconnecting, deleting your account, or a valid Meta data-deletion request.
• Knowledge base and embeddings: retained until you delete the underlying source or your account; removed within 30 days of deletion.
• Instagram OAuth tokens: retained only while the connection is active; deleted immediately when you disconnect, delete your account, or Meta sends a deauthorization signal.
• Account and billing records: retained for the life of your account and, where required, for the period mandated by tax and accounting law after closure.
• Demo conversations: each demo link expires automatically; expired demo data is kept only for our own evaluation of the demo and is deleted on request.

When the maximum window above applies, residual copies in encrypted backups are overwritten on our normal backup-rotation cycle.

7. Deleting your data and revoking access

• Disconnect your Instagram account from the Account page. This revokes the connection with Meta and deletes the stored access token immediately. Your past conversations remain until you delete your account.
• Delete your Volvex Chat account from the Account page. This removes your operator account and all associated workspace data (within 30 days, accounting for backups) and makes a best-effort call to revoke the Instagram access token with Meta.
• Remove the app from Instagram (Instagram → Settings → Apps and Websites). Meta notifies us via our deauthorization callback and we expire the connection automatically.
• Request data deletion via Meta. When Meta sends us a data-deletion request, we delete the associated Instagram-derived data and provide a status confirmation, which you can check at chat.volvex.ai/deletion-status.
• Email us at ilya@volvex.ai to request deletion or exercise any other right below.

8. Your rights

If you are in the European Economic Area, the United Kingdom, or another region with similar laws, you have the right to access, rectify, erase, restrict, or object to processing of your data; to data portability; to withdraw consent where processing is based on consent; and to lodge a complaint with a supervisory authority. In Finland this is the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto, tietosuoja.fi). To exercise any right, contact ilya@volvex.ai; we respond within the timeframes required by law (normally within one month).

If you sent a direct message to a business that uses Volvex Chat and want to exercise your rights over that message, the business is the controller of that data, so please contact them directly. We will assist that business in responding to your request.

9. Data security

• Encryption in transit (HTTPS/TLS) for all data exchanged with the Service.
• Encryption at rest for Instagram OAuth tokens using AES-256-GCM, with the encryption key held separately from the database.
• Strict tenant isolation: each workspace's data is segregated and access-controlled at the database level so one operator can never read another's data.
• Least-privilege access to production systems and audit logging of admin actions.

No method of transmission or storage is completely secure; while we strive to protect your data, we cannot guarantee absolute security.

10. International data transfers

Volvex AI Oy is based in Finland (EU). Some sub-processors may process data on servers outside the EEA, including in the United States. Where data is transferred outside the EEA, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or an equivalent adequacy mechanism.

11. Children's privacy

Volvex Chat is a business tool intended for use by businesses and adults (operators must be at least 18; see our Terms of Service). It is not directed at children, and we do not knowingly collect personal data from anyone under 16. If you believe a child has provided us personal data, contact us and we will delete it.

12. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by an updated "Last updated" date and, where appropriate, communicated to operators by email. Continued use of the Service after a change constitutes acceptance of the revised policy.

13. Contact us

Volvex AI Oy, Kurbölentie 130, 06200 Porvoo, Finland · Business ID (Y-tunnus) 3507135-1 · ilya@volvex.ai