Privacy Policy

1. Introduction

Convya is operated by Gotchaalab, a company registered in Malaysia. This Privacy Policy explains how we collect, use, store, and protect your personal data in accordance with Malaysia's Personal Data Protection Act 2010 (PDPA).

2. Data We Collect

• Account data: Email address, display name, and profile picture, provided via Google sign-in through Firebase Authentication.
• Project data: Website content, AI chat messages, uploaded images, and site configuration.
• RSVP guest data: Names, phone numbers, email addresses, dietary preferences, attendance responses, and optional messages, collected on behalf of project owners from their guests.
• Usage data: IP address, browser type, pages visited, and error reports, collected via Google Analytics and Sentry.

3. How We Use Your Data

• To provide and maintain the Convya service.
• To process credit purchases and manage your account.
• To improve the product through anonymized usage analytics.
• To track and resolve errors via Sentry.
• To display anonymized site examples in marketing materials (with the limited license described in our Terms of Use).
• We will never sell your personal data to third parties.

4. Cookies & Tracking

• Firebase Authentication: Stores session tokens to keep you signed in.
• Google Analytics: Uses cookies to collect anonymized usage statistics (pages visited, session duration, device type).
• Sentry: Collects error and performance data to help us fix bugs.
• We do not use advertising cookies or third-party ad trackers.

5. Data Storage & Security

Your data is stored on Google Cloud Platform (asia-southeast1 region, Singapore) and Cloudflare R2 (global CDN).

Authentication is managed by Firebase Auth (Google infrastructure).

We use industry-standard encryption in transit (HTTPS/TLS) and follow security best practices.

Access to production systems is restricted to authorized personnel only.

6. RSVP Guest Data

When a Convya user enables RSVP on their event site, they collect personal data from their guests.

The project owner is the data controller. Convya acts as a data processor, storing and serving this data solely to provide the RSVP feature.

Convya does not use guest data for marketing, analytics, or any purpose beyond the RSVP service.

Guest data is permanently deleted when the associated project is deleted by the owner.

7. Third-Party Services

We use the following services that may process your data under their own privacy policies:

• Firebase Authentication (Google): account sign-in
• Stripe: payment processing
• Google Analytics: usage analytics
• Sentry: error tracking
• Cloudflare: CDN and asset hosting
• OpenRouter: AI content generation

8. Data Retention

Account data is retained while your account is active.

Project data (sites, chat history, assets) is retained while the project exists.

RSVP guest data is retained while the associated project exists.

Upon account deletion, all associated data is permanently removed.

Payment transaction records may be retained as required by Malaysian tax and financial regulations.

9. Your Rights

Under the PDPA 2010, you have the right to:

• Access your personal data held by us.
• Request correction of inaccurate data.
• Request deletion of your data.
• Withdraw consent for data processing.

To exercise these rights, contact us at contact@convya.art. We will respond to requests within 21 days as required by law.

10. Children

Convya is not intended for use by individuals under 18 without parental or guardian consent.

We do not knowingly collect data from children under 18. If we discover such data has been collected, we will delete it promptly.

11. Changes to This Policy

We may update this policy from time to time. Changes will be posted on this page with an updated effective date.

We encourage you to review this policy periodically.

12. Contact

For privacy-related inquiries, contact us at contact@convya.art.

Gotchaalab, Kuala Lumpur, Malaysia.