Gavito is a customer messaging platform operated by Gavito Technologies (“we”, “us”). Businesses use it to talk to their customers on WhatsApp through Meta’s official WhatsApp Business Platform, run campaigns and send invoices. This policy explains what personal data we handle, why, and the choices you have.
Who is responsible for your data
For the accounts of people who sign up to Gavito, we decide how their data is used. For the messages, contacts and invoices a business keeps in Gavito, that business decides how the data is used, and we process it on the business’s behalf and only on its instructions. If you are a customer of a business that uses Gavito, contact that business first about your data; we will help them answer you.
What we collect
- Account details: your name, email address, a securely hashed password, and, if you turn it on, your two-factor authentication settings.
- Sign-in and security records: the IP address and browser of each session, and a log of important actions in an organization (for example invitations, role changes and connected numbers), so we can keep accounts secure.
- Organization details: the business name and the team members and roles in each organization.
- WhatsApp connection: when a business connects a number through Meta’s signup, we receive the WhatsApp Business Account and phone number IDs and an access token from Meta. Access tokens are stored encrypted.
- Conversations: the WhatsApp number and profile name of each customer who messages a connected number, the messages exchanged, their delivery status, and which team member a conversation is assigned to. Photos, videos, voice notes and documents stay with Meta and are fetched from Meta only when a team member opens them.
How we use it
- To provide the service: show conversations, send replies, campaigns and invoices.
- To keep accounts and data secure, prevent abuse and investigate problems.
- To send service emails, such as sign-up verification, password resets and team invitations.
- To meet our legal obligations.
We do not sell personal data, we do not use it for advertising, and we do not use the content of messages for any purpose other than providing the service to the business that owns them.
Who we share it with
We share data only with the providers we need to run Gavito:
- Meta Platforms, which carries WhatsApp messages and runs the WhatsApp Business Platform. Meta’s handling of messages is covered by its own terms and policies.
- Our email provider, which delivers service emails.
- Our hosting provider, which runs the servers Gavito and its database are on.
- A breached-password check: when you choose a password, we send only the first five characters of its hash to check it against known data breaches. Your password itself never leaves our servers.
We may also disclose data when the law requires it.
How long we keep it
We keep account and organization data while the account is active. When an account or organization is deleted, we delete its data within 30 days. Database backups are kept for 14 days and then deleted, so deleted data leaves our backups within that time as well.
How we protect it
Data is encrypted in transit with HTTPS. Each organization’s data is kept separate at the database level, so one business can never see another’s. Passwords are hashed, WhatsApp access tokens are encrypted, and access within an organization depends on each member’s role.
Your rights
You can ask us for a copy of your personal data, ask us to correct it, or ask us to delete it. See how to delete your data. You can also withdraw consent where we rely on it. To make any request, email support@gavitotechnologies.com. We reply within 30 days.
Changes to this policy
If we change this policy, we will update the date at the top of this page, and tell account owners by email about significant changes.
Contact
Questions or complaints about privacy: support@gavitotechnologies.com.