Version 3.4.1 · Effective date: October 7, 2026 · Last updated: October 7, 2026
Convirza, Inc. (“Convirza,” “we,” “us,” or “our”) respects your privacy and is committed to protecting personal information. This Privacy Policy describes how we collect, use, disclose, store, and protect information in connection with our websites, applications, APIs, integrations, and products and services (collectively, the “Services”).
Privacy requests: privacy@convirza.com · General support: support@convirza.com · (888) 804-5046 · Jump to: AI assistant connectors · Google user data · Data retention
This Privacy Policy applies to information Convirza processes in two distinct capacities. Which sections apply to you depends on which capacity is involved.
When Convirza acts for itself (controller / business). We determine how information is used when you visit our websites, request information, create an account, or communicate with us. This Privacy Policy governs that information in full.
When Convirza acts on behalf of a customer (service provider / processor). In many circumstances, Convirza processes information at the direction of, and on behalf of, our business customers. In those circumstances, the customer determines the purposes and means of processing, and Convirza generally acts as a service provider or data processor. We process that information to perform the Services under our agreement with that customer, and, where permitted by our agreement with that customer and applicable law, for the limited additional purposes described in this Privacy Policy, such as keeping the Services secure and improving Convirza’s own scoring models (Section 6). Questions regarding a customer’s collection or use of personal information should generally be directed to that customer, and we will forward or refer requests to that customer where appropriate.
Scope. This Privacy Policy applies to information Convirza processes in connection with:
This Privacy Policy applies to information collected through our websites and through the Services, including information collected by telephone, message, and other channels. It is not limited to online activity.
We describe the information we collect by who it is about and where it comes from, because different rights and obligations apply to each.
Collected directly from you, or automatically when you interact with our websites:
Collected when a customer signs up for, administers, or uses the Services:
As part of the Services, Convirza collects or receives information about individuals who interact with our customers, including individuals who call, message, or visit our customers’ properties. Depending on how a customer configures and uses the Services, this may include:
Convirza maintains this information on behalf of, and at the direction of, our customers, except for the limited uses described in Section 6. Our customers control this information, and its collection and use are also governed by those customers’ own privacy policies, which may differ from this Privacy Policy. We encourage individuals with questions or requests concerning information held by a Convirza customer to contact that customer directly.
We may automatically collect:
Because the Services process communications, information transmitted through the Services may in some circumstances include information that applicable law treats as sensitive, including government identifiers, financial account information, precise geolocation, health information, or account credentials spoken or entered during a communication.
Convirza does not ask for sensitive personal information for its own purposes. Where sensitive information is present in customer content, Convirza processes it to perform the Services. Use of transcripts for model training is limited as described in Section 6.
Customers decide whether to turn on call recording and transcription. Convirza advises customers to consider the notices, consents and agreements they need before recording calls where sensitive information may be discussed, and customers are responsible for configuring the Services accordingly.
Convirza processes the audio of communications to produce transcripts, classifications, scores, summaries and related analytics.
Convirza may use information to:
Where Convirza acts as a service provider, we use information processed on behalf of a customer to perform the Services for that customer, and for the limited additional purposes described in this Privacy Policy, including the model improvement described in Section 6.
Certain Convirza Services use artificial intelligence, machine learning, automated classification, or related technologies to analyze communications and other customer data. Depending on the Services a customer selects, these technologies may be used to transcribe, classify, summarize, and evaluate communications, and to generate scores, indicators, and related analytics at the customer’s direction.
Convirza uses third-party technology providers as service providers or subprocessors to deliver these capabilities. These providers process information to provide their services to Convirza, and some may keep it for limited periods under their own terms. Our speech-to-text provider, Deepgram, processes call audio to produce transcripts. Deepgram’s terms allow it to keep audio and transcripts it receives and to use them to improve its own models, except for requests on which Convirza opts out of that program. Information about our current subprocessors is available on request from privacy@convirza.com.
When a customer’s user connects an AI assistant through the Convirza connector, information sent to that assistant is described in Section 9.2.
Convirza’s own AI features. Some Convirza features, such as AI voice agents and the assistant that helps customers build them, send the information needed for a request to AI model and infrastructure providers, including OpenAI (language models), Baseten (hosting for Convirza’s own models) and LiveKit (real-time voice sessions), and return the result. Under OpenAI’s standard API terms, OpenAI does not use this information to train its models and may keep it for up to 30 days to monitor for abuse. Conversations handled by AI voice agents are stored in the customer’s Convirza account and retained as described in Section 11.
Improving Convirza’s own models. Where our agreement with a customer permits it, Convirza may use call transcripts processed for that customer to train and improve Convirza’s own scoring models, which produce the scores and indicators described above. These transcripts can include names, phone numbers and other details spoken during calls. Convirza does not use for model training: (a) protected health information we process under a Business Associate Agreement; (b) data from customers whose agreement does not permit this use; or (c) data from customers who have asked us to exclude their data. A customer’s administrator can ask us to exclude the customer’s data by emailing privacy@convirza.com. We will apply the exclusion to future training within 30 days of the request. This paragraph does not apply to Google user data, which Convirza does not use for model training (see Section 9.1).
Convirza does not sell personal information for money. As described in Section 8, we share limited website visitor information with advertising and marketing partners. Convirza may disclose personal information as follows.
Service providers and subprocessors. To vendors that perform services on our behalf, including hosting, telecommunications carriage, transcription, speech and language processing, payment processing, analytics, security, and customer support. These providers process information to perform services for Convirza. Some providers may keep or use information under their own terms, as described in Section 6. Our product analytics provider, Statsig, receives the user details described in Section 9.2.
Customer-authorized integrations. To third-party platforms a customer connects to the Services, at that customer’s direction and configuration, including advertising, analytics, CRM, scheduling, and communications platforms, and AI assistants a customer’s user connects through the Convirza connector. See Sections 9 and 9.2.
Business customers. To the Convirza customer on whose behalf information was collected, and to that customer’s authorized users, agencies, and partners as configured by that customer.
Affiliates. To Convirza subsidiaries and affiliated entities, subject to this Privacy Policy.
Legal and safety. To comply with a court order, law, subpoena, or legal process, including responses to government or regulatory requests; to enforce our terms and agreements, including for billing and collection; and where we believe disclosure is necessary or appropriate to protect the rights, property, or safety of Convirza, our customers, or others.
Business transactions. To a buyer or successor in connection with a merger, acquisition, financing, reorganization, dissolution, or sale or transfer of some or all of Convirza’s assets, including in bankruptcy or a similar proceeding.
With your consent, or as otherwise disclosed at the time information is collected.
Aggregated and de-identified information. Convirza may disclose aggregated or de-identified information that cannot reasonably be used to identify an individual. Convirza maintains such information in de-identified form and does not attempt to reidentify it.
We use your website visits to advertise to you. Convirza does not sell personal information for money. However, when you visit our websites, we use cookies, pixels and similar technologies from advertising partners, such as Meta (Facebook and Instagram) and LinkedIn. These partners receive information about your visit, such as the pages you view, your device and browser, and cookie or advertising identifiers. We and they use it to show you Convirza ads on their platforms and elsewhere, and to measure how our ads perform. Under some U.S. state privacy laws, this counts as “selling” or “sharing” personal information, including “sharing” for cross-context behavioral advertising. You can opt out at any time, as described below.
Some of our website partners may also associate your visit with other information they or others hold about you, such as your email or postal address, so that we or our service providers can send you communications and marketing.
This applies only to visitors to Convirza’s own websites. It does not apply to the call, message, recording or analytics data Convirza processes on behalf of customers. Convirza does not sell that data for money or share it for its own advertising.
Where Convirza transmits conversion or attribution information to an advertising platform for a customer, it does so at the direction of the customer and on that customer’s behalf, as that customer’s service provider. The customer, not Convirza, determines whether that transmission constitutes a sale or share under applicable law with respect to the customer’s own obligations.
How to opt out. Use the “Your Privacy Choices” link in the footer of our websites, or email privacy@convirza.com with the subject line “Do Not Sell or Share.” We process opt-out requests within 15 business days. You can also block or delete third-party cookies in your browser settings.
The Services allow customers to connect third-party platforms, including advertising, analytics, CRM, scheduling, telephony, and communications systems. When a customer authorizes an integration, Convirza exchanges only the information necessary to operate that integration, and does so at the customer’s direction.
The privacy practices of third-party platforms are governed by their own privacy policies. Customers should review the privacy practices of third-party services they choose to connect to Convirza.
This section explains how Convirza accesses, uses, stores, shares, protects, retains and deletes data we receive from Google APIs (“Google user data”) through the Google Ads call-conversion integration and through signing in to Convirza with Google. It applies in addition to the rest of this Privacy Policy, and where they differ, this section governs Google user data.
Convirza asks for Google access only when you choose a feature that needs it, and asks only for the permissions that feature needs.
| Feature | Google permission (scope) | What Convirza accesses |
|---|---|---|
| Google Ads call-conversion integration | Google Ads API (https://www.googleapis.com/auth/adwords) |
The Google Ads account and customer identifiers available to the Google user who authorizes the connection, so the customer can choose the account to connect; and the ability to upload call conversions to that account. |
| Signing in to Convirza with Google | Basic Google sign-in information | Your name, email address, and Google account identifier, used to identify the person authorizing a connection or signing in. |
For these features, Convirza requests only the permissions listed above.
Convirza uses Google user data only to provide the feature you turned on:
Convirza uploads conversions at your direction and on your behalf, as your service provider. We do not use Google user data for any other purpose.
To keep a Google Ads connection active, Convirza stores:
OAuth tokens are used only to keep your connection working, so Convirza can upload conversions without asking you to re-authorize each one. They are not shown to end users.
You can stop Convirza’s access to your Google account at any time, in either of two ways:
After you revoke access at Google, Convirza can no longer upload conversions to your Google Ads account. To have the stored Google user data deleted as well, disconnect Google Ads in Convirza or email privacy@convirza.com.
Convirza people do not read your Google user data, except:
Access is limited to personnel who need it for these purposes.
Convirza does not sell Google user data. Convirza does not transfer Google user data to anyone, except:
Convirza does not send Google user data to AI or large language model providers, data brokers, advertising platforms, or external data warehouses, and does not make it available through the Convirza AI assistant connector described in Section 9.2. The connector can return click identifiers, such as the Google click ID (gclid), and Google Analytics client IDs, but these are collected by Convirza’s own tracking script from a visitor’s landing page. They are not received from Google APIs.
Convirza does not use Google user data:
Convirza’s model-improvement practices in Section 6 do not apply to Google user data.
Google user data is sent over encrypted connections (TLS) and access is restricted as described above. See also Section 12.
Convirza’s use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Questions about Google user data: privacy@convirza.com.
Convirza offers a connector, built on the Model Context Protocol (“MCP”), that lets a customer’s authorized users connect their Convirza account to a third-party AI assistant they choose, such as ChatGPT (OpenAI), Claude (Anthropic), or another MCP-compatible tool. In this section, “AI assistant” means that third-party assistant, not Convirza’s own AI features, which are described in Section 6. The connector is available at connect.convirza.com/mcp.
How a connection is made. A user adds the Convirza connector in their AI assistant and signs in through Convirza’s own OAuth 2.0 sign-in page, with a Convirza password or with “Continue with Google” or “Continue with Microsoft.” The user’s password is never shared with the AI assistant. Each request is authenticated as that user and is subject to that user’s Convirza role and permissions.
Processing happens at the user’s direction. The connector does nothing on its own. It runs a tool only when the connected user asks the AI assistant for something and the assistant calls one of Convirza’s tools. The AI assistant, not Convirza, reads the user’s conversation and decides which tool to call. Convirza does not use a language model to process connector requests.
What the connector receives. Convirza receives only what the AI assistant sends with a tool call: the tool name and its inputs, such as search terms, filters, dates, record IDs, and the values for any change the user asked for. Where the connector offers a tool for uploading call recordings and the user asks the assistant to use it, Convirza receives the recording file and the call details sent with it, and stores them in the customer’s account like any other recording. Convirza does not receive or request the user’s full conversation, chat history, memory or files from the AI assistant.
What the connector can read and return. Depending on the request and the user’s permissions, the connector can return:
| Tool category | What it reads and returns |
|---|---|
| Search and fetch | Matching records found by name, email address or phone number, across the categories below. |
| Calls and call analytics | Call details: caller and tracking phone numbers, caller name and other caller contact details where available, date, time, duration, status, routing, and marketing source and campaign; links to call recordings, and call transcripts; Conversation Analytics results such as scores, indicators, classifications, outcomes, summaries, agent performance and missed-opportunity reports. |
| Attribution | Marketing-source details for a call or visit, including landing page, referring source, campaign parameters, click identifiers (such as the Google click ID, gclid) and Google Analytics client IDs collected by Convirza’s own tracking script. |
| Text messages (SMS) | SMS conversation content, the phone numbers involved, and dates and times; SMS broadcast content, recipient lists and schedules. |
| AI voice agents | Voice agent settings, and for calls an AI voice agent handled, the same call details, recordings and transcripts as other calls. |
| Users, groups and locations | User names, email addresses, roles and permissions; group and location names, structure and addresses. |
| Tracking numbers, campaigns and routing | Tracking numbers, campaigns, call routing and location routes, dynamic number insertion settings, tags, recorded greetings and prompts, and blocked caller numbers. |
| Scorecards and insights | Scorecards, scored-call results, and insight and custom-insight definitions. |
| Integrations and API access | Webhook URLs and settings, event subscriptions, and the account’s own API client credentials (a new secret is shown once, when the user creates or rotates it). |
| Reports | Aggregated metrics and reports built from the categories above. |
The connector does not return Google OAuth tokens, Google Ads account identifiers or conversions uploaded to Google Ads (see Section 9.1). It does not return payment card details.
Actions. The connector can also make changes in Convirza at the user’s request, subject to that user’s Convirza role and permissions, such as creating, updating or deleting users, groups, campaigns, tracking numbers, routes, webhooks, tags, scorecards and voice agents; ordering or releasing tracking numbers; and creating, scheduling or cancelling SMS broadcasts. These changes take effect in the customer’s account immediately, as if the user made them in Convirza.
Where returned information goes. Information the connector returns is sent to the AI assistant the user connected, at that user’s direction, so the assistant can answer the user’s request. Once received, it is handled under the AI assistant provider’s own terms and privacy policy (for example, OpenAI’s for ChatGPT and Anthropic’s for Claude), and under any agreement the customer has with that provider, including any settings that control whether the provider may use conversations to train its models. Convirza does not control how the AI assistant provider stores or uses that information. Customers should review those terms, and their own obligations to the people whose calls and messages they record, before connecting. The AI assistant provider is not a Convirza subprocessor for this purpose; the customer’s user chooses and directs the transfer.
Product analytics (Statsig). Convirza may send events to Statsig, our product analytics provider, when a user connects the connector and when a tool is called, so we can understand how the connector is used and improve it. These events include the user’s Convirza user ID, email address and name, the user’s organization (Convirza account), the type of event (for example, connected or tool called), the name of the tool, and the time. Statsig processes this information as our service provider.
What Convirza keeps. Connecting an AI assistant does not change how Convirza stores customer data (see Section 11). For the connector itself, Convirza keeps:
Your controls.
No sale; model training. Convirza does not sell information received or returned through the connector. How Convirza may use call data stored in a customer’s Convirza account, including any recordings a user uploads through the connector, to improve its own models is described in Section 6.
Children. The connector is for business users of Convirza accounts and is not directed to children.
Convirza and our service providers may use cookies, pixels, web beacons, local storage, and similar technologies to operate and secure our websites and Services, remember preferences, understand website and product usage, measure marketing performance, improve our Services, and support advertising and marketing activities.
These technologies include analytics and session-recording tools, provided by our service providers, that record how you use our website pages, such as the pages you view, clicks, scrolling and mouse movements. We configure these tools to mask what you type into form fields.
You can control cookies through your browser settings, including blocking or deleting them. Blocking some cookies may affect how our websites work.
Convirza retains personal information for as long as reasonably necessary to provide the Services, fulfill the purposes described in this Privacy Policy, comply with contractual obligations, resolve disputes, maintain security, and satisfy legal or regulatory requirements.
Customer data. Convirza keeps the call, message, recording, transcript and analytics data it processes for a customer for as long as that customer’s account exists, and may continue to keep it after the customer stops using the Services or closes the account. Convirza deletes it when the customer asks, or when an individual’s verified request is passed to us through the customer. We complete verified deletion requests within 45 days of verification. Copies in backups are deleted when those backups expire, in about 30 days. Convirza can delete a specific caller’s data or a whole account’s data. Where a customer’s contract sets different terms, the contract governs.
| Category | How long we keep it |
|---|---|
| Website visitor and prospect information | For as long as needed for our sales and marketing communications, or until you unsubscribe or ask us to delete it |
| Customer account and administrative information | For as long as the account exists, then as long as needed for legal, tax and audit obligations |
| Billing and transaction records | For as long as needed for tax, accounting and audit obligations |
| Call records and metadata (numbers, dates, durations, routing, attribution) | For as long as the customer’s account exists; deleted within 45 days of a verified request (Section 13) |
| Call recordings, including any recordings uploaded through the AI assistant connector | For as long as the customer’s account exists; deleted within 45 days of a verified request (Section 13) |
| Transcripts, summaries, scores and other analytics | For as long as the customer’s account exists; deleted within 45 days of a verified request (Section 13) |
| SMS messages and related metadata | For as long as the customer’s account exists; deleted within 45 days of a verified request (Section 13) |
| Caller information (phone numbers, names and other contact details) | For as long as the customer’s account exists; deleted within 45 days of a verified request (Section 13) |
| AI voice agent conversations | For as long as the customer’s account exists; deleted within 45 days of a verified request (Section 13) |
| Google user data (Google Ads connection, tokens, Google account identifiers) | While connected; deleted when you disconnect or ask us to, as stated in Section 9.1 |
| Other integration credentials and tokens | For as long as the integration remains connected |
| AI assistant connector credentials | Access tokens expire 7 days after last use; refresh tokens expire after 6 months (Section 9.2) |
| AI assistant connector request logs (including connector requests and responses) | 12 months, then deleted automatically |
| Other application and API logs | For as long as needed for security, troubleshooting and support |
| Database backups | Deleted data may remain in backups for about 30 days, until those backups expire |
Information returned to an AI assistant through the Convirza connector is also held by that assistant’s provider under its own terms; Convirza’s retention periods above do not govern the provider’s copy. See Section 9.2.
Convirza maintains administrative, technical, and organizational safeguards designed to protect information from unauthorized access, destruction, loss, alteration, or disclosure. These include access controls and authentication requirements, encrypted connections (TLS) for our websites, applications and APIs, restriction of access to personnel with a business need to know, and logging.
No system or method of transmission is completely secure, and Convirza cannot guarantee absolute security.
Depending on your location and applicable law, you may have rights concerning your personal information, including the rights to:
How to submit a request. Submit a request by email to privacy@convirza.com, or by phone at (888) 804-5046.
Verification. Before responding to a request to know specific pieces of information or a request to delete, we will verify your identity. If you have a password-protected account, we will verify through that account. Otherwise, we may ask you to provide information sufficient to match you to the personal information we hold.
Authorized agents. You may use an authorized agent to submit a request on your behalf. We may require the agent to provide proof of authorization and may require you to verify your own identity directly.
Response timing. We will confirm receipt within 10 business days and respond within 45 calendar days, extendable by an additional 45 days where reasonably necessary, with notice to you.
Appeals. If we decline your request, you may appeal by emailing privacy@convirza.com with the subject line “Privacy Request Appeal.” We will respond to an appeal within 45 days (or 60 days where applicable state law provides) with a written explanation of our decision. If your appeal is denied, you may contact your state attorney general.
Non-discrimination. Convirza will not discriminate against you for exercising your privacy rights.
Information held on behalf of a customer. If Convirza processes information on behalf of one of our customers, we will refer your request to that customer, or assist that customer in responding, as required under our agreement with them and applicable law.
Residents of states with comprehensive privacy laws, including California, Colorado, Connecticut, Texas, Virginia, and others, may have the rights described in Section 13.
| Category of personal information | Sources | Business purpose | Disclosed to |
|---|---|---|---|
| Identifiers (name, email, phone, IP address, account identifiers) | You; customers; automatic collection | Provide Services; account administration; security; marketing | Service providers; affiliates; customer-authorized integrations; advertising partners (Section 8) |
| Customer records (billing, payment, contact) | You | Billing; account administration | Service providers (payment, accounting) |
| Commercial information (subscription, usage, transactions) | Automatic collection | Provide and improve Services | Service providers |
| Internet or network activity (usage, referring URLs, device data) | Automatic collection | Operate and secure websites and Services; analytics; advertising | Service providers; advertising partners (Section 8) |
| Geolocation data (approximate, from IP address) | Automatic collection | Security; analytics | Service providers |
| Audio and electronic information (recordings, transcripts, messages) | On behalf of customers | Provide Services at customer direction; improve Convirza’s own scoring models where the customer’s agreement permits (Section 6) | Service providers; the applicable customer; AI assistants a customer’s user connects (Section 9.2) |
| Professional or employment information (job title, employer) | You | Account administration; marketing | Service providers |
| Sensitive personal information (see Section 3) | On behalf of customers | Provide Services at customer direction; improve Convirza’s own scoring models where the customer’s agreement permits (Section 6) | Service providers; the applicable customer |
| Inferences (scores, classifications, summaries) | Derived from the above | Provide Services at customer direction | The applicable customer |
Retention is described in Section 11. Sale and sharing are described in Section 8.
California residents may request, once per year and free of charge, information about personal information disclosed to third parties for their direct marketing purposes in the preceding calendar year. Submit requests to privacy@convirza.com.
Nevada residents may submit a request to opt out of the sale of covered information to privacy@convirza.com.
Where the Services are used by customers in healthcare, dental, wellness, or related settings, information processed through the Services may constitute consumer health data under laws including the Washington My Health My Data Act, the Nevada Consumer Health Data Privacy Law, and comparable laws.
Requests and questions about consumer health data can be sent to privacy@convirza.com. Where Convirza processes this data for a customer, we will refer the request to that customer or help it respond.
The Services enable customers to record, transcribe, analyze, and message individuals who communicate with them. Laws governing call recording, monitoring, notification, consent, telemarketing, and messaging vary by jurisdiction, and several require the consent of all parties to a communication.
Customers are solely responsible for determining which laws apply to their use of the Services, for providing any required notices and disclosures, and for obtaining any required consents before enabling recording, transcription, analysis, or messaging features. Convirza provides configuration controls that allow customers to enable, disable, and restrict these features. Convirza does not provide legal advice regarding a customer’s compliance obligations.
Convirza acts as a service provider carrying out the customer’s instructions with respect to these features. Apart from the uses described in Sections 6 and 12, such as model improvement where permitted and keeping the Services secure, Convirza does not use the content of customer communications for its own purposes.
If you give Convirza your mobile number and agree to receive text messages, for example when you sign up for an account or request support, we may text you about your account, support requests and service notices. We send marketing texts only with your separate express written consent. Message frequency varies. Message and data rates may apply. Reply STOP to opt out or HELP for help, or contact support@convirza.com. We do not share mobile numbers or text-messaging consent with third parties for their marketing.
Convirza is based in the United States. Convirza and its service providers process information in the United States and may process it in other countries, which may have data protection laws that differ from those in your country. If you are in the European Economic Area, the United Kingdom or Switzerland and have questions about how your information is transferred, contact privacy@convirza.com.
Where Convirza processes protected health information on behalf of a covered entity or business associate under the Health Insurance Portability and Accountability Act, that processing is governed by a Business Associate Agreement between Convirza and the customer. Convirza uses and discloses protected health information only as the Business Associate Agreement and HIPAA permit. Convirza does not use protected health information to train its models unless the Business Associate Agreement expressly permits it. In the event of a conflict between this Privacy Policy and an executed Business Associate Agreement, the Business Associate Agreement governs with respect to protected health information.
Convirza’s Services are intended for businesses and are not directed to children. Convirza does not knowingly collect personal information directly from children under 13 through our websites or customer account registration process, and does not knowingly sell or share the personal information of individuals under 16. If you believe a child has provided personal information directly to Convirza, please contact us at privacy@convirza.com and we will delete it.
We may update this Privacy Policy periodically to reflect changes to our Services, technology, legal requirements, or privacy practices. When we make material changes, we will update the “Last updated” date above, post notice on this page, and provide additional notice or obtain consent where required by applicable law or by third-party platform policies.
Questions, concerns, and privacy requests may be directed to:
Convirza, Inc.
Privacy requests: privacy@convirza.com
General support: support@convirza.com
Phone: (888) 804-5046
Website: www.convirza.com
Convirza Privacy Policy · Version 3.4.1 · Effective date: October 7, 2026 · Last updated: October 7, 2026
