Privacy Policy

1. Who We Are

Movra Connect ("we", "us", "our") is a product of Qualiency, registered in Singapore. Movra Connect is a WhatsApp Business Platform solution that helps fitness and dance studios manage client communications through the WhatsApp Business API.

2. Data We Collect

We collect the following categories of data:

• Account information: your name, email address, and studio details when you sign up.
• WhatsApp Business Account data:when you connect your WhatsApp Business Account through Meta's Embedded Signup, we receive your WABA ID, phone number ID, and an access token to send and receive messages on your behalf.
• Message data: WhatsApp messages sent and received through your connected business number, including text content, timestamps, and sender/recipient phone numbers.
• Contact data: phone numbers, display names, and labels of WhatsApp contacts who interact with your business number.
• Payment information: processed securely by Stripe. We do not store credit card numbers.
• Usage data: pages visited, features used, and general analytics to improve our service.

3. How We Use Your Data

• To provide the Movra Connect service: sending, receiving, and managing WhatsApp messages on your behalf.
• To power our AI concierge agent that responds to your clients' messages based on your studio's configuration.
• To manage your WhatsApp Business Account connection, including webhook subscriptions and message template management.
• To process payments and manage your subscription.
• To send you service-related notifications (e.g., connection issues, trial expiry).
• To improve our product and fix bugs.

4. WhatsApp Data Handling

As a Meta Technology Provider, we access the WhatsApp Business Platform on your behalf. Specifically:

• Access tokens are encrypted at rest using AES-256-GCM and stored in our database. They are only used to make WhatsApp API calls on your behalf.
• Messages are stored to provide conversation history, analytics, and AI agent context. They are scoped to your workspace and never shared with other customers.
• Phone numbers of your contacts are stored to enable contact management and message delivery. They are never sold or shared with third parties.
• You can disconnect your WhatsApp Business Account at any time from the Settings page, which revokes our access.

5. Data Storage & Security

• Data is hosted on Supabase infrastructure (AWS ap-southeast-2, Sydney).
• All data in transit is encrypted via TLS 1.2+.
• Sensitive credentials (access tokens, API keys) are encrypted at rest with AES-256-GCM.
• Row-level security (RLS) ensures workspace data isolation — each studio can only access its own data.
• We conduct regular security reviews and follow OWASP best practices.

6. Third-Party Services

We use the following third-party services to operate Movra Connect:

• Meta (WhatsApp Business Platform): message sending/receiving, business account management.
• Supabase: database hosting, authentication, edge functions.
• Stripe: payment processing.
• Vercel: application hosting.
• OpenAI: AI-powered message generation for the concierge agent.
• Resend: transactional email delivery.
• Sentry: error tracking and monitoring.

7. Data Retention

• Your data is retained for as long as your account is active.
• If you cancel your subscription, your data is retained for 30 days, then permanently deleted.
• You may request immediate data deletion at any time by contacting us.
• WhatsApp access tokens are deleted immediately when you disconnect your account.

8. Data Deletion

You can request complete deletion of your data at any time by emailing privacy@movra.io. This serves as our data deletion callback process as required by Meta.

Upon receiving a deletion request, we will:

• Delete all WhatsApp messages and contact data associated with your account within 30 days.
• Revoke and delete all stored access tokens immediately.
• Remove your workspace and all associated data, including studio configuration, AI agent settings, broadcasts, and analytics.
• Unassign the WhatsApp Business Account (WABA) from our system.

We will confirm the completion of your data deletion via email once all steps have been carried out.

9. Your Rights

You have the right to:

• Access the personal data we hold about you.
• Correct any inaccurate data.
• Delete your account and all associated data.
• Export your data in a portable format.
• Disconnect your WhatsApp Business Account at any time.
• Withdraw consent for data processing.

To exercise any of these rights, contact us at privacy@movra.io.

10. Cookies

We use essential cookies for authentication and session management. We do not use advertising or third-party tracking cookies.

11. Changes to This Policy

We may update this policy from time to time. We will notify you of material changes by email or through a notice in the application. Continued use of Movra Connect after changes constitutes acceptance of the updated policy.

12. Contact

If you have questions about this privacy policy or our data practices, contact us at: privacy@movra.io