Privacy policy

We collect information you provide when you create an account, configure your business, contact us, or use Invoki.

• Account information, such as your name, email address, sign-in method, and authentication identifiers.
• Business information, including your business name, website, services, prices, policies, time zone, and preferred voice.
• Connected social account identifiers, account names, authorized permissions, encrypted access credentials, uploaded photos and videos, approved captions, schedules, and publishing receipts when you use content publishing.
• Customer email addresses, consent choices, completed appointment details, follow-up messages, delivery activity, replies, and unsubscribe preferences when you use email follow-ups or promotions.
• Instagram account identifiers and customer messages when you connect Instagram and turn Invoki on.
• Customer-shared photos, short videos, Stories, Reels, public links, and—only when a business explicitly enables it—voice notes needed to understand an Instagram conversation.
• Website-receptionist conversations and, only when a visitor chooses to provide them, contact details and contact preferences for a requested follow-up.
• Product activity and technical information needed to operate, secure, and understand use of the service.
• Messages you send to support and any information you choose to include in them.

We use information to provide and secure Invoki, answer website and Instagram questions from the business’s approved information, complete bookings, deliver a visitor-requested follow-up, personalize the product to the business, troubleshoot problems, communicate about accounts, and improve the service. Website contact details are made available only to the business whose site collected them. We do not sell personal information.

We use trusted providers to run Invoki. These currently include Supabase for authentication and data storage, Netlify for hosting, Railway for secure message processing, OpenAI for generating receptionist replies and, when enabled, moderating or transcribing supported customer content, Meta for Instagram messaging and Instagram/Facebook publishing, TikTok for authorized publishing, Google for optional sign-in and YouTube publishing, Stripe for billing, and Resend for account emails and approved client follow-ups. OpenAI also helps draft captions; you review content before publishing. They process information on our behalf under their own security and privacy commitments.

We share information only with service providers needed to operate Invoki, when you direct us to, or when reasonably necessary to comply with law, protect users, investigate abuse, or defend legal rights.

We retain website and Instagram conversation history while the business’s Invoki account is active so the business can understand and continue customer conversations. Website chat sessions expire after 30 days of inactivity; a returning visitor then receives a new session. Raw Instagram webhook delivery records are deleted after seven days. Source video, extracted frames, audio tracks, page text, and playable voice-note audio are not kept after analysis. A direct voice-note transcript is encrypted only while Invoki prepares the response, for no more than six minutes, and is deleted when used or expired; a concise summary and a sanitized visual preview may remain with the conversation. Disconnecting Instagram immediately removes Invoki’s stored access token and schedules its private connection media for deletion. You may request access, correction, deletion of conversation history, or account deletion by contacting us or the business you contacted. Some billing, security, and legal records may be retained when required by law.

Invoki uses YouTube API Services. When you connect a social account, Invoki uses the permissions you authorize to identify the destination account and publish only content you approve. Your media, title, caption, and selected publishing settings are sent to the chosen platform. We do not request your social-platform password. We do not sell Google user data, use it for advertising, or use it to train generalized AI models.

You can disconnect publishing in Settings > Connections. This removes Invoki’s stored publishing credentials and prevents future publishing through that connection. Disconnecting does not delete posts already on the social platform, or remove your Invoki uploads and publishing history. You can request deletion of retained account data by contacting support. You can also revoke Invoki’s Google access through your Google account permissions. Instagram DM access has a separate disconnect control.

Businesses approve automation settings and service instructions before future completed appointments create follow-ups. Clients choose optional emails at booking and can unsubscribe using the link in an email. Invoki uses replies, new bookings, and opt-outs to stop relevant pending follow-ups. Client contact information is used for the business they contacted, not for unrelated businesses’ promotions.

We use practical technical and organizational safeguards, including server-verified sessions and database access controls. No internet service can promise absolute security, so please use a strong, unique password and protect access to your account.

Invoki is a business service and is not directed to children under 13. If you use the service outside the United States, your information may be processed in countries where our providers operate.

We may update this policy as Invoki evolves. We will post the revised version here and update the effective date. Material changes may also be communicated through the product or by email.