# InvokeApp Privacy Policy

**Version 2.0 · 20 October 2026**


## Summary

| | |
|---|---|
| **Who processes your data** | MARTÍNEZ CAMPOY CONSULTING, S.L., operating under the **InvokeApp** brand. |
| **Why** | To provide the platform, answer your requests, invoice, keep the service secure and, if you agree, send you communications. |
| **Your customers' data in the platform** | We process it **on behalf of your company or agency**, which is the controller. We only follow its instructions. |
| **Google and Meta** | We only access Gmail, Google Calendar, WhatsApp, Instagram or Facebook if you connect the account, and only for the features you see in the platform (sections 5 and 6). We do not sell that data, we do not use it for advertising and we do not train AI models with it. |
| **Where** | On Google Cloud servers in the European Union (Madrid). AI models run in Google's European region. |
| **Your rights** | Access, rectification, erasure, objection, restriction and portability: write to privacy@invokeapp.io. You may complain to the Spanish Data Protection Agency (AEPD). |
| **Delete your data or disconnect an account** | invokeapp.io/data-deletion |

---

## 1. Controller

- **Company:** MARTÍNEZ CAMPOY CONSULTING, S.L. (trade name InvokeApp).
- **Tax ID (CIF):** B88657853.
- **Registered office:** Calle Roma, 15, 30600 Archena (Murcia), Spain.
- **Commercial Registry:** Commercial Registry of Murcia, sheet MU-120146.
- **Privacy contact:** privacy@invokeapp.io.
- **Data Protection Officer:** not appointed. For any data protection question: privacy@invokeapp.io.

MARTÍNEZ CAMPOY CONSULTING, S.L. is the only company that provides the InvokeApp service: it operates the website
`invokeapp.io`, the platform (`core.invokeapp.io`) and the applications connected to Google and Meta.

## 2. Who this policy applies to and our role

| If you are… | Data | Our role |
|---|---|---|
| A website visitor, newsletter subscriber or someone who contacts us | What you give us in forms, emails or chats, and the cookies you accept | **Controller** |
| A platform user (a person from an agency or company with an account) | Your account, sign-in, billing and support data | **Controller** |
| A customer, contact or lead of a company or agency that uses InvokeApp, or a person who messages the WhatsApp of a business that uses InvokeApp | The data that company manages in the platform: records, messages, emails, appointments, posts | **Processor** (or sub-processor, when an agency processes it on behalf of its own client). That company is the controller |

When we act as a processor, we process data only to provide the service to the controlling company and on its
instructions, under the data processing agreement (Article 28 GDPR) that forms part of our terms of service. If this is
your case, please address your requests to that company; if you write to us, we will forward them without delay and
help it respond to you.

## 3. Data we process as controller

| Activity | Data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Contact (form, email, website WhatsApp, video calls) | Name, email, phone, company and what you tell us | Answer you and, if you ask, prepare a proposal | Steps taken at your request before entering into a contract; legitimate interest in answering enquiries | Until the enquiry is resolved plus 12 months, unless it becomes a contractual relationship |
| Newsletter | Email and, if you provide them, name and business details | Send you the newsletter | Consent | Until you unsubscribe (link in every email) |
| Downloads of guides, kits and playbooks | Email, name and the business details you provide | Deliver the material and, if you agree, related communications | Consent | Until you withdraw consent |
| Blog comments | Name, email and comment | Moderate and publish the comment | Consent | While the comment is published |
| Platform account | Name, email, password (stored hashed, never in plain text), company, role, language and preferences | Provide the contracted service | Performance of the contract | While the account is active and, afterwards, blocked for the applicable limitation periods |
| Billing and payments | Tax details, plan, amounts and payment history. **Card data is processed by Stripe; we do not store it** | Invoice and collect payments | Performance of the contract and legal obligation | 6 years (Article 30 of the Spanish Commercial Code) and the applicable tax periods |
| Support | Requests, conversations and attachments | Solve issues | Performance of the contract | While the account is active plus 3 years |
| Security and technical logs | IP address, date and time, sign-in actions, errors | Protect the service and investigate abuse and incidents | Legitimate interest in the security of the service | Up to 400 days |
| Technical service metrics | Volumes, response times and errors, **without the content** of your data | Keep the service stable and properly sized | Legitimate interest | Aggregated, without identifying individuals |
| Website cookies | See the [Cookie Policy](https://invokeapp.io/cookies-policies) | | | |

We do not make decisions producing legal effects concerning you based solely on automated processing.

## 4. Artificial intelligence

- The platform uses **Google Gemini models through Vertex AI**, processed in the **European region**
  (`europe-west1`, Belgium).
- AI is only used in features you see in the platform: message drafts, summaries, reply classification, assistants
  and agents your company enables.
- **We do not train or fine-tune AI models** with your data, your customers' data or data obtained from Google or
  Meta. Google, as the Vertex AI provider, does not use the data we send to train its models.
- AI outputs are drafts and require human review before being used with third parties. When an agent talks to people
  (for example on WhatsApp or in a website chat) it discloses that it is an AI system.

## 5. Google user data (Gmail, Google Calendar and other Google APIs)

This section explains how InvokeApp accesses, uses, stores and shares data from the Google accounts you connect.

### 5.1 Permissions and how we use them

We only request a permission when you enable the feature that needs it, and it is only used for that feature.

| Permission | When it is requested | What it is used for |
|---|---|---|
| `openid`, `email` | When you connect any Google account | Identify the connected account and show it to you in the platform |
| `gmail.send` | When you connect your company's or a project's mailbox | Send **from your own account** the emails that you or your team approve in the platform: campaigns, follow-ups and replies |
| `gmail.readonly` | Only if you enable "Allow reading replies" | Read **only the threads that were started from InvokeApp**: your contacts' replies to those emails and the messages you write manually in those same threads. This lets the platform show you the conversation, detect replies and unsubscribe requests, and stop pending follow-ups. **We do not read the rest of your mailbox** |
| `calendar.events`, `calendar.readonly` | When you connect a calendar for the receptionist or appointment management | Check your availability and create, change or cancel the appointments managed by the platform |
| `analytics.readonly`, `adwords`, `tagmanager.readonly` | Only if you connect Google Analytics, Google Ads or Tag Manager | Read the metrics and settings shown in your reports and dashboards |

### 5.2 What we store, where and for how long

- **Access credentials (tokens):** encrypted in our database. When you disconnect the account we revoke them with
  Google and delete them.
- **Gmail:** from the threads started in the platform we store sender, recipient, subject, date, message and thread
  identifiers and the message text, linked to the contact and to the campaign or follow-up. We do not store
  attachments or messages from other threads.
- **Google Calendar:** we only store the data of the appointments the platform creates or manages (date, time, event
  identifier and the contact details the person provided). We do not copy the rest of your calendar.
- **Analytics, Ads and Tag Manager:** the metrics shown in your reports.
- **Where:** Google Cloud, European Union (Madrid, `europe-southwest1`).
- **How long:** while the connection is active and the feature needs it. If you disconnect the Google account, delete
  the campaign or close your account, we delete that data within **30 days at most**. Encrypted backups are deleted by
  rotation within 10 days at most.

### 5.3 Who we share it with

We do not transfer Google user data to third parties except:

1. To **Google Cloud and Vertex AI**, as our service providers, to host the data and to run the AI features you see in
   the platform (for example, classifying a reply or suggesting a draft). Never to train models.
2. When necessary for **security** purposes (for example, investigating abuse).
3. To **comply with applicable law**.
4. As part of a merger, acquisition or sale of assets, **only with your prior explicit consent**.

We **never** sell Google user data or use it for advertising (including personalised advertising or retargeting), to
determine creditworthiness or for lending purposes, or to create, train or improve AI models.

Our staff **do not read** the content of your emails or calendar, unless you explicitly ask us to for a specific
message (for example, in a support request), when necessary for security purposes, or to comply with the law.

### 5.4 Limited Use disclosure

> InvokeApp's use and transfer to any other app of information received from Google APIs will adhere to the
> [Google API Services User Data Policy](https://developers.google.com/terms/api-services-user-data-policy), including
> the Limited Use requirements. The use of information received from Google Workspace APIs will adhere to the
> [Google Workspace User Data and Developer Policy](https://developers.google.com/workspace/workspace-api-user-data-developer-policy),
> including the Limited Use requirements.

### 5.5 How to remove access and delete the data

- In the platform: **Integrations → your Google connection → Disconnect**.
- In your Google account: [myaccount.google.com/permissions](https://myaccount.google.com/permissions) → InvokeApp →
  Remove access.
- To request deletion of data already stored: [invokeapp.io/data-deletion](https://invokeapp.io/data-deletion).

## 6. Meta data (WhatsApp, Instagram, Facebook and Threads)

### 6.1 Permissions and how we use them

| Permission | What it is used for |
|---|---|
| `whatsapp_business_management`, `whatsapp_business_messaging` | Connect the business's WhatsApp Business account, through Meta's Embedded Signup or with the credentials the business itself provides; send and receive, on behalf of the business, the messages and templates it configures; manage templates; receive delivery and read statuses and quality notices |
| `instagram_basic`, `instagram_content_publish`, `pages_show_list`, `pages_read_engagement`, `pages_manage_posts`, `business_management` | Choose the Facebook Page or Instagram professional account and publish the content you schedule |
| `threads_basic`, `threads_content_publish` | Publish to your Threads profile the content you schedule |
| `ads_read` | Only if you connect Meta Ads: read your campaign metrics for your reports |

### 6.2 What data we process

- **WhatsApp:** phone number and profile name of the people who write or are written to, message content and
  attachments, delivery and read statuses, templates, and account identifiers (WhatsApp Business account and phone
  number). Access credentials are stored encrypted.
- **Instagram, Facebook and Threads:** page or account identifiers, encrypted credentials, published content and its
  status.

### 6.3 Who owns the accounts and our role

- The WhatsApp Business account, the phone number and the business portfolio **belong to the business that connects
  them**, not to InvokeApp or to the agency. The business keeps full access to WhatsApp Manager and can disconnect
  InvokeApp at any time.
- We act as the business's **Tech Provider**: we process its Meta data **only on behalf of and on the instructions of
  that business**, kept separate from other clients' data, and **never for our own purposes**.
- We do not use WhatsApp data to build or augment profiles of people beyond the conversation itself, we do not sell
  it or share it with third parties, and **we do not use it to create, train or improve AI models**.
- Meta bills the business directly for WhatsApp messages.

### 6.4 Retention and deletion

Messages and Meta data are kept while the connection is active and the business needs them, with the periods the
business configures. If the business disconnects its account, asks us to delete the data or no longer has an
InvokeApp account, we delete it within **30 days at most**. Instructions are at
[invokeapp.io/data-deletion](https://invokeapp.io/data-deletion).

### 6.5 If you message the WhatsApp of a business that uses InvokeApp

That business is the controller of your data: contact it to exercise your rights or to stop receiving messages (you
can also write "STOP" in the conversation). If you write to us, we will forward your request to the business without
delay.

## 7. Other platforms you can connect

InvokeApp lets you connect other platforms (for example CRMs, messaging, calendars, CMSs or social networks). For all
of them: you authorise the connection; we use the data only for the feature you enable; credentials are stored
encrypted; and you can disconnect them at any time from **Integrations**. Some connections use a developer
application you provide (your own app ID and secret); in that case, the relationship with the platform is maintained
by your application.

## 8. Recipients and international transfers

- We do not sell personal data.
- Our service providers (processors) are listed at [invokeapp.io/subprocessors](https://invokeapp.io/subprocessors),
  with their function, processing location and applicable safeguard. The main ones: Google Cloud (hosting and AI, in
  the EU), Stripe (payments), Meta and Twilio (messaging), and Google Workspace for the emails we send.
- If a provider processes data outside the European Economic Area, it does so with Chapter V GDPR safeguards: an
  adequacy decision (including the EU-U.S. Data Privacy Framework) or standard contractual clauses.
- We disclose data to authorities only when required by law.

## 9. Security

Encryption in transit (HTTPS/TLS) and at rest; third-party credentials encrypted at application level with key
rotation; separation of each company's data; role-based, least-privilege access; activity logging; and sending AI models
only the text each feature needs. No measure is infallible: if a breach affects you, we will notify it as required by
the GDPR.

**Found a vulnerability?** Write to security@invokeapp.io with the details. Do not run tests that affect other
customers' data.

## 10. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and
portability, and withdraw any consent you have given at any time, by writing to privacy@invokeapp.io. We will reply
within one month. If you believe we have not handled your request properly, you can lodge a complaint with the Spanish
Data Protection Agency ([www.aepd.es](https://www.aepd.es)).

## 11. Children

InvokeApp is a service for businesses and professionals. It is not directed to children under 14 and we do not
knowingly process their data.

## 12. Changes to this policy

We will publish any change here with its date. If a change affects how we use Google or Meta data, we will notify you
in advance in the platform or by email and, where the platform's rules require it, ask for your consent again before
using the data in the new way.