# InvokeApp Privacy Policy **Version 2.2 · 24 October 2026** This is a translation. In case of discrepancy, the Spanish version prevails. ## Summary | | | |---|---| | **Who processes your data** | MARTÍNEZ CAMPOY CONSULTING, S.L., operating under the **InvokeApp** brand. | | **Why** | To provide the platform, answer your requests, invoice, keep the service secure and, if you agree, send you communications. | | **Your customers' data in the platform** | We process it **on behalf of your company or agency**, which is the controller. We only follow its instructions. | | **Google and Meta** | We only access Gmail, Google Calendar, WhatsApp, Instagram or Facebook if you connect the account, and only for the features you see in the platform (sections 5 and 6). We do not sell that data, we do not use it for advertising and we do not train AI models with it. | | **Where** | On Google Cloud. The platform and its database, in Madrid (European Union); AI models, in Belgium (and in the Netherlands as a fallback for image generation). Exceptions: video generation (Veo) runs in the United States and only if your company enables it, and technical logs are stored in Google's global location. Details in section 8. | | **Your rights** | Access, rectification, erasure, objection, restriction and portability: write to privacy@invokeapp.io. You may complain to the Spanish Data Protection Agency (AEPD). | | **Delete your data or disconnect an account** | invokeapp.io/data-deletion | --- ## 1. Controller - **Company:** MARTÍNEZ CAMPOY CONSULTING, S.L. (trade name InvokeApp). - **Tax ID (CIF):** B88657853. - **Registered office:** Calle Roma, 15, 30600 Archena (Murcia), Spain. - **Commercial Registry:** Commercial Registry of Murcia, sheet MU-120146. - **Privacy contact:** privacy@invokeapp.io. - **Data Protection Officer:** not appointed. For any data protection question: privacy@invokeapp.io. MARTÍNEZ CAMPOY CONSULTING, S.L. is the only company that provides the InvokeApp service: it operates the website `invokeapp.io`, the platform (`core.invokeapp.io`) and the applications connected to Google and Meta. ## 2. Who this policy applies to and our role | If you are… | Data | Our role | |---|---|---| | A website visitor, newsletter subscriber or someone who contacts us | What you give us in forms, emails or chats, and the cookies you accept | **Controller** | | A platform user (a person from an agency or company with an account) | Your account, sign-in, billing and support data | **Controller** | | A customer, contact or lead of a company or agency that uses InvokeApp, or a person who messages the WhatsApp of a business that uses InvokeApp | The data that company manages in the platform: records, messages, emails, appointments, posts | **Processor** (or sub-processor, when an agency processes it on behalf of its own client). That company is the controller | When we act as a processor, we process data only to provide the service to the controlling company and on its instructions, under the data processing agreement (Article 28 GDPR) that forms part of our terms of service. If this is your case, please address your requests to that company; if you write to us, we will forward them without delay and help it respond to you. ## 3. Data we process as controller | Activity | Data | Purpose | Legal basis | Retention | |---|---|---|---|---| | Contact (form, email, website WhatsApp, video calls) | Name, email, phone, company and what you tell us | Answer you and, if you ask, prepare a proposal | Steps taken at your request before entering into a contract; legitimate interest in answering enquiries | Until the enquiry is resolved plus 12 months, unless it becomes a contractual relationship | | Newsletter | Email and, if you provide them, name and business details | Send you the newsletter | Consent | Until you unsubscribe (link in every email) | | Downloads of guides, kits and playbooks | Email, name and the business details you provide | Deliver the material and, if you agree, related communications | Consent | Until you withdraw consent | | Blog comments | Name, email and comment | Moderate and publish the comment | Consent | While the comment is published | | Platform account | Name, email, password (stored hashed, never in plain text), company, role, language and preferences | Provide the contracted service | Performance of the contract | While the account is active and, afterwards, blocked for the applicable limitation periods | | Proof of contracting | Version of the terms accepted, date and time, user, IP address, browser and acceptance channel | Prove which terms were accepted, when and by whom | Performance of the contract and legitimate interest in proving the contract | For the term of the contract and, afterwards, blocked for the applicable limitation periods | | Billing and payments | Tax details, plan, amounts and payment history. **Card data is processed by Stripe; we do not store it** | Invoice and collect payments | Performance of the contract and legal obligation | 6 years (Article 30 of the Spanish Commercial Code) and the applicable tax periods | | Support | Requests, conversations and attachments | Solve issues | Performance of the contract | While the account is active plus 3 years | | Security and technical logs | IP address, date and time, sign-in actions, errors | Protect the service and investigate abuse and incidents | Legitimate interest in the security of the service | Up to 400 days | | Technical service metrics | Volumes, response times and errors, **without the content** of your data | Keep the service stable and properly sized | Legitimate interest | Aggregated, without identifying individuals | | Website cookies | See the [Cookie Policy](https://invokeapp.io/cookies-policies) | | | | We do not make decisions producing legal effects concerning you based solely on automated processing. ## 4. Artificial intelligence - The platform uses **Google Gemini models through Vertex AI**, processed in the **European Union** (`europe-west1`, Belgium); as a fallback, image generation may run in the Netherlands (`europe-west4`). Text-to-speech uses the European endpoint of Google Cloud Text-to-Speech. Voice dictation in the assistants is transcribed with Gemini in the European Union and the audio is not stored. **Exception:** video generation (the Veo model) is only available in the United States (`us-central1`); it is only used when your company enables that feature, with the safeguards in section 8. - AI is only used in features you see in the platform: message drafts, summaries, reply classification, assistants and agents your company enables. - **We do not train or fine-tune AI models** with your data, your customers' data or data obtained from Google or Meta. Google, as the Vertex AI provider, does not use the data we send to train its models. - Before sending text to the model we pseudonymise the personal data we detect: emails, phone numbers, ID documents, bank accounts and cards and, in the platform, the names recorded in the CRM. Detection is not perfect: it does not cover postal addresses or descriptions that could identify someone, and in some agents personal names may not be detected. This protection is on by default and only a company administrator can turn it off. - Texts the AI prepares to send to third parties (emails, messages, proposals) are proposed as drafts for a person to review, unless your company enables an autonomous mode; in that case they are sent within the limits your company sets and under its responsibility. Agents that talk to people (for example on WhatsApp or in a website chat) reply in real time and disclose that they are an AI system. ## 5. Google user data (Gmail, Google Calendar and other Google APIs) This section explains how InvokeApp accesses, uses, stores and shares data from the Google accounts you connect. There are two kinds of connection: - **Gmail** is connected with InvokeApp's Google application: the permissions in the first table of §5.1 are granted to InvokeApp. - **Google Calendar, Google Analytics, Google Ads and Google Tag Manager** are connected with **your company's Google application**: the OAuth client that your company creates in its own Google Cloud project and registers in the platform. Those permissions are granted to your application, not to InvokeApp's (§5.1, second table). ### 5.1 Permissions and how we use them We only request a permission when you enable the feature that needs it, and it is only used for that feature. **With InvokeApp's Google application (Gmail):** | Permission | When it is requested | What it is used for | |---|---|---| | `openid`, `email` | When you connect your Gmail mailbox | Identify the connected account and show it to you in the platform | | `gmail.send` | When you connect your company's or a project's mailbox | Send **from your own account** the emails of your campaigns, follow-ups and replies. By default, each send is approved by a person; if you enable the autonomous mode, they are sent within the limits you set | | `gmail.readonly` | Only if you enable "Allow reading replies" | Read **only the threads that were started from InvokeApp**: your contacts' replies to those emails and the messages you write manually in those same threads. This lets the platform show you the conversation, detect replies and unsubscribe requests, and stop pending follow-ups. **We do not read the rest of your mailbox** | **With your company's Google application** (InvokeApp uses the permissions your application obtains, only for these features and on your company's behalf): | Permission | When it is requested | What it is used for | |---|---|---| | `calendar.events`, `calendar.readonly` | When you connect a calendar for the receptionist or appointment management | Check your availability and create, change or cancel the appointments managed by the platform | | `analytics.readonly`, `adwords`, `tagmanager.readonly` | Only if you connect Google Analytics, Google Ads or Tag Manager | Read the metrics and settings shown in your reports and dashboards | ### 5.2 What we store, where and for how long - **Access credentials (tokens):** encrypted in our database. When you disconnect the Gmail mailbox we revoke the permission with Google and delete the credentials. For other Google connections (Calendar, Analytics, Ads or Tag Manager) we mark the connection as disconnected; also remove access at [myaccount.google.com/permissions](https://myaccount.google.com/permissions), which is what invalidates the credential, and request deletion of any credentials still stored and of the data at [invokeapp.io/data-deletion](https://invokeapp.io/data-deletion). - **Gmail:** from the threads started in the platform we store sender, recipient, subject, date, message and thread identifiers and the message text, linked to the contact and to the campaign or follow-up. We do not store attachments or messages from other threads. - **Google Calendar:** we only store the data of the appointments the platform creates or manages (date, time, event identifier and the contact details the person provided). We do not copy the rest of your calendar. - **Analytics, Ads and Tag Manager:** the metrics shown in your reports. - **Where:** in our Google Cloud database in Madrid (`europe-southwest1`); backups, in the European Union multi-region (section 8). - **How long:** while the connection is active and the feature needs it. Disconnecting the account does not by itself delete the data already stored: if you disconnect the Google account or close your InvokeApp account, ask us to delete it at [invokeapp.io/data-deletion](https://invokeapp.io/data-deletion) and we will delete that data within **30 days of your request at most**. Encrypted backups are deleted by rotation within 10 more days at most. ### 5.3 Who we share it with We do not transfer Google user data to third parties except: 1. To **Google Cloud and Vertex AI**, as our service providers, to host the data and to run the AI features you see in the platform (for example, classifying a reply or suggesting a draft). Never to train models. 2. When necessary for **security** purposes (for example, investigating abuse). 3. To **comply with applicable law**. 4. As part of a merger, acquisition or sale of assets, **only with your prior explicit consent**. We **never** sell Google user data or use it for advertising (including personalised advertising or retargeting), to determine creditworthiness or for lending purposes, or to create, train or improve AI models. Our staff **do not read** the content of your emails or calendar, unless you explicitly ask us to for a specific message (for example, in a support request), when necessary for security purposes, or to comply with the law. ### 5.4 Limited Use disclosure > InvokeApp's use and transfer to any other app of information received from Google APIs will adhere to the > [Google API Services User Data Policy](https://developers.google.com/terms/api-services-user-data-policy), including > the Limited Use requirements. The use of information received from Google Workspace APIs will adhere to the > [Google Workspace User Data and Developer Policy](https://developers.google.com/workspace/workspace-api-user-data-developer-policy), > including the Limited Use requirements. ### 5.5 How to remove access and delete the data - In the platform: **Integrations → your Google connection → Disconnect**. For the Gmail mailbox, we also revoke the permission with Google. - In your Google account: [myaccount.google.com/permissions](https://myaccount.google.com/permissions) → InvokeApp (for Gmail) or your company's application (for Calendar, Analytics, Ads and Tag Manager) → Remove access. - To request deletion of data already stored: [invokeapp.io/data-deletion](https://invokeapp.io/data-deletion). ## 6. Meta data (WhatsApp, Instagram and Facebook) ### 6.1 Permissions and how we use them | Permission | What it is used for | |---|---| | `whatsapp_business_management`, `whatsapp_business_messaging` | Connect the business's WhatsApp Business account with the access credentials the business itself provides (later, also through Meta's Embedded Signup); send and receive, on behalf of the business, the messages and templates it configures; manage templates; receive delivery and read statuses and quality notices | | `instagram_basic`, `instagram_content_publish`, `pages_show_list`, `pages_read_engagement`, `pages_manage_posts`, `business_management` | Choose the Facebook Page or Instagram professional account and publish the content you schedule | | `ads_read` | Only if you connect Meta Ads: read your campaign metrics for your reports | Today, the Instagram, Facebook and Meta Ads connections use the Meta app of the business itself or of its agency (section 7). We will only request those permissions with InvokeApp's app once Meta approves them. ### 6.2 What data we process - **WhatsApp:** phone number and profile name of the people who write or are written to, message content and attachments, delivery and read statuses, templates, and account identifiers (WhatsApp Business account and phone number). Access credentials are stored encrypted. - **Instagram and Facebook:** page or account identifiers, encrypted credentials, published content and its status. ### 6.3 Who owns the accounts and our role - The WhatsApp Business account, the phone number and the business portfolio **belong to the business that connects them**, not to InvokeApp or to the agency. The business keeps full access to WhatsApp Manager and can disconnect InvokeApp at any time. - We act as the business's **Tech Provider** on WhatsApp: we process its Meta data **only on behalf of and on the instructions of that business**, kept separate from other clients' data, and **never for our own purposes**. - We use WhatsApp data only for the features the business enables. If the business uses the receptionist with the InvokeApp CRM, a summary of the conversation is stored in the contact's record; it is part of that business's data and its CRM features (for example, lead scoring) may take it into account. We do not sell WhatsApp data, we do not share it with third parties and **we do not use it to create, train or improve AI models**. - Meta bills the business directly for WhatsApp messages. ### 6.4 Retention and deletion Messages and Meta data are kept while the connection is active and the business needs them. Disconnecting the account does not by itself delete the data already stored: if the business disconnects its account or no longer has an InvokeApp account, it can ask us to delete the data and we will do so within **30 days of the request at most**. Instructions are at [invokeapp.io/data-deletion](https://invokeapp.io/data-deletion). ### 6.5 If you message the WhatsApp of a business that uses InvokeApp That business is the controller of your data: contact it to exercise your rights or to stop receiving messages (you can also write "STOP" or "BAJA" in the conversation). If you write to us, we will forward your request to the business without delay. ## 7. Other platforms you can connect InvokeApp lets you connect other platforms (for example CRMs, messaging, calendars, CMSs or social networks). For all of them: you authorise the connection; we use the data only for the feature you enable; credentials are stored encrypted; and you can disconnect them at any time from **Integrations**. When you disconnect, we mark the connection as disconnected; also remove access from the provider itself, which is what invalidates the credential, and request deletion of any credentials still stored and of the data at [invokeapp.io/data-deletion](https://invokeapp.io/data-deletion). Some connections use a developer application you provide (your own app ID and secret); in that case, the relationship with the platform is maintained by your application. ## 8. Recipients and international transfers - We do not sell personal data. - Our service providers (processors) are listed at [invokeapp.io/subprocessors](https://invokeapp.io/subprocessors), with their function, processing location and applicable safeguard. The main ones: Google Cloud (hosting and AI), Stripe (payments), Meta and Twilio (messaging), and Google Workspace and Brevo for the emails we send. - Some features your company enables send queries to third parties that are not our service providers: for example, lead prospecting and enrichment search Google Maps Platform and Google's search engine for the sector, area or business name. They are also listed at [invokeapp.io/subprocessors](https://invokeapp.io/subprocessors). - If a provider processes data outside the European Economic Area, it does so with Chapter V GDPR safeguards: an adequacy decision (including the EU-U.S. Data Privacy Framework) or standard contractual clauses. Any exceptions that do not yet have that safeguard in place (today, the internal technical alerts sent through Telegram, which acts as an independent controller) are indicated on that same page. - We disclose data to authorities only when required by law. Where the platform itself processes data (Google Cloud): | What | Where | |---|---| | The platform, the agents, the database and files | Madrid (`europe-southwest1`), European Union | | AI models | Belgium (`europe-west1`), European Union; the Netherlands (`europe-west4`) as a fallback for image generation | | Video generation (Veo), only if your company enables it | United States (`us-central1`) | | Task queues and scheduled tasks | Belgium (`europe-west1`), European Union | | Messages the platform passes to the agents (Pub/Sub) | No fixed region configured: Google Cloud stores them in the region closest to the publisher, today the platform in Madrid | | Database backups | European Union multi-region | | Technical logs and platform secrets | Google Cloud's global location, which may store them in data centres in any country | | The public website `invokeapp.io` | Firebase's global content delivery network; the blog, with its server in the Netherlands (`europe-west4`) | ## 9. Security Encryption in transit (HTTPS/TLS) and at rest; third-party credentials encrypted at application level, with the keys in a secrets manager and a system that allows them to be rotated; separation of each company's data; role-based access; activity logging; and sending AI models only the content each feature needs: text and, in voice or image features, the dictated audio (not stored) or the images provided. No measure is infallible: if a breach affects you, we will notify it as required by the GDPR. **Found a vulnerability?** Write to security@invokeapp.io with the details. Do not run tests that affect other customers' data. ## 10. Your rights You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw any consent you have given at any time, by writing to privacy@invokeapp.io (we also handle requests sent to letstalk@invokeapp.io, the channel in clause 11.4 of the Terms of Service). We will reply within one month. If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency ([www.aepd.es](https://www.aepd.es)). ## 11. Children InvokeApp is a service for businesses and professionals. It is not directed to children under 14 and we do not knowingly process their data. ## 12. Changes to this policy We will publish any change here with its date. If a change affects how we use Google or Meta data, we will notify you in advance in the platform or by email and, where the platform's rules require it, ask for your consent again before using the data in the new way.