Privacy Policy

Who this covers

Invalo is software that small businesses use to follow up their own customers' enquiries and leads. This policy covers two groups of people: the business owners and team members who use Invalo, and the customers, leads and message senders whose details a business holds or processes in Invalo.

What we collect

When you sign up, we collect your name, email address, and the business information you provide during onboarding. If you import or connect customer data (leads, quotes, orders, service records), we store that data — including your customers' names, email addresses, and phone numbers where you provide them — so Invalo can analyse it and prepare communications on your behalf.

If you connect Facebook Messenger or Instagram to Invalo, we store the content of the conversations your customers have with your business on those channels, so Invalo can provide messaging and automation features — including detecting recurring customer questions, suggesting automations for them, and running an automated reply where you have set one up. We may analyse this conversation content using AI to identify recurring customer needs and automation opportunities. In full, we store:

• the identifiers of the Facebook Page or Instagram professional account you connect, the permissions you granted, and an access token (stored encrypted);
• the conversations your customers have with your business on those channels: message text, the sender's Meta-scoped ID, timestamps and delivery status (text only — we do not store attachment files or links);
• any details a customer chooses to give on a secure form Invalo sends them for you, such as a name, phone number or email address.

Facebook, Instagram and Meta

Meta Platforms is the source of Facebook Messenger and Instagram messaging data. Invalo receives it through Meta's Messenger and Instagram messaging interfaces, and only for the Page or Instagram professional account that a business owner connects. The owner grants access by logging in with Meta and approving permissions.

Invalo asks for these permissions only: for Facebook Messenger, pages_messaging, pages_show_list and pages_manage_metadata; for Instagram, instagram_business_basic and instagram_business_manage_messages. We use them to list your Pages, subscribe your Page or account to message notifications, receive your customers' messages, and send replies from your business — nothing else.

You can disconnect either channel at any time from Integrations in Invalo. After that, Invalo stops using the access token and stops processing new messages for that channel. You can also remove Invalo's access from within Facebook or Instagram's own settings.

How we use it

We use your business and customer data to: run AI analysis that looks for revenue-recovery opportunities in your data; prepare draft follow-up messages for your review; send those messages by email or SMS once you approve them; receive messages sent to your connected Facebook Page or Instagram account and keep them as conversation history; detect recurring customer questions and suggest automations, when you ask us to; and show you the results inside the product.

Invalo can also send an automated reply on Facebook Messenger or Instagram — but only after you have set up a workflow, approved it, enabled the channel for Invalo workflows and switched the workflow on, and only within the reply window Meta allows. Sending customer-facing messages requires an active paid subscription; during a free trial, Invalo prepares but does not send.

We do not sell your data, we do not use messaging data received from Meta for advertising, and we do not use your customer data to build products for anyone other than your own business.

Approvals and automated replies

Recovery messages (email or SMS) are reviewed and approved by you before they send. Automated replies on Facebook Messenger and Instagram follow the workflow you approved: you approve the wording and rules once for that version, and you can switch it off at any time. Changing a workflow creates a new version that must be approved again before it can send. Customers can reply STOP to opt out of automated replies, and an opted-out customer is not contacted again.

AI processing

Opportunities, recommendations and draft messages are generated by AI models analysing your business data. They are estimates and drafts, not guarantees — every dollar figure Invalo labels as “potential” is an estimate, and only figures labelled “verified” are backed by a real transaction or your own confirmation.

Where AI is used on conversations, it is to identify recurring customer questions, and conversation text may be sent to our AI provider for that purpose. A private AI summary of a new lead, if you switch one on, uses only the answers you choose to allow; phone numbers and email addresses are never sent to AI, and for a name only the first name is used. The summary is for you and is never sent to the customer.

Third parties we rely on

Invalo is built on infrastructure providers who process data on our behalf under their own agreements: Supabase (database and authentication), Vercel (hosting), Anthropic (the AI models that analyse your data and draft messages), Stripe (billing and payment processing — Invalo never stores your card details), Resend (outbound email delivery), Twilio (outbound SMS delivery, where configured) and Meta (Facebook Messenger and Instagram messaging, for the channels you connect). Each only receives the data needed to perform its function.

Retention and deletion

We retain your business and customer data for as long as your account is active, so Invalo can keep providing continuous analysis and show your historical results. Raw Facebook and Instagram conversation content is the one exception: under our V1 retention policy it is kept for up to 12 months from when a message was sent and is then automatically cleared, even while your account stays active. The message record and its Meta message ID are kept so the same message is not processed twice.

You can permanently delete a business, or your entire account, yourself at any time from Settings. Deleting a business or account permanently removes the customer, lead, quote, order, invoice, campaign, conversation, and activity data that belongs to it, and revokes any connected accounting or messaging integration with that provider. We keep a narrow set of records even after deletion — billing and payment history, and the minimum activity log needed for security, fraud prevention and legal compliance — for as long as we are required or entitled to under applicable law. Some records may also be retained briefly in backups before being purged.

If you are a person who messaged a business that uses Invalo, you can ask for your messages to be deleted. See Data deletion instructions for how.

Your customers' data

If you provide us with your customers' contact details so Invalo can prepare and send follow-up communications, you are responsible for having the appropriate basis to share that data with us and to contact those customers. Every recovery email includes a working, one-click unsubscribe link, and an unsubscribed customer is never contacted again through Invalo.

Security

We use industry-standard practices — encrypted connections, encrypted credential storage and role-based access control — to protect your data. No method of storage or transmission is perfectly secure, and we make no claim of guaranteed security.

Contact

Questions about this policy or your data: email support@invalo.au. We typically respond within 2 business days — this is a service expectation, not a contractual SLA.