Privacy Policy

Effective: 1 September 2026 · Last updated: 28 August 2026

Who we are. Quivio ("Quivio", "we", "us") is a customer-messaging service provider for small businesses in Lebanon. Businesses (each a "Client") engage Quivio as their third-party service provider to operate their WhatsApp Business Platform account and to handle their customers' booking and ordering messages on the Client's behalf and under the Client's instructions. Quivio is not affiliated with, endorsed by, or a partner of WhatsApp or Meta Platforms. Contact: admin@quivio.io.

Roles. For messages you exchange with a Client, the Client is the business you are dealing with and is responsible for that relationship; Quivio processes your data only on the Client's behalf and instructions (as a processor). For the quivio.io website and Client accounts, Quivio is the controller.

What is collected when you message a Client that uses Quivio

• Your WhatsApp phone number and profile name, as provided by WhatsApp.
• The content of the messages you exchange with the Client through its WhatsApp number. If the Client enables it, voice messages are converted to text so they can be answered; Quivio does not keep the audio file.
• The booking or order details you provide: service or items, date and time, delivery address, your first name.

We do not ask for, and you should not send, identity documents, payment-card numbers or health information.

Automation and human contact. The Client's replies to routine booking and ordering questions are generated automatically from the Client's own services, menu, opening hours and policies. This automation is part of the Client's customer service, not a general-purpose assistant. You can ask for a person at any time (for example, reply "talk to someone" / "بدي احكي مع حدا") and the Client will be notified and take over the conversation; you can also contact the Client directly by phone or in store.

Why the data is used. To answer you on the Client's behalf, to create and manage your booking or order, to send you appointment reminders you have agreed to (you can stop them at any time by replying), and to let the Client see and respond to the conversation. Legal basis: performance of the service you asked for and the Client's legitimate interest in serving its customers.

Messaging consent. The Client may message you on WhatsApp only after you have given it your number and agreed to be contacted — for example by writing to the Client first, or by ticking a box when you book. Reminder messages are sent only if you agreed to them when booking. To stop any messages, reply "stop" / "وقّف" or block the number; the request is honoured immediately.

Who can see the data. The Client (through its Quivio dashboard); Quivio staff, for support and safety, under confidentiality; and Quivio's sub-processors, each bound by written terms to act only on our instructions: Meta Platforms Ireland (WhatsApp Business Platform), Supabase (database hosting, Frankfurt, EU), n8n GmbH (workflow hosting, EU), a language-model provider such as OpenAI (used only to draft replies within the Client's conversation; message content is not used to train or improve any AI model), and Vercel (website hosting). We do not sell, license or share personal data with anyone else, do not use it for advertising, and do not combine it with data from other Clients.

Where the data is stored. In European Union data centres (Frankfurt). Transferring data outside Lebanon is necessary to provide the service.

How long. Conversation messages: 12 months after the last message, then deleted. Bookings and orders: for as long as the Client keeps its account, and at most 3 years. Client account and website data: while the account exists, then 30 days.

Your rights. You can ask to see, correct or delete the data held about you, or object to its use. Message the Client's WhatsApp number, or email admin@quivio.io. Our Data Deletion page explains the fastest route. We answer within 30 days.

Security. Encryption in transit and at rest; each Client's data is isolated from every other Client's; two-factor authentication on all administrative access; least-privilege credentials; regular security reviews. Our safeguards are designed to meet or exceed industry standards. If a security incident affects your data, we notify the Client and, where required, you, without undue delay.

Website (quivio.io). We keep only server logs and basic, cookie-free analytics. Messages sent through the contact form are used to reply to you.

Children. Quivio's services are not directed at children under 16, and Clients may not target minors.

Changes. Changes are published on this page with a new date; material changes are also emailed to Clients.