Privacy Policy

Last updated: July 23, 2026

1. Introduction

ALee Consulting LLC ("ALee Consulting", "we", "us" or "our") provides Convello, an omnichannel conversational engagement platform that helps businesses and agencies manage customer conversations across WhatsApp, Instagram, Messenger, Telegram and other messaging channels. We respect your privacy and are committed to protecting the personal information you entrust to us.

This Privacy Policy describes the personal information we process, why we process it, the choices you have, and the rights available to you. It applies to our website at https://aleeconsult.com, the Convello application, and related services (together, the "Service"). By using the Service you acknowledge the practices described here.

2. Who we are

ALee Consulting LLC is a limited liability company registered in the United States and is the entity responsible for the Service. For privacy matters, you can reach us using the details below.

• Company: ALee Consulting LLC
• Registered address: 27 Viola Street, South San Francisco, CA 94080, United States
• Phone: +1 (650) 333-1294
• Privacy contact: [email protected]
• General enquiries: [email protected]

3. Controller vs. processor

Our role under data protection law depends on the type of data involved:

• Where we are the controller. For information about our own customers and website visitors — for example, account registration details, billing information, support requests and website analytics — ALee Consulting determines the purposes and means of processing and acts as a data controller.
• Where we are a processor / service provider. For the personal information of end-users who contact a business through a messaging channel powered by Convello (for example, the message content, contact details and profile information of a customer messaging one of our business customers), the business customer is the data controller and ALee Consulting acts as a processor and service provider on that customer's behalf. We process such data only to provide the Service under our agreement with the business customer and following their lawful instructions.

If you are an end-user and wish to exercise rights over data that a business processes through Convello, please contact that business directly. We will support the business customer in responding to your request.

4. Information we collect

Account data

When a business customer creates and administers an account, we collect information such as name, business name, email address, phone number, role, password credentials (stored in hashed form), workspace configuration and preferences.

Customer and end-user data processed on behalf of business customers

To operate the shared inbox, automation and campaign features, we process the contact details and messages of end-users who interact with our business customers. This may include names, phone numbers, social handles and profile identifiers, message content and attachments, delivery and read status, consent and opt-in status, and metadata such as timestamps and channel of origin. This data is processed on behalf of, and under the instructions of, the business customer.

Usage and technical data

We collect information about how the Service is accessed and used, including IP address, device and browser type, operating system, log data, feature usage, referring pages, and diagnostic and performance information.

Cookies and similar technologies

Our website and application use cookies and similar technologies to keep you signed in, remember preferences, secure the Service and understand usage. See the Cookies & tracking section below.

5. How we use information

We use personal information for the following purposes:

• Provide the Service — to authenticate users, deliver and route messages, run automations and campaigns, and make platform features available.
• Support — to respond to enquiries, troubleshoot issues and communicate service-related notices.
• Security and integrity — to detect, prevent and respond to fraud, abuse, spam, and security incidents, and to enforce our terms and platform policies.
• Improvement — to monitor, maintain and improve the reliability, performance and features of the Service.
• Billing — to process subscriptions, usage-based fees and taxes.
• Legal — to comply with applicable laws, respond to lawful requests, and establish, exercise or defend legal claims.

6. Legal bases for processing

Where the EU or UK General Data Protection Regulation (GDPR) applies, we rely on the following legal bases:

• Performance of a contract — to provide the Service to our customers under our terms and agreements.
• Legitimate interests — to secure, maintain and improve the Service, prevent abuse, and run our business, where those interests are not overridden by your rights.
• Consent — where required, for example certain cookies, marketing communications, or specific end-user opt-ins obtained by our business customers.
• Legal obligation — to comply with laws, tax and accounting requirements, and lawful requests from authorities.

For end-user data processed on behalf of a business customer, the business customer is responsible for establishing a valid legal basis, including obtaining any required consent or opt-in before messaging.

7. Platform data & Meta Platform Terms

Convello integrates with Meta Platforms (Facebook, Instagram and Messenger) via the official Meta Graph API, with the WhatsApp Business Platform, and with Telegram. When a business customer connects one of these channels, we access only the data necessary to provide the Service.

• Data obtained through the Meta APIs and the WhatsApp Business Platform is used only to provide and improve the Service for the authorizing business customer.
• We do not sell Platform data and we do not use it for advertising or to build advertising profiles.
• We handle Platform data in accordance with Meta's Platform Terms and Developer Policies and each platform's applicable policies.
• We retain Platform data only as long as needed to provide the Service and delete it in line with our retention practices and applicable platform requirements.

If our access to a platform is revoked, or a connection is removed, we stop processing the associated Platform data and delete or de-identify it in accordance with the platform's requirements and applicable law.

8. How we share information

We do not sell personal information. We share information only in the following circumstances:

• Service providers and subprocessors — trusted vendors that perform functions on our behalf under contractual confidentiality and data-protection obligations.
• Messaging platforms — Meta and other messaging providers, to the extent necessary to deliver messages you send and receive through their channels.
• Legal and safety — where required by law, legal process, or to protect the rights, property or safety of ALee Consulting, our customers or others.
• Business transfers — in connection with a merger, acquisition, financing or sale of assets, subject to appropriate safeguards.

Representative categories of subprocessors we use include:

Category	Purpose
Cloud hosting & infrastructure	Hosting the Service, storing data, and running compute and databases.
Messaging platform APIs	Sending and receiving messages via Meta, WhatsApp Business Platform and Telegram.
Analytics	Understanding product usage and reliability to improve the Service.
Email / CRM	Transactional and service communications and account management.
Payment processing	Processing subscription and usage-based payments securely.

A current list of subprocessors is available on request from [email protected].

9. Data retention

We retain personal information for as long as needed to provide the Service, comply with our legal obligations, resolve disputes and enforce our agreements. Retention periods vary by data type and context:

• Account data is retained for the life of the account and for a reasonable period afterward.
• End-user message data processed on behalf of a business customer is retained according to that customer's configuration and instructions, subject to platform requirements.
• Billing and tax records are retained as required by applicable accounting and legal rules.

When data is no longer needed, we delete or de-identify it. See Data Deletion Instructions for how to request deletion.

10. International transfers

ALee Consulting is based in the United States and may process and store personal information in the United States and other countries where we or our service providers operate. Where we transfer personal information across borders, we use appropriate safeguards such as Standard Contractual Clauses or other lawful transfer mechanisms as required by applicable law.

11. Data security

We maintain administrative, technical and organizational measures designed to protect personal information, including encryption in transit and at rest, least-privilege access controls, audit logging and ongoing monitoring. No method of transmission or storage is completely secure, but we work continuously to protect your data. Learn more in our Security overview.

12. Your rights

Depending on where you live, you may have the right to:

• Access the personal information we hold about you.
• Correct inaccurate or incomplete information.
• Delete your personal information.
• Port your data to another provider in a portable format.
• Object to or restrict certain processing, and withdraw consent where processing is based on consent.

For residents of the European Economic Area and the United Kingdom, these rights arise under the GDPR, and you may also lodge a complaint with your local supervisory authority. For residents of California, the CCPA/CPRA provides rights to know, delete, correct and opt out of the sale or sharing of personal information, and the right not to be discriminated against for exercising those rights. We do not sell personal information.

To exercise your rights, contact [email protected]. If your data was processed through a business customer's channel, we will refer your request to, or coordinate with, that business as the controller. We may need to verify your identity before acting on a request.

13. Data deletion & requests

You can request deletion of your personal information at any time. We honor verified deletion requests, subject to data we must retain for legal or accounting reasons. For step-by-step instructions — including in-app deletion, email requests and Meta-connected data — see our dedicated Data Deletion Instructions.

14. Cookies & tracking

We use strictly necessary cookies to operate and secure the Service, and functional and analytics cookies to remember preferences and understand usage. You can control cookies through your browser settings; disabling some cookies may affect functionality. Where required by law, we obtain consent before setting non-essential cookies.

15. Children's privacy

The Service is intended for businesses and is not directed to children. We do not knowingly collect personal information from individuals under the age of 16. If you believe a child has provided us personal information, please contact us and we will take appropriate steps to delete it.

16. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, provide additional notice. Your continued use of the Service after changes take effect constitutes acceptance of the revised policy.

17. Contact us

If you have questions about this Privacy Policy or our privacy practices, or wish to exercise your rights, contact us at:

• Email: [email protected]
• Post: ALee Consulting LLC, 27 Viola Street, South San Francisco, CA 94080, United States
• Phone: +1 (650) 333-1294