Privacy Policy

Last updated: July 19, 2026

1. Who We Are

Movra Connect ("we", "us", "our") is a product of Qualiency, registered in Singapore. Movra Connect is a WhatsApp Business Platform solution that helps fitness and dance studios manage client communications through the WhatsApp Business API.

2. Data We Collect

We collect the following categories of data:

Account information: your name, email address, and studio details when you sign up.
WhatsApp Business Account data: when you connect your WhatsApp Business Account through Meta's Embedded Signup, we receive your WABA ID, phone number ID, and an access token to send and receive messages on your behalf.
Message data: WhatsApp messages sent and received through your connected business number, including text content, timestamps, and sender/recipient phone numbers.
Contact data: phone numbers, display names, and labels of WhatsApp contacts who interact with your business number.
Media attachments: images, videos, and documents shared through WhatsApp messages, stored in our media storage bucket scoped to your workspace.
Mobile push notification tokens: if you install our mobile app, we store an anonymous device token (issued by Apple or Google) so we can notify you of new messages. No message body is included in push payloads.
Payment information: processed securely by Stripe. We do not store credit card numbers.
Usage data: pages visited, features used, and general analytics to improve our service.

3. Sensitive Information Disclosure

WhatsApp messages are free-form text and media. Your customers may voluntarily share sensitive information — including health details, financial information, or identity documents — as part of their message content. We store this information as part of your conversation history so you can serve your customers.

We do NOT use this information for advertising, profiling, cross-customer targeting, or any purpose beyond message delivery, storage, and AI-agent reasoning within your workspace. We do not sell any customer information under any circumstances.

4. How We Use Your Data

To provide the Movra Connect service: sending, receiving, and managing WhatsApp messages on your behalf.
To power our AI concierge agent that responds to your clients' messages based on your studio's configuration.
To manage your WhatsApp Business Account connection, including webhook subscriptions and message template management.
To process payments and manage your subscription.
To send you service-related notifications (e.g., connection issues, trial expiry).
To improve our product and fix bugs.
To provide push notifications on mobile devices when new messages arrive (mobile app only).

5. WhatsApp Data Handling

As a Meta Technology Provider, we access the WhatsApp Business Platform on your behalf. Specifically:

Access tokens are encrypted at rest using AES-256-GCM and stored in our database. They are only used to make WhatsApp API calls on your behalf.
Messages are stored to provide conversation history, analytics, and AI agent context. They are scoped to your workspace and never shared with other customers.
Phone numbers of your contacts are stored to enable contact management and message delivery. They are never sold or shared with third parties.
You can disconnect your WhatsApp Business Account at any time from the Settings page, which revokes our access.

AI agent processing: when our AI concierge agent responds to your customers' messages, message text and any attached images are sent to Anthropic (our AI provider, based in the United States) as part of the agent's reasoning context. Under Anthropic's standard Commercial Terms of Service, Anthropic automatically deletes API inputs and outputs within 30 days. Longer retention applies only in narrow cases: content flagged for a violation of Anthropic's Usage Policy may be retained up to 2 years for policy enforcement, and Anthropic's Trust & Safety classification scores may be retained up to 7 years. Anthropic does not use API data to train its models; we have not opted into any Anthropic training program.

6. Data Storage & Security

Data is hosted on Supabase infrastructure (AWS ap-southeast-2, Sydney).
All data in transit is encrypted via TLS 1.2+.
Sensitive credentials (access tokens, API keys) are encrypted at rest with AES-256-GCM.
Row-level security (RLS) ensures workspace data isolation — each studio can only access its own data.
We conduct regular security reviews and follow OWASP best practices.
Mobile session tokens are stored in the device's secure keychain (iOS Keychain / Android EncryptedSharedPreferences).
Mobile push notification tokens are stored server-side and used only to notify you of new WhatsApp messages. No message body content is included in push payloads.

7. Third-Party Services & Data Sharing

We share limited data with the following processors to operate Movra Connect. This matrix is the authoritative source for what data we share, with whom, and for what purpose — the same matrix drives our Google Play Data Safety declaration.

Data type	Supabase	Meta (WABA)	Anthropic (US)	OpenAI (US)	Vercel	Expo Push	Sentry	Stripe	Resend
Email address	Stores (Auth)	—	—	—	Proxies	—	Web + mobile; scrubbed to `<email>` before send	Stores (Customer)	Delivery address for transactional email
Studio / display name	Stores	—	—	—	Proxies	—	Web + mobile; may appear in event context (replay masked)	Stores (Customer)	May appear in email body
Payment method	—	—	—	—	—	—	—	Stores (tokenized)	—
Session tokens	Issues + validates	—	—	—	Proxies	—	—	—	—
Push token (mobile)	Stores	—	—	—	Proxies	Routes to APNs/FCM	—	—	—
WA phone number	Stores	Source	Sees in message context (≤30d)	—	Proxies	—	Web + mobile; scrubbed to `<waId>` / `<phone>` in URLs, query strings, request bodies, and error-message text before send. Free-text event context (extra/tags) is best-effort scrubbed for the `+`-prefixed phone form.	—	—
WA display name	Stores	Source	Sees (≤30d)	—	Proxies	—	Web + mobile; replay body masked; may appear in event context (no dedicated scrub regex)	—	—
Message text	Stores	Transports	Sees raw content for agent reasoning (≤30d)	Sees for embedding generation (retrieval search)	Proxies	—	Web + mobile; replay masked; may appear in error message field (embedded PII scrubbed via beforeSend)	—	—
Message media (images / video)	Stores (bucket)	Transports	Vision reasoning (≤30d)	—	Proxies	—	Media capture blocked	—	—
Voice notes (audio)	Stores (bucket)	Transports	Sees transcript in message context (≤30d)	Transcribes via Whisper (input processed, not retained beyond request)	Proxies	—	Media capture blocked	—	—
Interaction events	—	—	—	—	Serves + logs	—	Web (click / nav breadcrumbs); mobile (nav breadcrumbs via Expo Router integration)	—	—
Crash / error stack traces	—	—	—	—	Serves	—	Web + mobile; captures + stores (embedded PII scrubbed via beforeSend)	—	—

Each processor's role:

Supabase — our primary database, authentication, storage, and edge-function host (AWS ap-southeast-2, Sydney). Supabase Privacy Policy.
Meta (WhatsApp Business Platform) — carries all WhatsApp messages between your studio and your contacts. Access via our Meta Technology Provider integration. WhatsApp Business Policy.
Anthropic — powers our AI concierge agent (US-hosted). Retention: within 30 days auto-delete; up to 2 years for policy-flagged content; up to 7 years for Trust & Safety classification scores. Does not train on API data. Anthropic Privacy Policy.
OpenAI — used for two narrow functions: voice-note transcription (Whisper) and text embeddings for retrieval search. Voice audio and message text sent for these purposes are processed to generate the response (transcript / embedding) and, per OpenAI's API terms, are not retained for training on the API tier. OpenAI Privacy Policy.
Vercel — hosts the web application and edge functions. Vercel Privacy Policy.
Expo Push — routes mobile push notifications to APNs (iOS) and FCM (Android). Handles tokens only; does not persist message payloads. Expo Privacy Policy.
Sentry — error tracking on both web and mobile. On web, session replay is masked (no raw text or media captured) and only interaction shape / click targets / timing / error stacks are recorded. On mobile, we capture crashes, navigation breadcrumbs (via the Expo Router integration), and error stacks — no session replay. Both surfaces run identical PII scrubbing (wa_id, phone, email, and URL/breadcrumb path segments) via a shared beforeSend pipeline before events ship to Sentry cloud. Sentry Privacy Policy.
Stripe — payment processing. Handles card data via tokenized flows; we never store card numbers. Stripe retains invoices per its legal tax-record obligation (typically 7 years). Stripe Privacy Policy.
Resend — transactional email delivery (subscription notifications, onboarding sequences, weekly reports, agent-quality digests). Sees the recipient email address and the email body content it delivers. Resend Privacy Policy.

8. Data Retention

Your data is retained for as long as your account is active.
If you cancel your subscription, your data is retained for 30 days, then permanently deleted.
You may request immediate data deletion at any time by contacting us.
WhatsApp access tokens are deleted immediately when you disconnect your account.

9. Data Deletion

You can request complete deletion of your data at any time by emailing info@movra.io. This serves as our data deletion callback process as required by Meta.

Upon receiving a deletion request, we will:

Delete all WhatsApp messages and contact data associated with your account within 30 days.
Revoke and delete all stored access tokens immediately.
Remove your workspace and all associated data, including studio configuration, AI agent settings, broadcasts, and analytics.
Unassign the WhatsApp Business Account (WABA) from our system.

We will confirm the completion of your data deletion via email once all steps have been carried out.

We respond to all data-access and data-deletion requests within one month, in accordance with GDPR (Article 12(3), extendable by two additional months for complex requests), CCPA (45 days, extendable by 45 more), and Singapore PDPA (30 days). If we cannot meet this deadline, we will contact you to explain and provide an updated timeline.

10. Your Rights

You have the right to:

Access the personal data we hold about you.
Correct any inaccurate data.
Delete your account and all associated data.
Export your data in a portable format.
Disconnect your WhatsApp Business Account at any time.
Withdraw consent for data processing.

To exercise any of these rights, contact us at info@movra.io.

11. Cookies & Analytics

We use essential cookies for authentication and session management. We do not currently use advertising or third-party tracking cookies.

Our marketing website includes optional PostHog product analytics that are disabled by default. If we enable them in the future, we will notify existing users per Section 12 and add an in-page consent mechanism for EU visitors before the feature activates.

12. Changes to This Policy

We may update this policy from time to time. We will notify you of material changes by email or through a notice in the application. Continued use of Movra Connect after changes constitutes acceptance of the updated policy.

13. Children

Movra Connect is a professional tool for fitness and dance studios. It is not directed at children, and we do not knowingly collect data from children. If you become aware that a child has provided us with personal data through your workspace, contact us at info@movra.io and we will delete it.

14. Contact

If you have questions about this privacy policy or our data practices, contact us at: info@movra.io

15. Notification of Material Changes

Section 12 already commits us to notifying you of material changes to this policy. In practice: when we substantively update any section of this policy (adding a new data type we collect, a new processor we share data with, a new legal basis, or a change to retention windows), we send a summary email to workspace owners within 7 days of the change going live and post a notice inside the application. Continued use of Movra Connect after the notice constitutes acceptance of the updated policy.