Privacy Policy

Who we are

ENOVA Business Hub is an integration platform that lets companies connect their WhatsApp Business accounts, their Facebook Pages (Messenger) and their Instagram professional accounts in order to handle conversations with their customers, moderate comments, publish content and measure results from a single inbox (ENOVA Conecta), through Meta's official APIs.

With respect to the data of each company's customers, ENOVA acts as a data processor (Uruguayan Law 18,331): the company that connects its accounts is the controller of that database, and ENOVA processes the data only to provide the service to it.

Data we collect

How we use the data

The data we collect is used exclusively to:

• Route messages to the corresponding business customer
• Keep the message history for audit and support purposes
• Guarantee event idempotency (avoid duplicates)
• Show Messenger and Instagram conversations only to the authorized people of the company that owns the Page, so that they can read and reply to them from the ENOVA panel
• Send the replies written by that person; outside the 24-hour window we only reply with Meta's Human Agent tag (up to 7 days) and only when the reply is written by a person, never automatically
• Show the company's authorized people the comments and mentions of their Page and Instagram account, so that they can view, reply to, hide and delete them. They can also reply privately: a private reply turns a comment into a direct message to the person who wrote it
• Publishing content: the company can create, schedule and publish posts, carousels, reels and stories on its Instagram account, and posts on its Facebook Page. The files it uploads are stored on ENOVA servers in Uruguay and are delivered to Meta through short-lived signed links, solely in order to publish
• Metrics: we use them only to show the company its dashboards and its monthly report, and we cache them for at most 24 hours
• Conversion events: when the company marks a conversation as Lead or Purchase, ENOVA sends that event (Page identifier, identifier of the person on the Page, event name, value and currency) to Meta's Conversions API to measure its advertising, on the company's behalf. No other personal data is added

We do not share, sell or transfer data to third parties for commercial or advertising purposes.

Legal basis for processing

Data is processed under the following legal bases:

• Performance of a contract: to provide the service contracted by the customer company.
• Consent: the customer authorizes access to its WABA through Meta's official Embedded Signup flow, and to its Facebook Pages and Instagram accounts through Facebook Login, choosing which Pages it connects. It can disconnect them at any time from the panel.
• Legitimate interest: to ensure the security and proper operation of the service.

Data retention

• Messages and attachments (WhatsApp, Messenger and Instagram): kept for 12 months from their date and then deleted automatically, together with the files.
• Comments and mentions on Facebook and Instagram: kept for 12 months from their date and then deleted automatically. The company is responsible for that data and ENOVA processes it as a processor.
• Files uploaded for publishing: up to 90 days after publication or after the draft is deleted.
• Metrics: cache of up to 24 hours.
• Raw Meta webhook events: 30 days (90 days for those that failed to process), only for support and retries.
• Page access tokens: deleted at the moment the company disconnects the Page or the Instagram account.
• When an account is unlinked, or at the request of the data subject or of Meta (data deletion callback), the data is deleted within 30 business days.

Unsent messages and deletion from the inbox

• Unsent Instagram messages: when a customer unsends an Instagram message, ENOVA Conecta deletes its text and its attachments from our servers.
• Deletion from the inbox: an administrator of the partner company can delete a message or an entire conversation from ENOVA's servers. That deletion does not remove it from Instagram or Messenger.

Meta permissions we use

We ask Meta only for the permissions the service needs, and only on the Pages and accounts the company chooses to connect:

• instagram_manage_comments and pages_read_user_content: read and moderate comments and mentions
• pages_manage_engagement: reply to, hide and delete Page comments
• instagram_content_publish and pages_manage_posts: publish content
• instagram_manage_insights and read_insights: metrics of the company's own account and Page
• page_events: send conversion events to the Conversions API

Service providers and processors

ENOVA hosts everything described in this policy on its own servers in Uruguay. There is a single external provider in the data path:

• Cloudflare, Inc. (United States): provides the network, the CDN and the tunnel through which traffic reaches our servers. The connection uses TLS, which is terminated at Cloudflare's edge. Cloudflare processes the data in transit and does not store it.

Everything else is hosted on ENOVA's own servers in Uruguay. We do not sell data.

Security

• All communications use HTTPS/TLS
• Access tokens are stored encrypted in the database
• Each company's data is isolated in the database (row-level security): one company cannot see another's conversations
• Without the corresponding permission, phone numbers are shown masked
• Access to the system is restricted by OAuth 2.0 authentication
• The infrastructure runs on an OKD (Kubernetes) cluster with private networks

Your rights

As a data subject you have the right to request access, rectification, deletion and portability of your data. To exercise these rights, contact us at the address given below. If you wrote to a company through Messenger, Instagram or WhatsApp, you can also contact that company, which is the controller of the database. You can also request deletion from the data deletion page.