Privacy Policy

Who this policy covers

Invicta is used by businesses ("our clients") to manage conversations with their own customers. For data belonging to our clients' customers, our clients are the data controller and we act as their data processor. For our clients' own account information, we are the controller.

Information we handle

• Account information: name, business name, work email, phone number, and login credentials of users who sign in to Invicta.
• Contact records: names, phone numbers, email addresses, notes, pipeline stage and activity history that our client uploads or creates.
• Message content: SMS, WhatsApp, Facebook Messenger, Instagram Direct and email messages sent to or from our client's connected business accounts, together with the sender's platform-scoped ID, display name and profile picture where the platform provides them.
• Facebook and Instagram connection data: the list of Pages or professional accounts the connecting user administers, the selected Page or account ID and name, and the access tokens needed to receive and send messages.
• Call events: caller number, time and duration for missed calls forwarded to an Invicta number, so an automatic text reply can be sent. We do not record call audio.
• Billing information: handled by Stripe and GoCardless. We store only the reference IDs, mandate status and payment status. We never see or store full card or bank details.
• Technical logs: IP address, browser type and timestamps used for security and troubleshooting.

Why we handle it

• To deliver messages to the right business inbox and send their replies back.
• To show a single conversation history per customer across all connected channels.
• To send review requests, appointment and follow-up messages our client has set up.
• To send an automatic text reply when a customer's call is missed.
• To operate accounts, take subscription and setup payments, and provide support.
• To keep the service secure and prevent abuse.

Our legal bases are performance of a contract, our legitimate interest in running and securing the service, and consent where required for marketing messages.

How Facebook and Instagram data is used

When a business connects a Facebook Page or Instagram professional account, we request only the permissions needed to run a shared inbox: to list the Pages the user manages, to subscribe that Page to message notifications, and to read and send messages for that Page or account.

Message content and sender IDs received from Meta are stored solely so the business can read the conversation and reply from Invicta. We do not sell this data, use it for advertising, build advertising profiles from it, or share it with data brokers. When a Page or Instagram account is disconnected, we stop receiving messages, delete the stored access tokens immediately, and delete the associated message history within 30 days.

Who we share information with

We share data only with the service providers needed to run Invicta, each under a data processing agreement: Supabase (database and authentication hosting), Cloudflare (application hosting), Twilio (SMS, WhatsApp and voice), Meta Platforms (Messenger and Instagram messaging), Resend (transactional email), Google (AI-assisted reply drafting), Stripe and GoCardless (payments). We also disclose information where the law requires it.

Automated message drafting

Invicta can draft suggested replies using an AI model. Only the conversation text needed for the reply is sent to the model provider. It is not used to train public models.

Where data is stored

Data is stored on servers within the United Kingdom and European Union where possible. Where a provider processes data outside the UK or EEA, transfers are covered by UK International Data Transfer Agreements or Standard Contractual Clauses.

How long we keep it

• Message and conversation history: while the channel is connected, then 30 days.
• Contact records: while the client's account is active, then 90 days.
• Access tokens: deleted immediately when a channel is disconnected.
• Billing records: six years, as required by UK tax law.

Your rights

You may request access to your data, correction, deletion, restriction, portability, or object to processing. If you are an end customer of one of our clients, contact that business first; we will assist them promptly. Requests to us can be sent to support@invinciblemedia.co.uk and are answered within 30 days. You can also complain to the UK Information Commissioner's Office at ico.org.uk.

To remove data obtained through Facebook or Instagram, see our data deletion instructions.

Security

Access is protected by authenticated logins, per-account database isolation rules, encryption in transit, and encrypted storage of credentials and access tokens. Access by our staff is limited to what is needed for support.

Children

Invicta is a business tool and is not intended for anyone under 18.

Changes and contact

We will update this page if our practices change and revise the date above. Contact Invincible Media Ltd, Cardiff, United Kingdom — support@invinciblemedia.co.uk or +44 2921 680800.