Privacy policy

Effective 25 September 2026

Who we are

Propozel Convo is operated by Propozel, Vietnam. It is the conversational layer over Google Forms at convo.propozel.com. Questions about this policy go to hello@propozel.com.

What we store when you create a Convo

When you paste a public form link, we read the public structure of that form (title, description, question text, options, sections and their routing, and whether a question is required) from its public page and store it so the Convo can render. We also store the edits you make in the editor: the host persona, the moment text, the format, theme and brand accent, hidden questions, and any brand text or URL you provide for the AI moments. Brand text is kept private: it is never sent to respondents' browsers. A Convo made without signing in gets a random admin token that acts as the private edit link. A Convo made while signed in belongs to a workspace: your personal one, or a team's.

Your account and workspaces

Sign-in is handled by Supabase Auth in the same project that powers propozel.com, so a Convo login is your Propozel account. We hold your email address. If you sign in with Google, Microsoft or your company's single sign-on, that provider also gives us your name and, for Google, an avatar URL. For each workspace we store its name, its plan and allowance, its settings (such as allowed email domains and whether approvals are on), and its members' email addresses and roles. Invites store the invited email, the role and a hash of the invite link. No payment details: paid plans are bought on propozel.com/billing, and Convo never sees a card.

Cookies

We set the Supabase session cookies (names starting with sb-) needed to keep you signed in. On a Convo that is running an A/B test, respondents also get a convo_ab cookie for 30 days. It holds a random number from 0 to 99 that picks the version they see and identifies no one. We do not use analytics or advertising cookies.

Answers from respondents

When someone answers a Convo, their answers are sent to our edge endpoint and relayed in the same request to the form's own response endpoint, so they land in the form owner's responses (for a Google Form, their Sheet) exactly as a native submission would. On a form with sections, only the answers on the path the respondent took are sent. We do not store the answers. For each submission we keep one log row: the time, the outcome and the status code the form service returned, the browser user agent, and a keyed hash of the IP address. The hash key changes every day and each use has its own key (the submission log, the audit log, conversation limits and voice-clone consent), so hashes cannot be joined across tables or days. We never include IP hashes in any export. We also count responses per Convo per month.

If you answered a Convo and want your answers corrected or deleted, contact the person who runs the form. They hold the answers; we do not.

Webhooks

A form owner on a paid plan can add a webhook. After the form service accepts a response, we send the answers on the respondent's path to the owner's own HTTPS address, signed with a secret we share with the owner. We do not store those answers. We log each delivery's time, status and duration, and delete log entries older than 30 days in our regular clean-up.

AI features

Google Gemini writes the welcome, midway and thank-you lines and suggests conversational wording for questions. For that we send the form's title, description and question text, plus any brand text or URL content the form owner supplied, to Gemini, optionally through Cloudflare AI Gateway. The lines are saved with the Convo, so they are not regenerated for every visitor.

Brand voice training (on a Professional engagement): brand guidelines a form owner uploads are sent to Gemini to distil a voice profile. We store only the distilled profile, which the owner can edit, not the file. Brand safety (Partner): the facts sheet, banned phrases and competitor names an owner enters are stored privately and sent to Gemini when lines are checked.

Two-way conversation (on a Professional engagement), only on Convos where the owner turned it on: a respondent's answer to an open question, or a question they ask back, is sent to Gemini to write one short reply. Neither is stored by us, and any Cloudflare AI Gateway we route through has request logging off. We count turns per session by question id, with a keyed IP hash to limit abuse. Otherwise respondents' answers are never sent to Gemini.

Voice

Voice mode uses the browser's own speech engine to read questions aloud and to turn spoken answers into text. Some browsers send that audio to their maker (for example Google or Apple) to recognise it; that is governed by the browser maker's policy. Studio voice (on a Professional engagement) sends the text to be spoken to Gemini text-to-speech: the form's own text and, with two-way conversation, the host's replies. Clips of the form's text are stored and reused; spoken replies are made on the fly and never stored. Brand voice cloning (on a Professional engagement, set up with us) uses ElevenLabs: the voice samples a form owner uploads with the speaker's consent are forwarded to ElevenLabs once and not stored by us. We keep the ElevenLabs voice id, the consent version, the time and a keyed IP hash. A Convo speaking in a cloned voice sends the same text to ElevenLabs instead of Gemini, with clips stored and replies not, as above. After the voice is deleted in Convo, our regular clean-up deletes it at ElevenLabs.

A/B tests

On a Convo running a test we count, per version, views, first answers and submissions. These are totals only: there are no rows per visitor. Deleting a Convo deletes its tests.

Custom domains

When a workspace connects its own domain, we store the hostname and a verification token, and Cloudflare issues the certificate and serves the domain.

Audit log

We record changes made in Convo (for example an edit, an invite or a plan change): who made it (account id and email), what changed and when, a keyed IP hash and the browser user agent. Owners and admins of a Firm or Partner workspace can view and export its log; exports never include IP hashes or user agents. We keep audit rows for 24 months.

Sub-processors

Cloudflare (hosting, edge delivery, AI Gateway, custom-domain certificates), Supabase (database, authentication, audio storage), and Google (Forms, Gemini including text-to-speech, Sign in with Google). Where a feature is used: ElevenLabs (brand voice clones and their speech) and Microsoft (Microsoft Forms, Microsoft sign-in). Each processes data only as needed to run the service.

Where data is stored

Stored data lives in one Supabase project, shared with propozel.com, in a single region. Cloudflare serves pages and handles requests in the data centre nearest the visitor. A dedicated regional deployment is available under a Partner agreement.

What we do not do

We do not sell personal data, share it for advertising, or build profiles from it. Convos carry no ads or sponsored content.

Form owners

Anyone can make a Convo of a public form. If one was made of your form without your permission, write to hello@propozel.com and we will remove it.

Retention and deletion

A Convo stays until you delete it. You can delete any Convo you own from Your Convos or from its editor; deleting removes the stored form structure, your edits, saved moments, brand kit, A/B tests, webhook and delivery log, and the submission log rows, and our regular clean-up then removes its stored voice clips. Deleting a Convo does not touch the responses already in your Google Sheet. To delete your Propozel account, email hello@propozel.com from the account address; deleting the account also deletes your personal workspace and the Convos in it. Convos in a team workspace belong to the team and stay with it. Audit rows are kept for the period above.

Changes

If this policy changes we will update the effective date above. Material changes will be noted on the landing page.