Privacy Policy - ShowCloud Convert

Last updated: 05 May 2026

Who we are

Angel 1 Sh.P.K. ("we", "us"), registered in Albania (NIPT L81317015B), operates ShowCloud, a SaaS platform for fitness centers, including the "Convert" module that powers chat-based lead capture on websites and WhatsApp.

For privacy matters, contact: privacy@angel1.tech

Our role

ShowCloud Convert is sold to fitness centers ("Gyms"). The Gym is the data controller for visitor data collected through Convert. We are the data processor acting under the Gym's instructions, per a Data Processing Agreement signed at onboarding.

This page describes what data flows through our systems on the Gym's behalf.

Data we process

When a visitor chats with a Gym via Convert (web widget or WhatsApp), we process:

  • Identity: first name, last name (when provided)
  • Contact: email, phone number (when provided)
  • Conversation content: messages exchanged with the bot or staff
  • Behavioral: page URL where the chat started, UTM parameters, time of conversation, IP address (only briefly, for rate limiting)
  • Technical: visitor session ID stored locally in the visitor's browser
  • WhatsApp-specific (when applicable): WhatsApp ID (wa_id, the visitor's phone number in international format), message delivery status (sent / delivered / read), media files the visitor sends

We do not process: payment data, government IDs, health data, or location beyond city-level UTM, unless the visitor explicitly types it into the chat.

Why we process it

  • To answer the visitor's questions about the Gym's services
  • To capture the visitor as a lead for the Gym's CRM, when the visitor has confirmed they want to be contacted
  • To allow Gym staff to reply to visitors via WhatsApp or web chat
  • To improve the AI assistant's accuracy (only aggregated, anonymized metrics)
  • To prevent abuse of the platform (rate limiting, spam detection)

Legal basis (GDPR Art. 6)

  • Legitimate interest for operating the service and preventing abuse
  • Performance of a contract when the visitor explicitly requests a callback, booking, or membership inquiry
  • Consent for any further marketing communications (separate opt-in, not handled by Convert)

Who else sees the data

  • OpenAI (United States) - visitor messages are sent to OpenAI's API for the AI assistant's response. Bound by OpenAI's Data Processing Addendum and SCCs. Not used for OpenAI model training (we use the API with zero-data-retention configuration where supported).
  • Meta Platforms Ireland - when the channel is WhatsApp, Meta is the controller of message transport per Meta's WhatsApp Business Terms.
  • Twilio Inc. (United States) - when the Gym uses Twilio as their WhatsApp provider. Bound by Twilio's DPA and SCCs.
  • Hosting providers - our infrastructure runs on European data centers; details available on request.

We do not sell visitor data. We do not share visitor data with third parties beyond the sub-processors listed above.

Where data is stored

Conversations and visitor data are stored on the specific Gym's dedicated server instance, located in {{EU country / region}}. Each Gym has an isolated database. Backups are encrypted and retained 30 days.

How long we keep it

  • Conversation data: 24 months by default, configurable per Gym
  • Lead records exported to CRM: governed by the Gym's own retention policy
  • Technical logs: 30 days
  • Backups: 30 days

Your rights (GDPR)

You have the right to:

  • Access the data we hold about you
  • Correct or delete that data
  • Export your data in a machine-readable format
  • Object to or restrict processing
  • Withdraw consent at any time
  • Lodge a complaint with your local Data Protection Authority

To exercise any right, contact the Gym you spoke with first (they are the data controller). If the Gym is unreachable, contact us at privacy@angel1.tech and we will route the request.

Data deletion instructions

To request deletion of all your conversation data:

  1. Identify the Gym you chatted with
  2. Email privacy@angel1.tech with subject "Convert Data Deletion"
  3. Include the phone number and/or email address you used
  4. We confirm receipt within 72 hours and process deletion within 30 days

For WhatsApp specifically: you can also block the Gym's WhatsApp number on your device - this stops further messages but does not delete historical data.

You can also use our request form at /chat/data-deletion.

Cookies and local storage

The web widget stores a single convert_public_token value in the visitor's browser sessionStorage to keep the chat alive across page reloads. It is cleared when the browser tab closes. No tracking cookies, no third-party scripts.

Changes to this policy

We will post any changes here and update the "Last updated" date. For material changes affecting visitor rights, we notify the Gym, who is expected to surface the change to visitors in the chat.

Contact

Angel 1 Sh.P.K.
Rruga Brigada VIII, Pallati teknoprojekt, Tirane
privacy@angel1.tech