Your WhatsApp chats go to your CRM. Not to us.
Who can read the chats, where they're stored and what happens to personal conversations: plain answers for your team, IT and legal.
ConvoSync reads WhatsApp Web on the user's own laptop, only for contacts already in your CRM or ATS. Personal chats are never read, and every save is reviewed first. Chats go to your CRM or ATS, and to your chosen AI provider if summaries are on, never to ConvoSync's servers. Admins see who syncs, not what was said.
Six things that are true about ConvoSync and your data
No chat storage on our servers
Conversations are saved to your own CRM or ATS, under your existing access rules and data policies. We hold only user accounts, settings and sync logs.
Personal chats are never read
Only conversations with contacts already in your system and assigned to that user are read, matched by phone number. Family, friends and anyone else are skipped.
Nothing saves without a person approving it
Every summary is shown to the user first. They can edit it, regenerate it or discard it. Syncing happens when the user clicks, not silently in the background.
Your AI account, or no AI at all
Summaries run on your own ChatGPT (OpenAI), Gemini or OpenRouter account, so your agreement with that provider applies. Prefer no AI? Switch it off and save the conversation only.
Keys stay in the browser
API keys and personal settings are stored in the user's Chrome browser. ConvoSync uses a sign-in server only to keep your CRM connection active.
No selling, no advertising
We don't sell your data, use it for advertising, or share it with third parties beyond the AI provider you choose.
Where each piece of WhatsApp data goes
The question IT and legal teams ask first. Here is every kind of data ConvoSync touches, where it ends up and who can see it.
| Data | Where it goes | Who can see it |
|---|---|---|
| Chats with business contacts in your system | Your CRM or ATS: an AI summary plus the full conversation as a Markdown (.md) file on the matching record | People with access to that record in your CRM or ATS, under the permissions you already set |
| Chat text used for the AI summary | The AI provider account you choose (OpenAI, Gemini or OpenRouter), only if AI summaries are on | Covered by your own agreement with that provider |
| Personal chats and anyone not in your system | Nowhere. They are never read | Nobody |
| Images, documents and voice notes | Not captured as standard. Can be added as a custom option | Only if you set it up |
| API keys and personal settings | The user's Chrome browser | That user, on that laptop |
| CRM sign-in connection | A ConvoSync sign-in server, used only to keep your CRM connection active | Not shown to anyone |
| User accounts, team settings and sync logs | ConvoSync's servers | Your admins, in the admin console. Sync logs show who synced and when, not what was said |
ConvoSync staff never see chat content, because it doesn't pass through our servers.
What happens to a WhatsApp conversation when it's synced
The safeguards built into every sync:
- Runs on the user's own laptop, next to WhatsApp Web, with Chrome open. Nothing is installed on phones.
- Filters before it reads. A chat is only read if its phone number matches a contact assigned to that user.
- A person approves every save. No summary reaches a record unseen.
- One destination you already trust: your own CRM or ATS, with its own security and access controls.
The user clicks sync
One chat, or a bulk sync of their assigned contacts, from the ConvoSync extension in Chrome.
Matched against your CRM or ATS
Only numbers that belong to contacts already in your system and assigned to that user are read. Everything else is skipped.
Summarised by your AI provider, if on
The chat text goes to your own OpenAI, Gemini or OpenRouter account. With AI off, this step is skipped.
The user reviews it
Edit, regenerate or discard. Nothing is saved without approval.
Saved to the record
The summary and the full conversation land on the record in your CRM or ATS. ConvoSync logs that a sync happened, not what was in it.
What admins can and can't see
Staff often worry that a WhatsApp CRM tool means their manager can read their phone. It doesn't.
Admins can
- Invite, disable or remove users
- See who synced today, who hasn't for several days and who has never synced
- See each person's sync history
- Manage the company's AI and integration keys
- Read synced conversations in the CRM or ATS, only where your CRM already lets them see that record
Admins can't
- Read chat content in the ConvoSync admin console
- See personal chats, which are never read in the first place
- See chats with contacts who aren't in your CRM or ATS
- Sync someone else's WhatsApp. Each user syncs their own
- See other companies' data. Everything is isolated to your company account
Using WhatsApp for work under GDPR: what to check
Client chats on staff WhatsApp are personal data either way. Saving them to your CRM puts them under the same rules as your other client records.
This is practical guidance, not legal advice. Talk to your data protection lead about your own situation.
- Privacy notice. Make sure it mentions WhatsApp as a way you communicate with clients, candidates or customers.
- Reason for keeping it. Record why you keep conversation records, for example to manage the client relationship or a contract.
- AI provider. Decide whether to use AI summaries, which provider, and check its data terms. Or switch AI off.
- Retention. Set how long records are kept in your CRM or ATS. Synced conversations follow those rules.
- Access requests. When someone asks for their data, synced conversations are on their record in one place, not spread across phones.
- Staff guidance. Tell your team which WhatsApp chats are synced and that personal chats are never read.
Need to run ConvoSync past IT or security?
Here's the short version to forward. Send us your security questionnaire and we'll answer it.
What gets installed
A Chrome extension on each user's Windows or Mac laptop, plus web access to the admin console. Nothing on phones, and no change to anyone's WhatsApp number.
What it connects to
WhatsApp Web in the same browser, your CRM or ATS (Zoho CRM, Zoho Recruit or Bullhorn, or a custom integration), and your chosen AI provider if summaries are on.
What it doesn't do
It doesn't send WhatsApp messages, run campaigns, use the WhatsApp Business API or store chat content on ConvoSync's servers.
WhatsApp data security and privacy: common questions
Is it safe to connect WhatsApp to a CRM?
It depends on where the conversations go on the way. With ConvoSync, chat text goes from WhatsApp Web on the user's laptop to your own CRM or ATS, and to the AI provider you choose if AI summaries are on. It isn't stored on ConvoSync's servers. Only conversations with contacts already in your system are read, and every save is reviewed by the user first.
Does ConvoSync store our WhatsApp conversations?
No. Conversations are saved to your CRM or ATS, not to us. ConvoSync's servers hold only user accounts, settings and sync logs. If AI summaries are on, chat text is sent to the AI provider account you choose to write the summary.
Does the ConvoSync Chrome extension read all of my WhatsApp chats?
No. It only reads conversations with contacts that already exist in your CRM or ATS and are assigned to you, matched by phone number. Chats with family, friends or anyone not in your system are never read.
Can my employer read my personal WhatsApp chats through ConvoSync?
No. Personal chats are never read, so they never reach the CRM or the admin console. The admin console shows users, sync status and sync logs, not chat content.
Does ConvoSync break WhatsApp's end-to-end encryption?
No. WhatsApp encrypts messages while they travel between phones. WhatsApp Web shows them decrypted on your own laptop, as it does for anyone using it. ConvoSync reads the conversation from there, on the same laptop, when the user syncs it. Once saved, the conversation is protected by your CRM or ATS's own security and access rules.
Does the AI provider use our conversations to train its models?
ConvoSync uses your own ChatGPT (OpenAI), Gemini or OpenRouter account, so your agreement with that provider applies. Many business and API plans don't use your data for training by default, but check the current terms and settings for your account. If you'd rather not send chats to any AI provider, switch summaries off.
Can we use ConvoSync without AI?
Yes. Switch AI summaries off and ConvoSync saves the full conversation only, without sending chat text to any AI provider.
What happens to our data if we stop using ConvoSync?
Everything already synced stays on the records in your CRM or ATS, because it was always saved there. Removing the extension stops any further capture. Contact us about closing your user accounts and sync logs.
Is ConvoSync GDPR compliant?
GDPR compliance depends on how your business uses WhatsApp and your CRM, not only on the tools. ConvoSync helps by keeping conversations in your own system, reading only business contacts, and letting you choose or switch off the AI provider. You should still check that your privacy notice covers WhatsApp and decide your retention rules in your CRM. This isn't legal advice.
Have a security questionnaire? Send it over.
Email us your questions, or book a 20-minute call.
Or email [email protected] · call +91 97170 87420 · WhatsApp us