Privacy Policy

How Vista Konnect collects, uses, and protects your data. Compliant with GDPR, CCPA, India's DPDP Act, 2023, and Saudi Arabia's PDPL.

Last updated: September 19, 2026

Overview

Vista Konnect operates the vistakonnect.com website, which provides our services. This policy informs visitors about our policies regarding the collection, use, and disclosure of Personal Information.

What information do we collect?

We collect personal information that you provide to us, such as name, contact information, email address, and any other information you choose to provide. We may also collect information about how you interact with our website and services.

How do we use your information?

We process your information for purposes based on legitimate business interests, fulfillment of our contract with you, compliance with our legal obligations, and your consent. We use your personal information for:

  • Providing, maintaining, and improving our services.
  • Sending you marketing and promotional communications.
  • Responding to your comments, questions, and requests.
  • Fulfilling orders and providing customer support.

Will your information be shared with anyone?

We only share information with your consent, to comply with laws, to provide you with services, to protect your rights, or to fulfill business obligations. We may share your information with third-party service providers who perform services on our behalf.

Do we use cookies and other tracking technologies?

We may use cookies and similar tracking technologies to track activity on our website and hold certain information. You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent.

How long do we keep your information?

We will only keep your personal information for as long as it is necessary for purposes set out in this privacy policy, unless a longer retention period is required or permitted by law.

What are your privacy rights?

You may review, change, or terminate your account at any time. You have the right to access, update, or delete your personal information. You can also object to our processing of your personal information.

Your rights under the GDPR (EU/UK)

If you are in the European Economic Area or the United Kingdom, the General Data Protection Regulation (GDPR) gives you the right to access, rectify, erase, restrict, or object to the processing of your personal data, and the right to data portability. Where we rely on your consent, you may withdraw it at any time. To exercise these rights, contact privacy@vistakonnect.com. You also have the right to lodge a complaint with your local data protection supervisory authority.

Your rights under the CCPA (California)

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the CPRA, gives you the right to know what personal information we collect and how we use and disclose it; to access, delete, and correct your personal information; to opt out of the "sale" or "sharing" of personal information; to limit the use of sensitive personal information; and to not be discriminated against for exercising these rights. We do not sell your personal information. To exercise any of these rights, contact privacy@vistakonnect.com.

Your rights under PIPEDA (Canada)

If you are in Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA) gives you the right to access the personal information we hold about you and to request corrections. We collect, use, and disclose personal information with your consent and for purposes a reasonable person would consider appropriate. To exercise these rights or raise a concern, contact privacy@vistakonnect.com; you may also contact the Office of the Privacy Commissioner of Canada.

Your rights under India's DPDP Act, 2023

If you are in India, the Digital Personal Data Protection Act, 2023 ("DPDP Act") applies to your personal data. As a Data Fiduciary, we process personal data only for lawful purposes, based on your consent or other legitimate uses permitted by the Act. As a Data Principal, you have the right to access information about the personal data we hold, to seek its correction or erasure, to grievance redressal, and to nominate another individual to exercise your rights in the event of death or incapacity. To exercise these rights or raise a grievance, contact our Grievance Officer at privacy@vistakonnect.com; we respond within the timelines prescribed by the Act. Unresolved grievances may be escalated to the Data Protection Board of India.

Your rights under Saudi Arabia's PDPL

If you are in the Kingdom of Saudi Arabia, the Personal Data Protection Law (PDPL) and its implementing regulations apply to your personal data. As a data controller, we process personal data on a lawful basis, typically your consent, performance of a contract, or another basis permitted by the PDPL. You have the right to be informed about how your data is collected and used, to access your personal data, to request its correction, and to request its destruction where permitted by law. To exercise these rights, contact privacy@vistakonnect.com. You may also lodge a complaint with the competent authority, the Saudi Data & AI Authority (SDAIA).

Children's data

Our services are intended for users aged 18 and over and are not directed at children. Where the DPDP Act or other applicable law requires it, we obtain verifiable consent from a parent or lawful guardian before processing a child’s personal data, and we do not carry out tracking, behavioural monitoring, or targeted advertising directed at children.

Service Providers

We may employ third-party companies and individuals for the following reasons:

  • To facilitate our Service;
  • To provide Service on our behalf;
  • To perform Service-related services; or
  • To assist us in analyzing how our Service is used.

We want to inform our Service users that these third parties have access to your Personal Information. The reason is to perform the tasks assigned to them on our behalf. However, they are obligated not to disclose or use the information for any other purpose.

Data security

We have implemented appropriate technical and organizational security measures designed to protect the security of any personal information we process. We value your trust in providing us your Personal Information, thus we are striving to use commercially acceptable means of protecting it. But remember that no method of transmission over the internet, or method of electronic storage is 100% secure and reliable, and we cannot guarantee its absolute security.

Links to Other Sites

Our Service may contain links to other sites. If you click on a third-party link, you will be directed to that site. Note that these external sites are not operated by us. Therefore, we strongly advise you to review the Privacy Policy of these websites. We have no control over, and assume no responsibility for the content, privacy policies, or practices of any third-party sites or services.

Messaging integrations on Meta platforms (Instagram, WhatsApp, Messenger)

Some clients connect their own Instagram, WhatsApp Business, or Messenger business accounts to our automation so they can reply to people who message them. When a client authorizes that connection, we process on the client's behalf the messages (text and media) that people send to the client's business account, together with the sender identifier, basic profile details, and timestamp that Meta's official messaging APIs deliver with each message (Instagram Messaging with the instagram_manage_messages permission, the WhatsApp Business API, and the Messenger Platform). We use this information only to run the reply workflows the client has set up. It is stored encrypted, isolated per client with row-level security, and transmitted over TLS. We do not sell it, and we do not share it except with Meta and the sub-processors listed below. When a connection is revoked we confirm the request within 24 hours and delete the stored records within 30 days.

SaaS Multi-Tenant Processing

We process client data via a multi-tenant platform. Isolation: Supabase RLS / multi-schema. Sub-processors are listed below; clients authorize via DPA.

Third-Party Processors and Sub-Processors

Updated: June 24, 2026. Changes: 30-day client notice. To object: privacy@vistakonnect.com. DPAs available on request.

  • Automation: HighLevel, Zapier, n8n (Workflow Orchestration; EU/US; DPA, SCCs)
  • AI/LLM: OpenAI (GPT-4), Google (Gemini), Anthropic (Claude) (Intelligence & Generation; US; DPA)
  • Voice/Video: ElevenLabs, Synthesia, HeyGen (Synthetic Media; US/EU; DPA)
  • CRM: HubSpot, Salesforce (Customer Relationship Management; US/EU; DPA, SCCs)
  • Payments: Stripe (Billing & Subscriptions; US/EU; PCI-DSS, DPA)
  • Data & Storage: Supabase (Postgres), Vercel (Data Hosting & Isolation; EU/US; SOC2, RLS)
  • Infrastructure: Cloudflare, Amazon Web Services (Security, CDN, Hosting; Global; SOC2, DPA)
  • Analytics: Google Analytics, PostHog (Usage Insights & Analytics; US/EU; DPA)

User Rights and Deletion

Request via privacy@vistakonnect.com or through the connected platforms. When you revoke a connected app we confirm the request within 24 hours and delete the associated records within 30 days. Compliant with PIPEDA (Canada), GDPR (EU), CCPA (California), the DPDP Act, 2023 (India), and Saudi Arabia's PDPL.

Updates to this policy

We may update our privacy policy from time to time. The updated version will be indicated by an updated "Last updated" date.

Privacy Contact

Role: Privacy Officer / Grievance Officer (India). Email: privacy@vistakonnect.com. Handles DSARs (30 days), DPDP grievances, SaaS tenant requests, and sub-processor objections.