Last updated: August 8, 2026
Voluble is an AI messaging assistant operated by CREWINABOX SOFTWARE DEVELOPMENT SERVICES ("Voluble", "we", "us", "our"), a business registered in the Philippines under DTI Business Name No. 8408202, with business address at 24 A Santiago, Sipac - Almacen, Navotas City, 1409.
This Privacy Policy explains what personal data we process, why we process it, the categories of parties that may receive it, how long we keep it, and how you can exercise your rights. It applies to the Voluble software application (Meta App ID 1875157930109591), our website at https://www.voluble.ph, and related services (the "Service").
For data deletion instructions, visit https://www.voluble.ph/data-deletion.
1. Who this policy applies to
Voluble serves two groups, and our privacy role differs for each:
- Client Businesses. These are businesses and authorized staff who use Voluble. For account, billing, support, and service-administration data, Voluble acts as the Personal Information Controller.
- End Consumers. These are people who message a Client Business through Facebook Messenger or Instagram. For conversation data processed to provide replies for that business, Voluble generally acts as a Personal Information Processor on behalf of the Client Business, which acts as the Personal Information Controller.
If you are an End Consumer, you may contact either Voluble or the business you messaged about access, correction, or deletion of your conversation data. We will coordinate with the Client Business where appropriate.
2. Personal data we process
2.1 Client Business data
| Category | Examples |
|---|---|
| Identity and contact | Owner or staff name, email address, mobile number |
| Business information | Business name, business details, connected Facebook Page or Instagram account identifiers |
| Account and security | Login email, securely hashed password, session and authentication information |
| Billing and records | Billing details, invoice history, payment status, tax-related records |
| Knowledge and configuration | Price lists, FAQs, product or service information, AI persona/tone settings, escalation settings |
| Support communications | Emails and messages sent to our support team |
2.2 End Consumer conversation data
| Category | Examples |
|---|---|
| Meta profile and platform identifiers | Name, profile picture where made available by Meta, and Page-scoped or similar platform identifiers |
| Message content | Messages sent to the Client Business and replies generated or sent through the Service |
| Attachments | Photos or documents sent in a conversation |
| Conversation records | Conversation history, timestamps, delivery/status information, and handoff status |
2.3 Technical data
| Category | Examples |
|---|---|
| Device and connection | IP address, browser type, device type, operating system |
| Service and security logs | API requests, error logs, timestamps, security and abuse-prevention events |
| Cookies and sessions | Session identifiers and other data needed to keep authorized users signed in |
We do not request access from Meta to data that is not needed for the messaging and account-connection features we provide.
3. Why we process personal data
| Purpose | Who it affects | Basis / role |
|---|---|---|
| Provide and administer Voluble accounts | Client Businesses | Performance of our service agreement and legitimate business interests |
| Receive and answer Messenger or Instagram conversations | End Consumers | Processing on the documented instructions of the Client Business; the Client Business is responsible for establishing the applicable lawful basis |
| Use business-provided knowledge to generate relevant replies | Both | Providing the Service and legitimate business interests |
| Provide human handoff, support, security, and abuse prevention | Both | Providing the Service, legitimate business interests, and applicable legal obligations |
| Billing, accounting, and tax compliance | Client Businesses | Contractual and legal obligations |
| Service analytics and improvement | Both | Aggregated or de-identified information where reasonably possible; we do not use End Consumer message content for unrelated commercial purposes |
| Comply with law and lawful requests | Both | Legal obligation or other lawful basis |
Voluble uses automated systems to generate customer-service replies. We do not use End Consumer conversation data to make decisions that produce legal or similarly significant effects about the End Consumer.
4. Service providers and recipients
We use trusted service providers to operate Voluble. Depending on the service involved, personal data may be disclosed to the following categories of recipients:
- Meta Platforms and related Meta services, to connect accounts and receive or deliver Facebook Messenger and Instagram messages.
- Cloud hosting, database, storage, and file-processing providers, to host the Service and store information needed to operate it.
- Artificial intelligence and related processing providers, to generate replies and retrieve relevant information from Client Business knowledge materials.
- Communications, monitoring, security, support, and professional-service providers, where needed to operate, protect, or support the Service.
- Government authorities, regulators, courts, or advisers when disclosure is required or permitted by law.
We require service providers that process personal data on our behalf to handle it only for authorized purposes and subject to appropriate confidentiality, privacy, security, and data-processing obligations. We do not sell or license personal data or Meta Platform Data.
Where applicable law requires additional information about a recipient or processor, you may request it using the contact details in Section 14.
5. Processing outside the Philippines
Some service providers may process or store personal data outside the Philippines. When personal data is processed internationally, we remain accountable for it and use appropriate contractual, organizational, and technical safeguards consistent with applicable Philippine data-protection requirements.
6. Use of AI and business content
Voluble uses artificial intelligence to generate replies and to retrieve relevant information from materials provided by a Client Business. End Consumer message content and Client Business knowledge files are processed only as needed to provide the Service, maintain security, and meet legal obligations.
We do not authorize our service providers to use End Consumer message content or Client Business knowledge files to train their general-purpose AI models. We may use aggregated or de-identified service information, such as conversation counts or response-time statistics, to monitor and improve Voluble.
7. Facebook and Instagram integration
Voluble connects to Facebook Pages and Instagram accounts through Meta-supported tools and APIs. When an End Consumer messages a connected account, Meta may provide Voluble with the information needed to deliver the conversation, such as the consumer's name and profile picture where available, a platform identifier, message content, and attachments.
Voluble uses this information to provide messaging functionality for the Client Business. A Client Business can stop future processing by disconnecting the relevant Facebook Page or Instagram account from Voluble or by removing the Voluble integration through its Meta settings.
We keep each Client Business's data logically separated from other clients' data.
8. How we protect personal data
We use reasonable and appropriate organizational, physical, and technical safeguards designed to protect personal data. These include encryption in transit and at rest where appropriate, access controls, secure credential handling, logging and monitoring, least-privilege access, and controls intended to prevent abuse and unauthorized access.
No system can be guaranteed completely secure. We review our security practices and respond to suspected incidents in accordance with applicable requirements.
9. Data retention
We keep personal data only for as long as needed for the purposes described in this policy, as directed by a Client Business where Voluble acts as a processor, or as required by law.
| Data category | Retention approach |
|---|---|
| Client Business account data | For the life of the account, then deleted within 30 days after account closure, except records that must be retained by law |
| Billing and tax records | For the period required by applicable Philippine tax and accounting laws |
| End Consumer conversations and attachments | For the retention period set by the Client Business, then deleted or de-identified in accordance with that instruction and applicable requirements |
| Client Business knowledge files | Until deleted by the Client Business or the account is closed, subject to any lawful retention requirement |
| Technical and security logs | For a limited period reasonably necessary for security, troubleshooting, abuse prevention, and legal compliance, then deleted or de-identified |
10. Your rights under the Philippine Data Privacy Act
Subject to the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules, and other applicable NPC issuances, data subjects may have rights including:
- the right to be informed about the processing of personal data;
- the right to access personal data and relevant processing information;
- the right to object to certain processing;
- the right to correct inaccurate or incomplete personal data;
- the right to erasure or blocking where the legal requirements are met;
- the right to data portability where applicable;
- the right to claim damages where provided by law; and
- the right to file a complaint with the National Privacy Commission.
To exercise a privacy right, contact our Data Protection Officer using the details in Section 14. We may request reasonable information to verify identity and locate the relevant data. End Consumers may also contact the Client Business whose Page or account they messaged.
11. Children
Voluble is a business service and is not directed to children. Because Client Business social-media accounts may be accessible to the public, a minor may send a message to a Client Business. In that situation, Voluble processes the conversation on behalf of the Client Business. If you believe personal data relating to a child should be reviewed or deleted, contact us or the relevant Client Business.
12. Data deletion
You may request deletion of personal data. Full instructions are available at https://www.voluble.ph/data-deletion.
You may also email support@voluble.phwith the subject line "Data Deletion Request". We may ask for information reasonably necessary to verify the request and locate the relevant account or conversation. Verified requests will be handled in accordance with applicable law and our documented deletion process.
Meta also requires apps that access user data to provide a way for users to request deletion. Removing the Voluble integration through applicable Meta settings may also trigger or support the deletion process for associated Meta data.
13. Personal data breaches and policy changes
If a personal data breach occurs, we will assess and handle it in accordance with applicable Philippine data-breach notification requirements. Where Voluble acts as a processor, we will notify the affected Client Business as required so that it can meet its obligations as controller.
We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date and, where appropriate, by notifying Client Businesses.
14. Contact us and our Data Protection Officer
- Privacy / general inquiries: support@voluble.ph
- Data Protection Officer: Kweyd Gonzales - kweyd.gonzales@voluble.ph
- Postal address: CREWINABOX SOFTWARE DEVELOPMENT SERVICES, 24 A Santiago, Sipac - Almacen, Navotas City, 1409, Philippines
You may also contact the Philippine National Privacy Commission through its official channels if you believe your data-privacy rights have been violated.