Privacy Policy

For your account data — you as a merchant or team member — we are the controller.

For the data of customers who message your store, your store is the controller. We process it on its behalf, according to its settings, and only to run the service.

• Account data: name, email address, organisation name and timezone. Passwords are stored as a one-way hash that cannot be reversed.
• Channel data: identifiers of connected WhatsApp and Meta accounts, and their access tokens, stored encrypted.
• What you add: knowledge base files, pages and text, the product catalog and stock, and your agent's instructions.
• Customer conversations: text and voice messages and images, the phone number or account identifier, the display name, and lead details the agent records.
• Usage data: session counts, processing volume, response times, and technical logs that do not contain message content.

• To run the service: generating the agent's replies, searching the knowledge base and catalog, and receiving and sending messages on your channels.
• To measure usage and bill for it.
• To protect the service and prevent abuse.
• To contact you about your account, such as password recovery and service alerts.

We do not sell data, we do not use your customers' conversations for advertising, and we do not use them to train AI models.

We rely on providers that process data on our behalf, and share with each only what it needs:

• Google (Gemini models): to understand text and voice messages and generate replies.
• Meta (WhatsApp, Messenger, Instagram): to receive and send messages.
• Hosting, storage and email providers, and a payment provider once payments are enabled.

These providers may process data in countries other than yours.

• Messages, sessions and customer contacts are deleted automatically 365 days after they were created.
• Account data is kept while the account exists and deleted after it is closed, except what the law requires us to keep, such as billing records.
• Backups are rotated and deleted after 30 days.

If you messaged a store that uses AURYXA and want your data deleted: ask the store directly. It can permanently delete your contact with all its conversations, messages and files from its inbox, using "Delete customer data". You can also email us at [Official contact email] with your phone number or account identifier and the store's name, and we will complete the deletion within 30 days.

If you are a merchant and want your account and all your organisation's data deleted: email us at [Official contact email] from the address registered on the account. You can export your data from the settings page first.

If you remove the connection to your Meta account in your Facebook settings, we stop using its access tokens, and you can ask for the rest of your data to be deleted the same way.

We use one essential cookie to keep you signed in, and cookies that remember your preferences such as language and theme. We use no advertising cookies and no third-party tracking.

We use encrypted connections, isolate each organisation's data at the database level, encrypt access tokens, and store passwords in a form that cannot be reversed. No system is perfectly secure; if an incident affects your data, we will tell you without undue delay.

You may access your data, correct it, ask for it to be deleted, object to its processing, and receive a copy of it. Email us at [Official contact email] and we will respond within 30 days.

The service is for businesses and is not intended for anyone under 18.

If we change this policy in a material way, we will tell you by email or in the dashboard before the change takes effect.

[Company legal name] — [Official contact email]