Privacy Policy – StrixVerse Inbox

This is an English translation provided for convenience. If there is any discrepancy, the Portuguese version prevails.

This policy explains how StrixVerse processes personal data in the StrixVerse Inbox service (https://inbox.strixverse.com): a single inbox for WhatsApp, Instagram, Messenger and website chat, with an artificial intelligence (AI) assistant that replies to customers and looks up orders in Shopify stores.

1. Who we are

StrixVerse – António Carlos Martins, sole trader (empresário em nome individual)
Tax number (NIF): 266097570
Address: Rua de Vilar, n.º 41, Coucieiro, Vila Verde, Braga, Portugal
Email: team@strixverse.com

2. Our role

• Customers of the service (stores and businesses that subscribe to StrixVerse Inbox): we are the controller of account, billing and business contact data.
• End customers of the stores (people who message a store through WhatsApp, Instagram, Messenger or website chat): we are a processor (Article 28 GDPR). We process this data only on behalf of, and according to the instructions of, the store, which is the controller. If you are an end customer, please first address requests about your data to the store you spoke to. You can also contact us and we will forward your request.

3. Data we process

End customers of the stores

• Contact identification: name, phone number, email, username and Instagram/Facebook identifiers, and profile picture when the platform makes it available.
• Conversation content: messages, images, audio, files and their dates.
• Shopify store order data (number, status, shipping, products), looked up only when the customer asks about an order and after confirming their email.
• Notes and "memories" about the contact created by the AI assistant or the store's agents (for example, preferences mentioned in the conversation).
• Website chat technical data: IP address, browser, source page and an identifier stored in the browser to keep the conversation going.

Customers of the service

• Name, email and role of users (agents and administrators).
• Billing data (name or business name, tax number, address, plan, payment history). Card details are handled only by Stripe and never reach us.
• Usage records (for example, the number of AI replies, to calculate credits).

4. What we use the data for

• Receiving, storing and showing messages to the store's team and allowing it to reply.
• Generating automatic AI replies from the information provided by the store (FAQs, documents, order data).
• Handing the conversation over to a member of the store's team when needed.
• Billing the service, calculating AI credits and providing support.
• Ensuring the security and proper operation of the service.

We do not sell personal data, use it for advertising or use it to train AI models.

5. Legal bases

• End customer data: processed on the store's instructions, under the data processing agreement. The store is responsible for having a valid legal basis (normally the performance of a contract or pre-contractual steps at the customer's request, or the legitimate interest in replying to those who contact it).
• Data of customers of the service: performance of the contract, compliance with legal obligations (billing and tax) and legitimate interest (security and abuse prevention).

6. Artificial intelligence assistant

Stores can enable an AI assistant that replies automatically. The assistant identifies itself as AI at the start of the conversation, as required by the EU AI Act (Article 50). Customers can ask to speak to a person at any time. AI replies may contain errors. Decisions with significant effects (such as refunds) are always made by the store's team.

7. Data from Meta platforms (WhatsApp, Instagram, Messenger)

Data received through Meta platforms is used only to provide the messaging service to the store that connected the account. We do not share it with third parties for their own purposes, sell it, or use it for advertising or profiling. We comply with the Meta Platform Terms and the WhatsApp Business policies.

8. Who we share data with

Transfers outside the European Economic Area rely on the EU-US Data Privacy Framework, where the entity is certified, or on standard contractual clauses approved by the European Commission. Under OpenAI's policy, data sent through the API is not used to train models and is kept for a maximum of 30 days for abuse detection.

Meta and Shopify are not processors of StrixVerse: they are platforms the store uses under its own contracts. They connect to StrixVerse Inbox through StrixVerse apps: one for Instagram and Messenger, one for WhatsApp and a custom app in each customer's Shopify store.

9. How long we keep data

• Conversations and contacts: while the store keeps the service active, or until the store or the end customer requests deletion.
• After the contract with the store ends: the store may request an export of conversations and contacts for 30 days. After that period, we delete the data.
• Backups: replaced automatically and deleted within a maximum of 30 days.
• Billing data: 10 years, as required by tax law.

10. Security

The service is accessed over an encrypted connection (HTTPS). Two-factor authentication is available and sensitive application data is encrypted. Each team's access is limited to its own account, and we make regular backups.

11. Your rights

You can request access, rectification, erasure, restriction or portability of your data, or object to its processing, by writing to team@strixverse.com. If the data was processed on behalf of a store, we will forward the request to that store and help fulfil it. We reply within a maximum of 30 days.

You also have the right to lodge a complaint with the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD) – www.cnpd.pt.

12. Data deletion

Instructions for requesting data deletion, including data received through Facebook, Instagram or WhatsApp, are at: https://strixverse.com/en/inbox/data-deletion

13. Cookies and browser storage

The website chat stores a technical identifier in your browser, which is needed to keep the conversation going across pages and visits. We do not use advertising cookies in the chat.

14. Changes

We may update this policy. The date at the top indicates the version in force. If the changes are significant, we will notify customers of the service by email.