Privacy Policy

1. Data Controller and Data Processor

MENDEZ GROWTH CONSULTING - FZCO
Building A1, Dubai Digital Park, Dubai Silicon Oasis, UAE
Contact: hi@plixana.com

This policy applies to the Plixana CRM service (“the Service”, plixana.com). Roles: for your account data (name, email, billing, usage records), Plixana acts as Data Controller. For the data of your organization's contacts and end users, your organization (the Customer) is the Controller and Plixana acts solely as Data Processor, under the Data Processing Agreement (DPA) published at plixana.com/legal/dpa.

2. Information We Collect

We distinguish two types of data, with different roles in each case:

(a) Account holder data (organizations that subscribe to Plixana) — Plixana is the Controller of this data:

• Name, email, phone number
• Organization data (business name, industry, country)
• Payment information processed by Stripe (we do not store card numbers)
• Service usage logs (processed messages, conversations, metrics)

(b) End-user data (people who message your connected channels) — your organization is the Controller of this data and Plixana processes it only as Processor:

• Name and phone number or platform username (WhatsApp, Instagram, etc.)
• Content of the messages exchanged with your organization
• Information the end user voluntarily shares (email, company)
• Metadata: timestamps, channel, detected language, conversation sentiment

3. How We Use the Information

We use the data to:

• Provide the CRM service and operate the AI agents that respond 24/7
• Process payments and subscriptions through Stripe
• Send transactional emails (welcome, invoice, technical alerts)
• Improve the Service through aggregated and anonymous analysis
• Comply with legal obligations (KYC, anti-fraud, accounting)

We do NOT sell or rent data to third parties for marketing purposes.

4. Legal Basis for Processing (GDPR)

• Performance of a contract (art. 6.1.b GDPR) to provide the Service.
• Legal obligation (art. 6.1.c) for tax retention and anti-fraud.
• Legitimate interest (art. 6.1.f) to improve the Service and prevent abuse.
• Consent (art. 6.1.a) for optional marketing communications.

5. Use of Artificial Intelligence

The Service uses third-party AI providers for automatic replies. Anthropic provides the main models, which write the replies and describe the images customers send. OpenAI and Groq are backup models: they write the reply when the main model fails or when the business chooses one of them for an agent. OpenAI also powers search in the business’s knowledge base and describes images when Anthropic fails; Groq also classifies each message, transcribes voice notes and powers helper features such as summaries. Cohere is used for product search by image (catalog photos and, when the business uses visual product matching, photos customers send on WhatsApp) and never receives the text of customer messages. Anthropic, OpenAI and Groq process the data under data processing terms (DPAs) that prohibit using it to train their models; Cohere processes the data it receives under its API terms.

End users can request human assistance at any time by writing “talk to a human” or similar phrases; the Service escalates automatically and stops generating AI responses.

6. Instagram and Messenger Data

When a business connects its Facebook Page or its Instagram professional account to Plixana through Meta’s login, Plixana receives data from the Meta Platform only so that business can answer its own customers. For this data the business is the Controller and Plixana acts as its Processor (see section 1).

Data we receive from Meta:

• About the business that connects: the ID and name of its Facebook Page and of its Instagram professional account (username and profile picture), and the access tokens Meta issues so Plixana can receive and send messages for that Page or account.
• About the people who message the business: the messages they send and their attachments (images, audio, files), the date and time of each message, and the ID that Meta assigns to them for that Page or account (page-scoped or Instagram-scoped ID). When Meta makes it available, also their public name or Instagram username.
• The replies sent to those people by the business, by its team or by its AI agents.

What we use it for:

• To show the conversations in the business’s Plixana inbox so its team can read and reply to them from one place.
• To let the business’s AI agents (PlixCore) answer customer questions with the business’s own information. The customer can ask to talk to a person at any time (section 5).
• To keep the conversation history and the contact record in the business’s CRM, so the business has context in later conversations.

We do not sell Meta Platform data, we do not use it for advertising, and we do not share it with any business other than the one the conversation belongs to.

AI processing: To generate automatic replies, the conversation text is processed only by Anthropic, OpenAI and Groq (described in sections 5 and 7; Groq also transcribes voice notes; Anthropic, or OpenAI as backup, describes images), only to produce the reply and under data processing terms that prohibit them from using it to train their models.

Retention: Instagram and Messenger messages stay in the business’s account while the business keeps the conversation, under the rules in section 9 (Data Retention). If a person unsends (deletes) a message on Instagram, Plixana marks it as removed and deletes its text and attachment from the inbox. The business can delete a conversation at any time, and if it cancels its account the data is permanently deleted 30 days after cancellation. The business can disconnect its Page or Instagram account at any time from Integrations.

How to request deletion: It depends on how you used Plixana:

• If you connected your Facebook Page or Instagram account to Plixana: remove Plixana in your Facebook settings (Business Integrations, or Apps and Websites) and request deletion there. Meta sends the request to our data deletion callback at https://plixana.com/api/meta/data-deletion, which disconnects the Pages and Instagram accounts you connected and deletes their access tokens and your Facebook identity data (user ID, name and email). It returns a confirmation code and a page where you can check the status of your request. The conversations each business had with its own customers belong to that business and are not deleted by this request.
• If you messaged a business through Instagram or Messenger: write to hi@plixana.com (or to the business itself) with your Instagram username or the Facebook Page you messaged, and together with the business, which is responsible for that data, we delete your conversations and your contact record in its account. Removing an app in your Facebook settings does not apply in this case, because you never signed in to Plixana.

Deletion requested through Meta usually finishes within a few minutes, and requests sent by email are usually handled well before the limit; in every case it takes no more than 30 days. If you have questions about your request, email us at hi@plixana.com.

7. Subprocessors

We share data exclusively with the following subprocessors, each bound by data protection terms (a DPA or the provider’s data processing terms):

• Supabase Inc. (US/EU) — database and authentication
• Vercel Inc. (US) — hosting and CDN
• Stripe Inc. (US/IE) — payment processing
• Resend Inc. (US) — transactional email
• Anthropic PBC (US) — main AI models: write the agents’ replies and describe the images customers send
• OpenAI L.L.C. (US) — backup AI models: they write the reply when the main model fails or when the business chooses OpenAI for an agent, and describe images when Anthropic fails; also knowledge-base search (turns the customer’s message and the business’s knowledge texts into vectors)
• Groq Inc. (US) — classifies each message, transcribes voice notes and powers helper features such as conversation summaries; also a backup AI model that writes the reply when the main model fails or when the business chooses Groq for an agent
• Cohere Inc. (Canada/US) — product search by image: compares the photos in the business’s catalog and, when the business uses visual product matching, the photos customers send on WhatsApp. It never receives the text of customer messages
• Meta Platforms Inc. (US/IE) — WhatsApp Business API, Instagram, Facebook Messenger

A complete, up-to-date list is available upon request at hi@plixana.com.

8. International Transfers

Data may be transferred to the United States, Canada, the European Union and the United Arab Emirates. For transfers from the EU/EEA we use Standard Contractual Clauses (SCCs) approved by the European Commission.

9. Data Retention

• Active accounts: for as long as the subscription is in effect.
• Canceled accounts: 30 calendar days of retention from the effective cancellation date, before permanent deletion (purge via daily cron). During those 30 days the account holder can reactivate the account without losing data or download everything in JSON from /facturacion.
• Accounting and billing data: 7 years by legal obligation.
• Technical logs: 90 days.
• End-user messages: for as long as the conversation exists or until the account holder deletes them.

10. Your Rights

You have the right to:

• Access your personal data
• Request correction of inaccurate data
• Request deletion (right to be forgotten)
• Restrict or object to processing
• Data portability in a structured format (JSON)
• Withdraw consent at any time
• Lodge a complaint with the competent data protection authority

To exercise these rights, write to hi@plixana.com from your account email. We respond within 30 days.

11. Security

We apply industry-standard technical and organizational measures: encryption in transit (TLS 1.3) and at rest (AES-256), Row-Level Security in the database, optional multi-factor authentication, log auditing, and continuous monitoring of suspicious activity.

12. Cookies

We use strictly necessary cookies for the authenticated session, security and preferences (dark/light theme, language) without asking for consent, because the Service cannot work without them. Campaign-attribution cookies (first-party UTM parameters) and third-party marketing identifiers (for example, the Meta pixel) are only activated if you accept them in the cookie banner, and you can withdraw your consent at any time from the cookie preferences. Full details are in the Cookie Policy at plixana.com/legal/cookies.

13. Minors

The Service is not directed to minors under 16, and we do not knowingly collect data from minors. If we discover that a minor provided us data without parental consent, we will delete it.

14. Changes to This Policy

We will notify substantial changes 30 days in advance by email to the account holder and via a banner in the app.

15. Contact

Questions about this Privacy Policy or the exercise of rights:
hi@plixana.com