Data Processing

This page explains how Tuxon handles personal data on behalf of the businesses that use the platform, and how to obtain our Data Processing Agreement (DPA).

1. Who is responsible for what

When a business uses Tuxon to talk to its own customers, the business is the data controller and decides what data is collected and why. Tuxon is the data processor: we process that data only on the business's instructions, to provide the Service.

Where Tuxon markets its own platform to businesses (for example, on this website), Tuxon acts as the controller for that limited data. See our Privacy Policy for details.

2. The Data Processing Agreement

We offer a Data Processing Agreement to our customers. It sets out the subject matter, duration, nature, and purpose of processing; the types of personal data and categories of data subjects; our security measures; and our obligations under Article 28 GDPR. It is available on request.

Sub-processors

We use a limited set of sub-processors to operate the Service. The list, with what each one does and where data is processed, is published at tuxon.ai/subprocessors and forms part of the DPA.

3. Categories of data we process

• Contact data — names, phone numbers, email addresses and messaging identifiers of the business's customers.
• Conversation data — message content, attachments, and (for voice messages) the audio and its transcription.
• Attachments for notification emails — email delivery data from the Tuxon dashboard to the team's own contact addresses.
• Business content — knowledge-base documents, product catalogues, and templates the business uploads.

4. Security measures

• Encryption in transit (TLS/HTTPS) for all traffic between browsers, the platform, and our providers.
• Authentication with JSON Web Tokens, optional Google sign-in, and two-factor authentication (TOTP) with backup codes.
• Role-based access control and per-workspace (tenant) data isolation — each business's data is kept separate.
• Access to production systems is limited to authorised personnel.
• Data is hosted on servers located in Germany (EU).

5. International transfers

Our primary hosting is in the EU. Some sub-processors process data outside the European Economic Area. Where they do, the transfer is covered by the European Commission's Standard Contractual Clauses or an adequacy decision. EU data residency is available on request for AI processing. Full details are on the sub-processors page.

6. Data deletion and return

At the end of an agreement, and on instruction, we delete or return the personal data we process on the controller's behalf, except where retention is required by law. Data subjects can also request deletion of data that came from Meta (Facebook / Instagram); see the Data Deletion page.

7. Contact

Data protection questions and DPA requests may be sent to support@tuxon.ai.