Privacy Policy

This Privacy Policy explains how Tuxon ("we", "us", "our") collects, uses, and protects information when you use the Tuxon platform, website, and related services (the "Service"). By using the Service, you agree to the practices described below.

1. Information we collect

• Account information: name, email address, password (encrypted), and payment details when you register or purchase features.
• Business data: information you upload, such as customer/contact details, knowledge-base content, message templates, and conversation history.
• Usage data: logs of how you interact with the Service, such as IP address, browser, device, and feature usage.

2. How we use information

• To provide, operate, and improve the Service and its features;
• To send transactional and account-related communications;
• To bill for paid features and prevent fraud or abuse;
• To comply with legal obligations and enforce our Terms.

3. Messaging data and consent

When you use messaging features, the content and recipient numbers involved are processed to deliver your messages through our providers (such as telecommunications and email providers). You are responsible for having the appropriate consent to contact the recipients and for honoring opt-out requests. See our SMS Opt-In Policy for details on how consent is obtained.

4. Facebook and Instagram (Meta) data

When you connect a Facebook Page or an Instagram professional account to Tuxon, we process the messages that people send to that account on your behalf. This includes the message content and any attachments, the sender's page-scoped ID (PSID) as provided by Meta, their profile name, and technical metadata such as timestamps and delivery status.

We use this data only to display the conversation to you and your team in the Tuxon inbox, to generate automated or AI-assisted replies, and to send your responses back through Meta's APIs. We do not use it for advertising, we do not sell it, and we do not use it to build profiles for any purpose other than providing the Service to you.

Our use of information received from Meta APIs adheres to the Meta Platform Terms and Developer Policies. You can disconnect a Page or Instagram account at any time from your Tuxon dashboard, after which we stop processing messages for it.

Deleting Meta data

A person who has messaged a business through Facebook or Instagram can have their data removed by removing the app under Facebook Settings → Apps and Websites, or by contacting us at support@tuxon.ai. When Facebook notifies us, the request is processed automatically and a confirmation code is issued. In all cases the person's identifier, name and message content are erased or irreversibly anonymised. See our Meta Data Deletion page for exactly what is removed and what is retained in anonymised form.

5. Sharing

We do not sell your personal information. We share information only with:

• Service providers who help us operate the Service — for example our hosting provider, our AI provider (OpenAI), and the messaging, email and sign-in providers needed for the features you use — each under confidentiality and data-processing obligations. The full list is available on our Sub-processors page;
• Meta Platforms, Inc., where you connect a Facebook Page or Instagram account, or where a customer contacts your business through Meta's messaging products. Their handling of data is governed by the Meta Privacy Policy;
• Authorities where required by law or to protect legal rights;
• Other parties only with your consent.

6. Google Sheets and Google Drive data

When you connect a Google Account to export data to Google Sheets, we request access to the Google Sheets API and the Google Drive API using the spreadsheets and drive.file permissions. We use this access solely to create a spreadsheet in your Google Drive containing the data you chose to export, and to write that data into it.

• We store an OAuth refresh token so that exports can be performed on your behalf without re-authorizing each time. You can revoke this access at any time from your Google Account permissions page, or by disconnecting the account in our dashboard;
• Exported spreadsheets are stored in your own Google Drive. We do not copy their contents to our servers;
• The drive.file permission limits our access to files our application creates. We cannot read or modify any other file in your Drive;
• We do not sell Google user data, use it for advertising or credit-worthiness purposes, transfer it to third parties, or allow humans to read it, except where necessary for security or to comply with law;
• Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

7. Data retention and security

We retain personal data only as long as needed for the purposes described, or as required by law. For example, conversation and contact data are kept for as long as your workspace is active and are deleted or anonymised when you close your account or on request; security and usage logs are kept for a limited period. See our Data Processing page for more detail.

We use reasonable technical and organizational measures to protect your data, including encryption in transit. No method of transmission is completely secure, so we cannot guarantee absolute security. If we become aware of a personal data breach affecting you, we will notify you and the relevant authority without undue delay, in line with applicable law.

8. International data transfers

Our main hosting is located in Germany (EU). Some of the service providers we use process data outside the European Economic Area. Where that happens, the transfer is protected by appropriate safeguards under Article 46 GDPR — in practice, the European Commission's Standard Contractual Clauses or an adequacy decision. The list of providers, what each one does, and where data is processed is on our Sub-processors page.

9. Your rights

Depending on your location, you may have rights to access, correct, export, or delete your personal information, and to object to certain processing. You can exercise these rights by contacting us at support@tuxon.ai. We respond to requests within 30 days.

If you use Tuxon as a business and need a Data Processing Agreement for your own compliance, see our Data Processing page.

If the data came from messaging a business on Facebook or Instagram, see our Meta Data Deletion page for the fastest way to have it removed.

10. Cookies

We use cookies and similar browser-storage technologies that are necessary to operate the Service — for example, to keep you signed in and to remember your theme preference. We do not use advertising or third-party tracking cookies. You can control cookies through your browser settings.

11. Changes to this policy

We may update this policy from time to time and will post changes on this page. Continued use of the Service after changes take effect constitutes acceptance of the revised policy.

12. Contact

Questions about this policy may be sent to support@tuxon.ai.