Privacy Policy

1. About this policy

“Detoximex” refers to the Detoximex service operated at detoximex.com, an AI Workforce & Business Automation platform for businesses that receive customer enquiries on messaging channels. This policy applies to the website, the application, and the AI agent that operates on a customer's connected channels.

Detoximex is an independently developed product and is not currently offered by an incorporated company. As the service moves to paid commercial operation, an operating entity will be established and this policy will be reissued naming that entity and its regulator-facing details. Until then this document intentionally makes no claim about corporate registration, licensing, or tax status.

2. Two different roles

• For our business customers — the people who create a workspace and use the product — Detoximex decides what account data is needed to run the service, and is responsible for it.
• For their end customers — the people who message a business through a connected channel — the business decides why the data is collected and how long it is kept. Detoximex processes that data on the business's instructions in order to operate the service on its behalf.

If you contacted a business that uses Detoximex and want your data corrected or removed, contact that business first, since it controls the record. If you cannot reach it, you can reach us through the route in section 10 and we will pass the request on.

Where a business is established in the United Arab Emirates, the Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) applies: the business is the controller and Detoximex is its processor. As processor we act only on the business's instructions, keep the data confidential, apply the security measures described on the security page, tell the business without undue delay if its data is involved in a breach, help it answer requests from the people whose data it holds, and delete or return the data when the service ends. These obligations are set out in full in the data processing agreement that forms part of the service terms.

3. What the service processes

• Account data — name, business email address, authentication records, workspace membership and role.
• Business and workspace data — company name, working hours, language settings, staff records including staff contact numbers and calendar identifiers, policy rules and agent configuration.
• Customer enquiry data — the enquirer's phone number and profile name as supplied by the messaging platform, plus the intake details they give during the conversation, and the score our fixed rules calculate from those details.
• Conversations and messages — the full content of messages exchanged with the AI agent or with staff through the workspace, timestamps, delivery status, and provider message identifiers used to prevent duplicate replies.
• Uploaded records — the properties, listings, products, services or other records a workspace uploads, including any file it imports.
• Knowledge — the documents a business uploads for the AI agent to answer from, and the numeric representations (embeddings) generated from them to make retrieval possible.
• Integration data — where a business connects a CRM or calendar, the records exchanged with that system and the access tokens needed to do so, held server-side only.
• Usage, quality and security logs — per-run records of which agent ran, which model and version, token counts, estimated cost, latency and outcome; error records; automated quality evaluations of a sample of AI replies; audit records of configuration changes; and usage counters used for billing.
• Payment data — plan, subscription status, invoice records and the payment provider's customer and subscription identifiers. Payments are processed by Paddle as Merchant of Record; card numbers are handled entirely by Paddle and are never received or stored by Detoximex.

Do not place payment card numbers, government identification documents, passwords, or health information into conversations, uploads or the knowledge base. The service is not designed to hold them.

4. Why it is processed

To operate the service; to reply to and qualify enquiries on behalf of a business; to answer questions from that business's own approved documents; to book meetings and update a connected CRM; to alert staff and support human takeover; to measure quality, cost, latency and reliability; to detect and investigate abuse and secure the platform; to take payment; and to meet obligations that apply to us.

A sample of AI replies is scored automatically — for example to detect an answer that was not grounded in the business's own content, or an escalation that should have happened. This is a service-quality control. It is not used to make decisions about individuals.

5. Service providers

Data is shared only with the providers needed to run the service, each under that provider's data protection terms:

• Meta Platforms — WhatsApp Business Cloud API message delivery. Meta's global infrastructure.
• OpenAI — model processing for replies, retrieval and quality evaluation. United States. API data is not used by OpenAI to train models.
• Supabase — application database, authentication and server-side functions. Tokyo, Japan (AWS ap-northeast-1).
• Vercel — application hosting and delivery. United States, with a global edge network; no customer data is stored at rest on Vercel.
• n8n — automation and integration execution (n8n Cloud). European Union; the exact data centre is confirmed to a business on request.
• HubSpot — CRM synchronisation, where a business enables it. United States, or the EU where the business's HubSpot account is EU-hosted.
• Google — calendar availability and meeting creation, where a business enables it. Google's global infrastructure.
• Paddle — Merchant of Record for subscription billing, payment processing and applicable sales-tax/VAT handling. United Kingdom and European Union.
• Resend — authentication and transactional email. United States.
• Stripe — a legacy integration retained in code; never activated for live payments and holding no customer data.

Personal data is not sold, and it is not shared for advertising. Adding or replacing a provider is notified to workspace owners 30 days in advance.

6. Google Calendar data

When a business connects Google Calendar, Detoximex uses the Google Calendar API to check the business's free/busy times and to create, update and cancel the appointment events it books on the business's behalf. It requests only the scopes needed for that: calendar.events and calendar.freebusy. Calendar data is used only to provide the booking feature. It is not used for advertising, is not sold, and is not shared with any third party except as needed to operate the service. Detoximex's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Access tokens are encrypted at rest (AES-256-GCM) on the server, are never exposed to the browser, and are deleted when the business disconnects the integration or deletes its workspace.

7. International processing

The application database and authentication records are hosted in Tokyo, Japan. Model processing takes place in the United States. Messaging, calendar and CRM providers process data on their own global infrastructure. So data is processed outside the country where a business or its customers are located, and we rely on the contractual data protection terms each provider offers. For a business established in the UAE, this transfer is made under the safeguards in those terms; the processing locations that apply to a specific workspace are confirmed to it in writing during onboarding.

8. Retention

While a workspace is active, conversation, customer enquiry, uploaded records, knowledge and operational records are retained so the service can function and so the business keeps its own history. When a workspace requests deletion, its content is deleted 30 days later; during those 30 days the owner can still sign in and export it. Billing and settlement records are kept for seven years after the transaction for financial record-keeping, with the workspace identifier only; the audit trail is kept for 24 months; error and delivery records for 90 days.

Backup copies are held by the database provider with point-in-time recovery and age out on the provider's rotation (currently seven days) rather than being edited individually.

9. Exporting and deleting data

Business customers. The workspace owner can export the whole workspace as a single JSON document from Settings → Export workspace data, and can delete the workspace from Settings → Delete workspace by typing its name to confirm. Deletion switches the AI agent off immediately and removes the workspace content from production systems 30 days later; every export and every deletion request is recorded in the audit trail with who asked. Provider authorisations you granted (Google, HubSpot, Meta) should also be revoked on the provider's side, which we cannot do for you. If you cannot sign in, you can request either from the account settings area of your workspace, or through the contact route published on detoximex.com, from the account owner's registered email address.

People who messaged a business using Detoximex. The business holds your record and can delete it from its workspace. If you cannot reach the business, contact us from the account settings area of your workspace, or through the contact route published on detoximex.com with the phone number you used and the name of the business, and we will forward the request and confirm to you once it has been actioned.

Deleting a workspace is irreversible and removes conversation history, customer enquiry data, uploaded records and knowledge for every user of that workspace.

10. Your rights and how to reach us

Depending on where you live, you may have rights to access the personal data held about you, to have it corrected, to have it deleted, to restrict or object to certain processing, and to receive a copy in a portable form. You can exercise these rights from the account settings area of your workspace, or through the contact route published on detoximex.com.

We may need to verify who you are before acting, and where we hold data on behalf of a business customer we will refer the request to that business and support them in answering it.

11. Security

Workspace data is isolated at the database level rather than only in application code, integration connection tokens are held in dedicated secret storage and are never exposed to the browser, and configuration changes are recorded with their previous and new values. The security overview describes these controls and states plainly what the service does not yet have, including the absence of any third-party security certification.

12. Children

Detoximex is a business tool and is not directed at children. We do not knowingly collect data from anyone under 18.

13. Changes to this policy

This policy is updated when practices change, and materially when an operating entity is established. Business customers are told about material changes through the account owner.