Privacy policy

Who is responsible for your data

If you wrote to a business that uses OnChats, the controller is that business: it is the one that decides what you are asked and for what purpose. Axiren Systems acts as a processor, which means it provides the platform and processes the data following the business’s instructions. To exercise your rights you can contact the business or write to us at privacidad@axirensystems.com and we will pass your request on to the business.

If you are the business, we are the controller of your account data (sign-up, billing and support) and the processor of your contacts’ data.

How we inform you when you write

When you write to a business that uses OnChats, the controller of your data is that business, and it is the business that has to inform you of how it processes your data. We provide the tool and this page, which explains how responsibilities are shared and where your rights come from.

• Through a website chat, the link to this page is fixed in the footer of the chat window, where it stays for as long as the conversation lasts. If the business has added it, its own privacy policy is linked next to it: the business is responsible for what you write to it.
• By direct message (Instagram), it is the business you are talking to that informs you. You can ask it for that information at any time, and you can also exercise your rights by writing to us: how to do so is explained below.

On every channel, whoever replies to you identifies itself as an automated assistant in its first message: this is covered below, in Use of artificial intelligence.

What data we process

• Messages that users send through Instagram, the web chat or other connected channels, including the content of the message and the conversation identifier.
• Voice notes, images and other files that the contact attaches to their message. We do not store the file at any point: it is read on the fly to turn it into text (what is said in the audio, what can be seen in the image) and the bytes are discarded there and then. The only thing we keep is that text, within the conversation, and it disappears with it. The AI provider that turns it into text may keep it for a limited time to monitor abuse of its service (see Use of artificial intelligence).
• The public identifier, display name and, where applicable, public profile photo of the account that writes to us (obtained from the Instagram API), which are needed to reply to the right contact and to show the conversation to its recipient.
• Data that the contact shares voluntarily during the conversation (for example, a phone number or what they are looking for).
• Data from the Instagram professional account that the business connects voluntarily (username, account identifier and an access token to send and receive messages on its behalf).
• Appointments and requests, if the business uses the calendar: the date, time and service of the appointment booked, or of what the contact asks for on a given day and time (a call, a visit) and the agent notes down for the business to confirm, and the details the business decides to ask for in order to do so (for example, name and phone number). For the phone number, email address and name, an encrypted fingerprint is also kept, used only to check that whoever asks to change or cancel an appointment is the person who booked it. Whatever the business marks as sensitive is stored encrypted. If the business has several staff members, the appointment says who it is with, and for each staff member we keep what the business writes: their name, a description for the assistant, their hours and the calendar their appointments go into. On WhatsApp, the phone number for the appointment is the number the contact writes from, and what they give for the appointment completes their record in the business’s dashboard if it was empty.
• Data from the Google account that the business connects for the calendar: the account address, the list of its calendars, when it is busy (without reading the content of its events) and the appointments and requests created, changed or cancelled from OnChats, with an access token that we store encrypted.
• Account data of the business that uses OnChats (email, business name, subscription details) and technical session cookies, which are essential for the dashboard to work. We do not use advertising cookies or third-party tracking cookies.
• Dashboard access log: the IP address and browser of each login and of failed login attempts against an account. It is a security measure: it is used to detect and cut off access that does not come from the business, and if someone logs in from a device we had not seen before, we notify the business by email straight away. It is deleted after 6 months.
• Website visits: we count them in aggregate (pages viewed, at what time and from which website people arrive) using the server’s access logs, which keep the full IP address for at most 7 days and, after that, without its last part for up to 30. No cookies, nothing stored on your device and no IP address kept in the count: so as not to count the same person twice in one day, a temporary code is used and deleted at the end of the day, and all we keep are the totals.

What we use the data for

• Receiving and replying to the messages that arrive on the connected channels.
• Assisting the business in attending to its contacts, including drafting replies and follow-up messages by means of automated assistants.
• Keeping the conversation history to provide continuity of service, and producing internal summaries and statistics of those conversations for the business itself.
• Offering free times and booking, changing or cancelling appointments in the business’s calendar, or noting down requests in it for the business to confirm, when the business connects it.

We do not sell or disclose this data to third parties for advertising purposes, nor do we use it to train artificial intelligence models.

Use of artificial intelligence

Some of the replies on the connected channels are written by an automated assistant (an AI system) configured by the business. The assistant identifies itself as such in the conversation and never claims to be a person; if you ask whether you are talking to an AI, it will confirm it. You can ask at any time to be attended to by a person from the team.

To draft the replies, and for the summaries and statistics that the business sees about its conversations, the content of the conversation is processed by OpenAI, our main provider, or, if it is unavailable, by Google Cloud (Vertex AI), which acts as a fallback. Both act as processors under contract and do not use that content to train their models or for their own purposes, except to check that their services are not being abused: for that purpose, OpenAI keeps what it receives for up to 30 days, and Google, only if its automated systems flag it as possible abuse, may keep it for up to 90 days in the European Union and a person at Google may review it. Google Cloud processes it in data centres in the European Union; OpenAI may process it in the United States, under the EU-U.S. Data Privacy Framework.

The AI provider receives only what it needs to draft each reply: the name of the person writing is replaced with a code, and their phone number, email address, username and documents are masked before anything is sent. If the business uses the calendar to book appointments, the assistant also receives the free times and the day and time of that person’s appointments (and, if there are several staff members, each one’s name, what they do and the description the business writes about them), never the events in the calendar or other people’s appointments; if it only notes down requests, it receives nothing from the calendar, and if the calendar is not connected, nothing from it. The details the business marks as sensitive are stored encrypted and are not part of what it is sent about the appointment.

If the contact sends a voice note, the audio is transcribed automatically so that the assistant can read what it says. If they send an image and the business has this enabled, the image is described in one or two sentences for the same purpose. Both are done by Google Cloud (Speech-to-Text for the audio and Vertex AI for the image) as a processor under contract, in data centres in the European Union and without using that content to train its models.

We do not store the file anywhere. We have no file server and no copy of the audio or the photo: they are downloaded from the channel at that moment, turned into text and discarded. Speech-to-Text processes the audio in memory and does not keep it (we have not turned on its data logging); Google may keep the image Vertex AI receives, like everything else that reaches it, only to monitor abuse of its service and on the terms explained above. What remains in the conversation is that text, labelled as what it is (‘[Nota de voz] …’ for a voice note, ‘[Imagen] …’ for an image) so that nobody mistakes it for words written by the contact. An automatic transcription or description can be wrong; if anything that appears about you is not correct, you can ask for it to be rectified or erased (see Retention and deletion).

When describing images, the system has express instructions not to transcribe or describe sensitive information or special categories of personal data (reports, personal documents, measurements) or the physical appearance of the people who appear in them: in those cases it only states what type of image has arrived, so that a person can deal with it.

We recommend that you do not share sensitive information, bank details or identity documents by chat: they are not needed to attend to you, and a messaging channel is not the right place for them.

What you write is used to attend to your conversation: it does not become part of the information the assistant uses to reply to other people.

Legal basis

We process contacts’ data on the basis of the business’s legitimate interests in responding to the messages that the contact initiates voluntarily (Article 6(1)(f) GDPR) and, where the conversation leads to a contractual relationship, on the basis of the performance of that contract (Article 6(1)(b) GDPR). The business’s account data is processed for the performance of the service contract with OnChats (Article 6(1)(b) GDPR): it is necessary to open the account and provide the service, and without it we cannot do so.

Appointments and requests are processed to manage the booking or the request that the contact makes (Article 6(1)(b) GDPR). Which other details are asked for in order to do so, and on what basis, is decided by the business, which is the controller.

The dashboard access log is based on our legitimate interests in protecting accounts against unauthorised access (Article 6(1)(f) GDPR), and what we keep because of a legal obligation, such as invoicing, on compliance with that obligation (Article 6(1)(c) GDPR).

Cookies and storage on your device

We do not use analytics, advertising or third-party cookies, and we do not track you across other websites. That is why you will not see a cookie banner: we only store what is essential for the service to work, and for that the law does not require us to ask for your permission (but it does require us to tell you about it).

• Dashboard session (onchats-session): keeps the business identified between screens. It expires when you log out.
• Known device (onchats-dispositivo): identifies this browser so that we can warn you by email if someone logs in to your account from another one. It lasts 400 days; if you delete it, the next login from here counts as a new device and you will receive that warning.
• Access during downtime (ax_mantenimiento): only created if you open an access link that we have given you while the platform is under maintenance.
• Web chat: until you write, the chat stores nothing in your browser. If you write through the chat on a business’s website, your browser stores a random conversation identifier for 30 days. This is what lets you carry on in the same thread when you come back instead of starting from scratch. It does not contain your name or anything that identifies you outside that conversation.
• Dashboard preferences: the theme and the layout of the panels. These are not cookies: they stay in your browser’s storage and are not sent to any server. You can delete them by clearing the site’s data.
• Website language (onchats-idioma): if you choose a language on the website, or decline the suggestion to view it in the other one, your browser remembers your choice so as not to ask you again. This is not a cookie either: it stays in your browser and is not sent to any server.
• Dashboard language (onchats-idioma): on the login pages and in the dashboard the same choice is a cookie, because those screens are prepared on the server and need to know which language to use. It’s only created when you choose a language (or arrive from the English website), it only stores “es” or “en” and it lasts a year. If you have an account, the language is also saved in it, so the dashboard and our emails reach you in the language you chose on any device.

Data retention and deletion

Conversations are kept for 6 months from the last message and are then deleted automatically. It is a fixed period, the same for everyone: keeping a dead conversation for years is no use to anyone and multiplies the damage of any incident. The business’s account data is kept for as long as the account exists, except for the IP address and browser in the access log, which are deleted after 6 months: all that is kept is that there was a login and when. If you booked or asked for an appointment, what was written in the business’s Google calendar is not deleted with the conversation: it is the business’s diary, and the business keeps or deletes it. And if a message fails to be processed, the technical record of that failure, which may include the conversation, is kept for 7 days at most so that it can be fixed, and is not included in the backups.

Platform failure alerts, which may include the account and user affected and the technical details of the error, are deleted after 3 months. And what the compliance review concludes about each part of an agent’s configuration (its verdict and the sentences it is based on, with phone numbers, email addresses and documents masked) is kept for 180 days, so that what has not changed is not reviewed again, and is deleted earlier if the account is deleted.

The full instructions, step by step, are in data deletion. In short, and at any time before that period ends:

• If you wrote to a business that uses OnChats (through Instagram or its web chat): write to us at privacidad@axirensystems.com stating the name of the business and the username or channel you wrote from, or ask the business directly. We will delete your conversation and your contact details within 30 days at the latest and confirm this to you.
• If you are a business with an OnChats account: you can disconnect your Instagram account in the Canales (Channels) section, or your Google Calendar in Canales → Herramientas (Channels → Tools), at any time (this revokes our access and stops the processing) and request the complete deletion of your account and its data by writing to the same address.

Data is deleted immediately from active systems; database backups are kept for 7 days, after which the data disappears from them too. Photographs and files are deleted immediately and permanently: they are not included in backups.

Attachments are not subject to this period because we do not store them. A voice note or an image is read at that moment to turn it into text and then discarded; it never reaches the database and therefore never reaches any backup. What is kept (and deleted with the conversation) is the text that results from it.

Appointments and requests are deleted together with the conversation they come from. When the business disconnects its Google Calendar we delete the access token; the appointments and requests already in its calendar belong to it and stay there.

We may keep what is strictly necessary to comply with legal obligations (for example, invoicing).

Who we share data with

To operate the service we use providers that act as processors and are bound by contract:

• Meta Platforms Ireland Ltd.: delivery and receipt of messages on the Instagram channel, and the contact’s public profile (name, username and photo) used to identify their record (EU / US (DPF)).
• Supabase: database, authentication and files (EU).
• Hostinger International Ltd.: hosting of the application and of the automation (France (EU)).
• OpenAI: generation of the agent’s replies (main provider), moderation of what is saved in the agents and compliance review of their configuration (EU / US (DPF)).
• Google Cloud (Vertex AI): fallback for the agent’s replies and for the compliance review, moderation of what is saved in the agents, search in the business’s fact sheets and description of the images received (EU (European multi-region)).
• Google Cloud (Speech-to-Text): transcription of the voice notes received (EU (European multi-region)).
• Resend: sending of transactional email (EU / US (DPF)).

Stripe processes the business’s payment data as an independent controller, not as our processor: it decides for itself what it keeps in order to collect payments, prevent fraud and comply with payment regulations. If you wrote to a business, you do not pay anything here and your data does not go through it.

These providers process the data solely to provide their service to us. Data travels encrypted (TLS) and access to each conversation is restricted to the business it belongs to. Where a transfer leaves the European Economic Area, it relies on the EU-U.S. Data Privacy Framework or on standard contractual clauses of the European Commission, a copy of which you can request from us.

If the business connects its Google Calendar, appointments and requests are written into its own Google account, where Google processes them as the business’s provider and not as our processor. What we receive from Google APIs is used only for the calendar: it is not sold, not used for advertising or to train AI models, and nobody reads it except with the business’s permission, to investigate a security issue or because the law requires it. OnChats’ use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction and portability by writing to privacidad@axirensystems.com.

In particular, you can object at any time to processing based on legitimate interests (the business’s, if you wrote to it, or ours, in the dashboard access log): it will stop unless compelling legitimate grounds that override your rights are demonstrated, or it is needed to defend against claims.

If you consider that the processing does not comply with the law, you can lodge a complaint with the Agencia Española de Protección de Datos (AEPD, the Spanish Data Protection Agency) at aepd.es, or with the supervisory authority of the EU country where you live or work.

Changes

If we change this policy, we will update the date at the top and, where the change is significant, we will give notice through the platform itself.

Contact

Controller: Axiren Systems. Axiren Systems is the trading name of Quico Blázquez Vidal, sole trader (self-employed), with tax identification number (NIF) 46088145D and address at Calle de Cadarso 16, local, 28008 Madrid. For any question about this policy or your data, write to us at privacidad@axirensystems.com.