Terms of service

1. What you are subscribing to

OnChats is a tool for attending to and winning customers through messaging: you connect your channels, set up one or more automated agents and they write on your behalf, with the history and the statistics in a single dashboard.

We give you the software; the relationship with your contacts is yours. The agent writes what you have told it to write: you set the prompt, the goal, the tone and the prices, and the replies that come out of that are yours for all purposes. We do not give professional advice of any kind and we do not guarantee any sales result.

OnChats is a general-purpose tool. It is not designed for any particular industry and does not know yours: it does not know what you do, what you can offer or what is regulated in your activity, and it does not check. You choose what you use it for. The use you make of it (including misuse) and compliance with the rules of your activity are exclusively your responsibility, without prejudice to our obligations as processor (annex) and as provider of the AI system (section 5). If your industry requires a qualification, an authorisation, prior notice or a particular way of dealing with a customer, that is for you to put in place: we neither assess it nor have the expertise to do so.

2. For professionals only

OnChats is contracted in the course of a professional or business activity. It is not offered to consumers, so these terms are not a consumer contract and consumer and user protection legislation does not apply to them (including the 14-day right of withdrawal).

By contracting, you declare that you are acting as a professional or a business and that you are of legal age.

3. Your account and your agents

You must give us truthful information, and you are responsible for what happens with your credentials and with those of the members of your team to whom you give access.

You are responsible for what your agents write. Review what you set up before you let it loose: a prompt that promises a price, a deadline or a result binds you, not us.

What you give the agent to reply with (the business information, the cards and the resources) may be told or sent to anyone who writes to it, and what it reads is sent to our artificial intelligence providers to search it and draft the replies. Only include what you could tell a customer and have the right to use. Do not include personal data of your customers or of other people, except the contact details of the business and of your team that you want to give and they know you give; nor health data or other special categories, passwords, keys or identity documents, nor anything unlawful or that infringes the rights of others. If there is something your agent must not tell, do not give it to it: asking it to keep quiet does not protect it.

What your contacts write to you does not become part of that information on its own: the agent does not learn from one conversation to reply in another.

4. Connected channels and services

So that the agent can reply on Instagram, you authorise us to send and receive messages on behalf of your professional account. You can revoke that permission whenever you like from Ajustes → Canales (Settings → Channels), and when you do so we stop processing those messages.

If you connect your Google Calendar, you authorise us to check when you are busy and to create, change and cancel in your calendars the appointments and requests your agent handles. You can disconnect it whenever you like from Canales → Herramientas (Channels → Tools). For each agent you decide how it uses it: to book appointments under the services, lengths and hours you set, to note down requests to be confirmed, which the agent records without checking your availability, or both. If you add several staff members, the agent offers each one’s times according to their calendar and hours, and puts each appointment in the calendar of whoever attends it, with the client and who it is with. Appointments the agent confirms under those rules commit you to your customer, just like what your agent writes. Requests that are noted down are not confirmed: confirming or dismissing them, and letting the person know, is up to you. The instructions you give your agent about the calendar are yours, like everything else you set up in it.

If you put the chat on your website, the line “Powered by OnChats” and the privacy link must always be visible in it: you may not hide, cover or change them, with styles or with code. You change its appearance with the dashboard options (the button, its colours, the side and the size) and with the CSS variables we document for moving it away from other elements of your website. You may also add your own CSS from the dashboard, as long as those two stay visible: if your CSS hides or covers them, the chat turns it off automatically.

By connecting a channel or a service you also undertake to comply with the terms of the platform that owns that channel or service. If that platform restricts or closes your account, or changes its API, the service stops working in that respect for reasons beyond our control: we are not liable for that interruption, although we will do what is reasonable to adapt.

5. The agent identifies itself as AI

The agent states that it is an artificial intelligence system when it starts a conversation and whenever it is asked, and it never claims to be a person. We set that rule: it cannot be switched off in the settings and a record is kept of each identification.

You may not set up an agent to hide its nature, pass itself off as a specific person or deny being an AI. Doing so is grounds for suspension, because the obligation is ours and we cannot transfer it to you.

6. Acceptable use

With OnChats you may not:

• Write to anyone who has not initiated contact with you or given you their consent: no lists that have been bought, scraped or imported from third parties.
• Keep writing to someone who has asked you not to write to them. A request not to be contacted is always respected, however it was expressed.
• Impersonate another person or business, or use the platform to deceive, harass or commit any unlawful act.
• Ask in the chat for passwords, verification codes, card numbers or other access or payment credentials.
• Ask for health data or other special categories (political opinions, religion, ethnic origin, sex life, genetic or biometric data) or for data on criminal convictions and offences, unless you need them to attend to that person and have a legal basis for processing them.
• Manipulate people or take advantage of their age, a disability or their social or economic situation to lead them to decisions that harm them.
• Offer unlawful products or services, or ones your business is not allowed to offer.

If we become aware of a serious breach, we may suspend the account, notifying you beforehand unless urgency prevents it.

We review automatically, with the safety filters of our artificial intelligence providers, what you save in your agents (their instructions, the business information and the cards) and the messages of each conversation. If the filters block something when it is saved, it is not saved; if it happens again in conversations, we may stop the agent until a person on our team reviews it. And when you save something your agent will use to reply, and before it is switched on, we compare it against these terms, with fixed rules and with an artificial intelligence system: if it finds a prohibited use, it is not saved or the agent is not switched on, we tell you what to change and we log it for a person on our team to review; if it only finds something doubtful, it is saved or the agent is switched on and we show it to you. These reviews look for harmful content and prohibited uses: they do not check that what you do is lawful nor approve it, and they do not change what section 1 says.

7. Price, credits and payment

The prices and limits of each plan are those shown on the plans page at the time of contracting. Prices are shown excluding VAT: the tax that applies according to your country and your tax status is added to the amount, and you will see it itemised before paying and on the invoice.

The allowance is measured in credits, which measure the cost of attending to conversations: how much the agent reads and how much it writes. A long conversation uses more than a short one. The plan’s credits reset on the 1st of each month and do not carry over from one month to the next. If you run short, you can top up without changing plan. Once the allowance is used up, the agent stops replying until you top up or until the next reset.

If we change the price, we will notify you at least 30 days in advance and you will be able to cancel before it applies. A price change never applies to a period already paid for.

If you do not pay, access to the dashboard is blocked and the agents stop replying. Blocking is not deleting: your data and your conversations are still there and come back as soon as you settle the payment.

8. Duration, plan changes and cancellation

The contract lasts for the period you have contracted (monthly or annual) and renews automatically when it expires, unless you cancel it beforehand from your account.

• Cancelling does not cut off the service immediately: you keep access until the end of the period you have already paid for, and nothing more is charged after that.
• Upgrading applies immediately, deducting from the new payment the part of the current period that you have not used.
• Downgrading applies on renewal, not before: what has already been paid for is enjoyed until the end.

There are no refunds for periods already started, for top-ups or for unused credits. The proration of upgrades is a discount on the next payment, never a refund.

We may terminate the contract if you seriously breach these terms or use the platform for anything unlawful, notifying you beforehand unless urgency prevents it.

When it ends, you can ask us for a copy of your account data and your conversations by writing to privacidad@axirensystems.com: we will deliver it to you in a commonly used format within 30 days of your request. We then delete them, except for what we have to keep because of a legal obligation (for example, invoicing).

Regardless of cancellation, conversations are deleted 6 months after the last message. It is a fixed period, the same for everyone and not configurable: keeping a dead conversation for years is no use to anyone and multiplies the damage of any incident.

Data is deleted immediately from active systems; database backups are kept for 7 days, after which the data disappears from them too. Photographs and files are deleted immediately and permanently: they are not included in backups.

9. Availability

We do what is reasonable to keep the service up and running, but we do not promise that it will be available without interruption. Maintenance downtime is announced in advance whenever it can be planned.

10. Liability

We are liable for the damage we cause you by breaching these terms, up to a limit: the amount of the fees you have paid us in the 12 months before the event that caused the damage. We are not liable for loss of profit or for indirect damage.

This limit does not apply in cases of wilful misconduct or gross negligence, or where the law does not allow liability to be limited.

If a claim is brought against us over what your agent wrote or over whom you wrote to, you will be liable for it and will hold us harmless against that claim and against the reasonable costs it causes us, unless the damage results from a breach on our part, and without prejudice to our obligations as processor (annex) and as provider of the AI system (section 5).

11. Changes to these terms

If we change anything significant, we will notify you at least 30 days in advance by email or within the app, telling you what changes and the date it comes into force. If you do not agree, you can cancel before that date, and the previous terms will continue to apply to you until the end of the period you have already paid for. If you do not cancel, the new version applies to you from the date it comes into force.

12. Governing law and courts

Spanish law applies. For any dispute between you, as a professional, and us, both parties submit to the courts of the provider’s domicile.

Annex: data processing agreement

This annex is the contract under Article 28 GDPR and forms part of the terms: accepting them means signing it. You are the controller of your contacts’ data and we are the processor: we process that data solely on your instructions.

Subject matter, duration and purpose

We process your contacts’ data to provide you with the service described in these terms, for as long as the contract lasts and within the retention period in section 8.

Data and data subjects

The identifier and display name of the account writing to you, the content of the messages and whatever each contact voluntarily says in the conversation. That content may arrive as a voice note or as an image: in that case it is turned into text (the transcription of what was said, a description of what can be seen) and the file is discarded without us storing it. What is kept, and what we process, is that text. A chat collects whatever people decide to write, so information that you had not asked for may end up coming in. Set up your agents not to request sensitive data, bank details or identity documents: they are not needed to attend to a contact, and asking for them by chat makes you the controller of a much more delicate processing operation (with the obligations that brings, which are yours and not ours, without prejudice to our obligations as processor under this annex and as provider of the AI system under section 5).

If you use the calendar, also the date, time and service of each appointment or request the agent handles, the staff member who attends it and the details you decide to ask for in order to do so; on WhatsApp, the phone number for the appointment is the number the contact writes from. What the contact gives for the appointment completes their record in your dashboard if it was empty. If you add staff members, also what you write about them: their name, the description you give the agent, their hours and the calendar their appointments go into.

And the personal data you include in what you set up in your agents (for example, the name and phone number of someone on your team in a card), which must only be what you can give to whoever writes (section 3).

Calendar: the details you ask for are your decision

You set which details are asked for to book an appointment or note down a request, which ones are required and which ones you mark as sensitive, just as you set the instructions you give each agent about the calendar. That is why you are the one who must have a legal basis for asking for them, tell your contacts about it and deal with any request they make about them. Ask only for what you need for the appointment or the request. If you ask for special category data (for example, health data), mark it as sensitive and make sure beforehand that you can process it: that obligation is yours and not ours, without prejudice to our obligations as processor (this annex) and as provider of the AI system (section 5). Who you add as a staff member and what you write about each of them is also your decision: tell them their data is used to manage your calendar and write about them only what the agent needs.

For our part, we only send the artificial intelligence model what it needs for each reply: the contact’s name is replaced with a code, and their phone number, email address and documents are masked before anything is sent. The details you mark as sensitive are stored encrypted, are not written into your calendar and can only be seen in the dashboard on request, with a record of who looked at them. The agent does not see the events in your calendar or other people’s appointments: only the free times and, once the person writing proves who they are, their own appointments; if it only notes down requests, it receives nothing from your calendar, and if the calendar is not connected or the agent does not have the tool switched on, it receives nothing from it. On Instagram and WhatsApp the channel already identifies the contact, who can change or cancel the appointments from that same conversation without giving any more details; on the website it is checked with their details or the booking code. Appointments and requests are written into your own Google account: there Google processes them as your provider, under your relationship with it, and not as our sub-processor. That is why what stays in your calendar is not deleted when conversations are deleted (section 8): keeping or deleting it is your decision.

Our obligations

• To process the data only in accordance with your instructions and not to use it for our own purposes.
• To inform you immediately if, in our opinion, an instruction of yours infringes the GDPR or other data protection law.
• Not to use the content of your conversations to train artificial intelligence models, whether ours or third parties’.
• To maintain confidentiality and require it of anyone who accesses the data.
• To apply appropriate technical and organisational security measures.
• To help you respond to the rights exercised by your contacts.
• To notify you without undue delay of any personal data breach.
• To assist you in meeting your obligations on security, on notifying breaches to the supervisory authority and communicating them to the data subjects, and on data protection impact assessments and prior consultation (Articles 32 to 36 GDPR), taking into account the nature of the processing and the information available to us.
• To return or delete the data when the contract ends.
• To make available to you the information needed to demonstrate that we comply, and to allow for and contribute to audits, including inspections, conducted by you or by another auditor mandated by you, with reasonable notice, subject to confidentiality and at your expense.

Sub-processors

You authorise us to engage the providers below, with whom we have signed the agreements that the GDPR requires. We impose on each of them, by contract, the same data protection obligations that we take on towards you in this annex and, if any of them fails to meet them, we remain liable to you for their performance. If we are going to change or add any, we will notify you in advance and you will be able to object.

Payments: independent controller

Stripe is not one of our sub-processors: it is an independent controller of the payment data. It processes that data on its own account (to collect payments, prevent fraud and comply with payment regulations) and not on our instructions or yours. We do not see or store your card details at any time.

Transfers outside the EU

We only transfer data outside the European Economic Area on your documented instructions: by accepting these terms you authorise the transfers shown in the table above, to those providers and in those locations. If Union or Member State law required us to make any other, we will tell you beforehand, unless that law prohibits it. Every transfer relies on the safeguards of Chapter V GDPR: the EU-U.S. Data Privacy Framework (the providers marked ‘DPF’) or standard contractual clauses of the European Commission.