Privacy Policy — Chatrix

1. Who we are

FOP Yevtushenko Valerii (ФОП Євтушенко Валерій; "Chatrix", "we", "us", "our") is a sole proprietor (fizychna osoba-pidpryiemets, FOP) registered in Ukraine, taxpayer registration number (RNOKPP) 3066518755, registration address: vul. Kosiora 31A, apt. 52, Kryvyi Rih, 50050, Dnipropetrovsk region, Ukraine. We are the operator of the Chatrix platform accessible at chatrix.live and at affiliated country-partner domains.

For privacy matters, contact us at [email protected].

Registered office, commercial register entry and tax identification numbers are published in our Impressum (for German visitors) and Aviso legal (for Spanish visitors), and are available on request from [email protected].

2. What we collect

Account data: name, email, organization name, role.
Billing data: billing address, VAT ID, payment tokens (full card data is held only by our payment provider).
Usage data: conversations, messages, AI suggestions, configuration you create.
Messaging-channel data: when a customer connects Facebook Messenger, Instagram Direct, WhatsApp or Telegram to Chatrix — the messages people send to that channel, their platform identifiers (Facebook page-scoped ID, Instagram-scoped ID, WhatsApp phone number, Telegram user ID), display name, profile picture and attachments. Facebook and Instagram are described in detail in the section "Facebook Messenger and Instagram" below.
Technical data: IP address, user agent, device type, cookies (see Cookie Policy).
Website analytics data (only with your consent): pages you view on chatrix.live, the referring page, approximate location, device and browser data, and clicks on the sign-up and contact links — see section 10.
Communications: demo requests, support emails, sales conversations.

3. Why we process your data (legal basis)

Service delivery — Art. 6(1)(b) GDPR (performance of contract).
Billing and accounting — Art. 6(1)(b) and 6(1)(c) GDPR (contract and legal obligation under Ukrainian tax law).
Product improvement and analytics — Art. 6(1)(f) GDPR (legitimate interest); you can opt out.
Website analytics on chatrix.live (Google Analytics 4) — Art. 6(1)(a) GDPR (consent); you can withdraw consent at any time (section 10).
Marketing and sales outreach — Art. 6(1)(f) GDPR or consent, depending on jurisdiction.
Fraud prevention and security — Art. 6(1)(f) GDPR (legitimate interest).
Legal compliance — Art. 6(1)(c) GDPR.

We use selected sub-processors to operate the service — hosting, email delivery, AI inference, payments. We have contractual guarantees (DPAs with Standard Contractual Clauses where applicable) with each. A current list of sub-processors is available on request at [email protected] (see section 7 of our Data Processing Agreement).

For analytics on our own website we use Google as a processor, only with your consent; see section 10.

Messaging platforms that a customer connects to Chatrix — Meta Platforms for Facebook Messenger and Instagram, WhatsApp, Telegram — receive the replies sent through them and are independent controllers of their own services; they are not our sub-processors.

5. Facebook Messenger and Instagram (Meta Platforms)

A business using Chatrix can connect its Facebook Page, and the Instagram professional account linked to that Page, through Facebook Login for Business. Chatrix is then registered with Meta Platforms as a messaging application for that Page and uses the Meta Messenger Platform and the Instagram Messaging API to deliver the conversation to the business and to send its replies.

What we receive from Meta about people who write to the business. For every message sent to the connected Page or Instagram account: the message text and attachments, the time it was sent, the sender's page-scoped ID (PSID) or Instagram-scoped ID (IGSID) and — fetched once when the conversation starts — the sender's name, Instagram username and profile picture. We also receive delivery and read receipts for the replies we send. We do not receive or store the person's Facebook or Instagram password, email address, phone number, friends or followers, posts, stories or any data outside the conversation.

What we receive about the business. The Page ID and name, the ID and username of the linked Instagram account, and a Page access token. The token is stored encrypted (AES-256-GCM) and is used only to receive webhooks for the Page and to send replies on its behalf. We do not store the business user's own Facebook access token.

Why we process it. To show the conversation to the business's operators and, where the business has enabled it, to its AI assistant; to deliver their replies back to the person; to show the operator who is writing (name and picture); and to show whether a reply was delivered or read. Legal basis: performance of our contract with the business (Art. 6(1)(b) GDPR). The business is the controller of these conversations and Chatrix acts as its processor under our Data Processing Agreement; the person's relationship with Meta is governed by Meta's own terms and privacy policy.

What we never do with data received from Meta. We do not use it for advertising, profiling or marketing of our own; we do not sell it or share it with data brokers; we do not combine it with data from other sources beyond the same business's conversations; and we never send messages to a person who has not written to the Page or Instagram account first. Replies follow Meta's messaging rules: within 24 hours of the person's last message, or up to 7 days when a human operator answers an open question (human-agent tag). Our use of data received from Meta complies with the Meta Platform Terms and Developer Policies.

Retention and deletion. Conversations are kept for the retention period set by the business (default 24 months) and are deleted when the business deletes the conversation or closes its account. Once a Page is disconnected, we stop receiving data for it and no longer use its access token; the token is removed when the business deletes its account or asks us to. A person who has messaged a business can ask us to delete the conversation as described in our Data deletion instructions.

Disconnecting. A business can disconnect a Page at any time in Chatrix (Settings → Integrations → Disconnect), which removes our webhook subscription from the Page, or by removing Chatrix under Facebook → Settings & privacy → Settings → Business integrations. After disconnection we receive no further data from that Page or its Instagram account.

6. International transfers

Primary infrastructure is located in the European Union. The operator of the service is established in Ukraine, which has no EU adequacy decision; access to personal data from Ukraine is covered by the EU Standard Contractual Clauses (Commission Decision 2021/914/EU). Where AI inference or email delivery requires transferring data outside the EU/EEA, we rely on the EU Standard Contractual Clauses (Commission Decision 2021/914/EU) and additional safeguards as needed under Schrems II.

Website analytics — Google (USA). If you consent to analytics, Google Analytics data may be processed by Google LLC in the United States. Google LLC is certified under the EU-U.S. Data Privacy Framework, which the European Commission found to provide an adequate level of protection (Implementing Decision (EU) 2023/1795); the transfer relies on that adequacy decision (Art. 45 GDPR).

7. How long we keep your data

Account data: for the duration of your contract plus the period required by Ukrainian tax and accounting law after termination.
Conversation content: for the retention period configured by the customer (default: 24 months), then deleted.
Marketing data: until you opt out or object.
Technical logs: up to 12 months.
Website analytics (only with consent): analytics cookies for the lifetimes listed in our Cookie Policy (generally up to 2 years); user-level Google Analytics data for the retention period set in our Google Analytics property (at most 14 months).
Messaging-channel data (Messenger, Instagram, WhatsApp, Telegram): the same as conversation content; channel credentials such as an encrypted Page access token are no longer used after the channel is disconnected and are removed with the account.

Access (Art. 15) — obtain a copy of your data
Rectification (Art. 16) — correct inaccurate data
Erasure (Art. 17) — have your data deleted
Restriction (Art. 18) — limit how we process your data
Portability (Art. 20) — receive your data in a machine-readable format
Objection (Art. 21) — object to processing based on legitimate interest
Withdraw consent — at any time, without affecting prior lawful processing
Lodge a complaint with the data protection supervisory authority of the EU/EEA member state where you live or work, or where the alleged infringement took place (Art. 77 GDPR), or with the Ukrainian Parliament Commissioner for Human Rights, who supervises personal data protection in Ukraine (ombudsman.gov.ua).

To exercise any right, email [email protected]. We respond within one month (Art. 12 GDPR).

9. How to delete your data

Step-by-step instructions — including for people who contacted a business through Facebook Messenger or Instagram — are on our Data deletion instructions page. In short: email [email protected] from the address or account you used, tell us which business you contacted, and we delete the conversation and your profile data within 30 days and confirm by email. Chatrix customers can disconnect channels themselves in the dashboard and request deletion of conversations or of the whole account at the same address.

10. Cookies and website analytics

The cookies and similar technologies used on chatrix.live, with their names and lifetimes, are listed in our separate Cookie Policy.

Only if you choose Accept all in the cookie banner do we load an analytics tool on chatrix.live. If you choose Reject non-essential or make no choice, it is not loaded.

Google Analytics 4 (measurement ID G-Q18XS874B7), provided by Google Ireland Limited, Ireland, with Google LLC, USA. It records the pages you view, the referring page, your approximate location (country, region, city), device, browser and screen data, and whether you click the sign-up link or the sales or partner email links or send the contact form (only the fact and the chosen topic, not the message). For visitors in the EU, Switzerland and the UK, Google uses the IP address only to derive the approximate location and does not log or store it. See How Google uses information from sites or apps that use its services.

Legal basis: your consent (Art. 6(1)(a) GDPR); for storing and reading information on your device, Art. 5(3) of the ePrivacy Directive 2002/58/EC as implemented nationally (e.g. § 25 TDDDG in Germany). Giving consent is voluntary; refusing it does not limit your use of the site.

Withdrawing consent: you can withdraw your consent at any time, with effect for the future: open our Cookie Policy (linked in the footer of every page), click Open cookie preferences and choose Reject non-essential, or email [email protected]. Processing before the withdrawal remains lawful. Retention periods are in section 7, international transfers in section 6.

11. Security

We implement technical and organizational measures appropriate to the risk, including encryption in transit (TLS 1.2+), encryption at rest, role-based access controls, logging, regular backups and personnel training. See our Security overview.

12. Children

The Chatrix Service is intended for business use and not directed at children under 18. We do not knowingly collect personal data from minors.

13. Changes to this Policy

Material changes are published on this page with a new effective date. For significant changes affecting your rights, we will notify you by email at least 30 days in advance where possible.

14. Contact

FOP Yevtushenko Valerii
vul. Kosiora 31A, apt. 52, Kryvyi Rih, 50050, Dnipropetrovsk region, Ukraine
[email protected]
[email protected]