Privacy Policy

1. Who we are

inboxiz is a business communications platform operated by OGIXO LIMITED. It helps organisations manage customer conversations through WhatsApp and website chat.

This policy explains how OGIXO LIMITED (“we”, “us” or “our”) handles personal information in connection with inboxiz.

Privacy contact: admin@ogixo.com

2. When this policy applies

This policy covers our public website, customer and administrator accounts, shared inbox, website live chat, messaging integrations and related support and account administration.

We act as a controller when deciding how and why to use personal information for our own purposes, such as account administration, security and handling enquiries.

When a business uses inboxiz to communicate with its customers, that business generally decides why and how its customer information is used and is the controller. Where we handle that information only on the business’s instructions, our role is that of a processor. The applicable agreement and actual processing arrangements determine the parties’ responsibilities; this policy does not replace a data processing agreement.

If you contacted a business through inboxiz, that business’s privacy notice also applies. Contact it first about information it controls.

3. Information we process

We receive information directly from you, from organisations using inboxiz and their authorised personnel, from people contacting those organisations, and from connected communication platforms. Depending on your interaction, it may include:

• Account and organisation details: names, business details, email addresses, telephone numbers, memberships, roles, preferences and account settings.
• Customer contacts and communications: contact identifiers, messages, conversation history, supported attachments, sender details, channel identifiers, timestamps and delivery information.
• Website-chat information: messages, visitor or session identifiers and technical information needed to operate the widget and retrieve the conversation.
• Internal workspace information: staff messages, private notes and operational records where those functions are used.
• Security and service records: authentication and access events, audit records, IP addresses, browser or device details and technical logs.
• Business administration: subscription and billing records where applicable, and information you provide in support or privacy enquiries.

Do not send passwords, access tokens or payment-card details through conversations or privacy requests. Organisations should limit sensitive information to what is necessary and lawful for their purposes.

4. Why we use information

We use information to operate accounts and organisations; authenticate users; apply access permissions; receive, route and display communications; maintain conversation history; provide support; investigate faults; prevent misuse; protect the service; maintain audit records; administer subscriptions where applicable; and meet legal obligations.

Account and authentication information is needed to provide protected workspace access. If required details are not supplied, we may be unable to create an account, authenticate you or provide the relevant service. Optional information is not a condition of using unrelated functions.

We use contact information to respond to enquiries and send necessary service communications. Any direct marketing must comply with applicable marketing rules and opt-out rights. This policy does not grant permission for marketing, optional tracking or new uses of customer conversations.

5. Legal bases for processing

Where we act as controller, the relevant UK GDPR basis depends on the activity:

• Contract: providing services under a contract with you, or taking steps you request before entering into one.
• Legitimate interests: administering business-customer relationships, supporting users, maintaining reliable services, preventing fraud and protecting accounts, subject to your interests and rights. This may apply to business representatives who are not personally party to the service contract.
• Legal obligation: keeping records or responding to requests where the law requires it.
• Consent: where required for a particular activity, such as certain marketing or non-essential storage technologies. You may withdraw consent without affecting earlier lawful processing.

For customer data processed on a business’s instructions, the business is responsible for identifying its lawful basis. Processing must follow its lawful documented instructions and the applicable agreement.

6. WhatsApp and other communication platforms

inboxiz integrates with the WhatsApp Business Platform provided by Meta. Authorised connections can make messages, contact and channel identifiers, communication metadata, supported attachments and delivery information available to inboxiz so that the relevant business can manage conversations.

Meta also handles information under its own terms and WhatsApp Privacy Policy. Connecting a channel does not make inboxiz responsible for every use of information by the platform provider.

Businesses must give their customers appropriate notices and obtain any permissions required for their communications. Private workspace information must be handled according to its intended audience and access permissions. This policy does not advertise unlaunched channels or authorise outbound messaging.

7. Who receives information

Information may be available to authorised personnel of the organisation responsible for a conversation, and to our personnel where needed for service operations, support or security.

The current service uses Cloudflare for web hosting and delivery, Supabase for backend services including authentication, database and supported file storage, and Meta/WhatsApp for the WhatsApp integration. Their involvement and the information they receive depend on the function used. Their processing responsibilities depend on applicable law, their terms and the relevant contractual arrangements.

Other recipients may include professional advisers, and authorities where disclosure is legally required or necessary to establish, exercise or defend legal rights. Payment-provider involvement, if introduced for a particular service, must be explained in the applicable payment information.

8. International processing

Our hosting, backend and messaging providers operate internationally. Information may be processed outside the UK, including in locations used by the relevant communication platform. This policy does not promise that every category of information remains in one country.

Where a transfer is restricted by UK data protection law, an applicable transfer mechanism is required, such as UK adequacy regulations or appropriate contractual safeguards with any necessary additional protections. Contact admin@ogixo.com for information about the countries, arrangements and relevant safeguards for your processing, including how to obtain a copy or description of applicable safeguards.

9. Data retention

Retention depends on the category of information and the reason it is held. We use the following criteria rather than applying one blanket period:

• Accounts and organisation records: the duration of the relationship, information needed to administer its closure, and applicable record-keeping or claims requirements.
• Messages, contacts and attachments: the business’s lawful instructions and service arrangements, the purposes for which the conversation is retained, and applicable legal requirements.
• Security and audit records: the period needed to investigate incidents, protect the service, demonstrate authorised activity and address disputes.
• Support, privacy and administration records: the time needed to handle the enquiry and retain necessary evidence of its resolution.

Ordinary workspace users cannot erase or rewrite conversation history at will. Deletion and rights requests require a controlled assessment. Legal holds and other lawful exceptions can affect removal. Backup copies, where present, may follow a separate lifecycle and may not be removed at the same time as active records. Ask us or the relevant business for the arrangements applying to your information.

10. Security

Implemented controls include authentication, server-side permissions, organisation-scoped access checks and audit records. Protected administrative operations use multi-factor authentication checks. Security also depends on the configuration and operation of the service and the connected providers.

No internet service can guarantee absolute security. Organisations must manage authorised users and permissions, and users must protect their credentials. Report suspected unauthorised access to admin@ogixo.com without including passwords or tokens.

11. Cookies and similar technologies

The application uses browser storage for authentication sessions and essential functionality. Website chat uses session information to associate visitors with their conversations. Storage technologies may be used by the platforms you choose to use, such as WhatsApp, under their own notices.

This privacy page does not load advertising, analytics, a chat widget or an authentication client, and does not require cookie acceptance to read it. Any non-essential tracking introduced elsewhere must be explained and, where required, used only with valid consent. You can manage browser storage through your browser settings; removing necessary session information may sign you out or interrupt chat continuity.

12. Your privacy rights

Depending on the processing and applicable exceptions, you can ask to access your personal information, correct inaccuracies, erase information, restrict its use or receive a portable copy. You can object to processing based on legitimate interests and object to direct marketing. Where processing relies on consent, you can withdraw it.

For information we control, send your request to admin@ogixo.com. Explain the request and how you interacted with inboxiz. We may need proportionate information to verify identity or clarify the request; do not send identity documents unless requested through an appropriate process. We will handle requests within the applicable legal time limits.

For conversations controlled by a business using inboxiz, contact that business first. We assist it with requests as required by our role and obligations.

You can complain to the UK Information Commissioner’s Office (ICO). You do not have to contact us before doing so, although we welcome the opportunity to resolve concerns.

13. Children’s information

inboxiz is intended for business use and does not invite children to create business administrator accounts. A business receiving communications from minors remains responsible for the lawfulness of its processing and for age-appropriate information and safeguards.

14. Changes to this policy

We may update this policy when processing practices, services or legal requirements change. The date and version above identify this publication. Where required, material changes or new purposes will be brought to the attention of affected people.

15. Contact and privacy requests

For privacy questions, rights requests or concerns about information controlled by inboxiz, contact:

Please do not include passwords, access tokens, unnecessary identity documents or other unnecessary sensitive information.