Privacy Policy

1. Who is the data controller

Xerix is a product operated by Rodrigo Alejandro Camacho (registered name CAMACHO RODRIGO ALEJANDRO), CUIT 20-29328374-6, with address at Av. Cabildo 1324, Ciudad Autónoma de Buenos Aires, Argentina.

For any question about your data, write to us at hola@xerix.ar or call +54 11 3061-3429.

2. Scope and roles

This policy covers four situations, and Xerix's legal role in each one:

• Visitors to xerix.ar: when you browse or write to us through the form, Xerix is the controller of that data.
• End customers of businesses: when a business uses Xerix to serve its own customers (through WhatsApp, email or other channels), Xerix processes those messages as a processor on behalf of and under the instructions of that business, which is the controller of that data.
• Staff of client businesses: when a person uses the Xerix panel (the application business teams use to handle their messages) on behalf of the business they work for, Xerix processes their data as a processor, on behalf of that business.
• Acceptance records for the panel terms: when a person accepts the Terms and Conditions of Use of the panel, Xerix is the controller of that record, which it keeps as proof of acceptance.

3. What data we process

We process different data depending on the case:

• Website: the data you leave in the demo request form (name, email, phone, company, industry, channels you use, monthly message volume and your message), plus minimal technical data (for example, your preferred language).
• Messages, on behalf of the client business: message content and metadata (sender, recipients, phone number or email address, and date), the conversation history, and the data the business records in its CRM (its customer database) from those messages. This may include data about other people mentioned in the conversation (for example, the name, age or ID document of a family member or companion) and, when they appear in it, health data such as allergies or dietary restrictions. Health data or other sensitive data are only processed when they appear in the conversation and to provide the service the person asked for; the client business is responsible for having the legal basis to process them.
• Staff who use the panel, on behalf of the client business: name, email, position, grammatical gender (for drafting replies), signature, language, availability (for example, absences), their activity in the panel and, when the feature is active, a profile of their writing style (vocabulary, tone, formality) and examples of their previous messages. To identify their own style, we compare their vocabulary with that of their colleagues at the same company. If the business connects a person's mailbox, also the access credentials for that mailbox, which we keep under restricted access (and encrypted where stored in Xerix's main database).
• Acceptance records for the panel terms: name, email, the accepted version, a code that identifies the exact text accepted, the IP address from which it was accepted and the date and time the server received it.

4. For what purpose

We use the data to:

• Answer your inquiries when you write to us, and follow up on them.
• Operate the service: read incoming messages, record in the business's CRM the data that arises from them, generate reply drafts with artificial intelligence, and assist the business team in responding.
• Personalize the assistant solely within each business's account, with an isolated profile that learns its style and history. We do not use the data we process for a business, through any channel, or its anonymized, aggregated or derived forms, nor do we allow others to use them, to create, develop, train or improve general or non-personalized artificial intelligence models. We only process them with artificial intelligence providers that are contractually prohibited from using them to create, develop, train or improve any model. This expressly includes WhatsApp data and data from Google Workspace APIs (such as the Gmail API): Google Workspace APIs are not used to develop, improve, or train non-personalized AI and/or ML models.
• Give the staff of each client business access to the panel.
• Record and prove acceptance of the panel terms, enable staff access and inform their business whether they accepted.
• We do not use your data to sell it or for advertising.

5. Legal basis for processing

We process your data on the basis of your consent and of the commercial relationship between us. For the messages we process for a business and for the staff who use the panel, processing follows the instructions of the client business, which must have the corresponding legal basis (for example, the consent of its contacts). We process the acceptance record for the panel terms because it is necessary for the relationship that arises from that acceptance (proving it, enabling access and informing the business), not on the basis of consent.

6. Who we share it with

We share data only with the providers that help us deliver the service and, for the acceptance record of the panel terms, with the company that requested the access; always, only what is necessary:

• The messaging channels each business connects, such as the WhatsApp Business Platform or its email account (for example, Google Workspace), as the channel for messages.
• The artificial intelligence providers that process messages to generate drafts and record data in the CRM, under the conditions in section 4.
• The hosting providers for the website (whose server also stores the acceptance records for the panel terms and hosts the mailbox where we receive a notice of each acceptance) and for the service infrastructure.
• The form service that receives what you send us from the website's demo form, the email provider where we receive it, and the service we use to send system emails (for example, staff invitations).
• The company that requested your access to the panel: we let it know whether you accepted the panel terms.
• We do not sell or rent your data to third parties.

7. International transfers

Some of these providers process data outside Argentina, including in countries that the Argentine data protection authority (AAIP) does not recognize as providing adequate protection. You can ask us for the current list of providers and countries by writing to hola@xerix.ar.

8. How long we keep it

We keep data while the client business account is active and while it is necessary for the stated purpose. We keep the inquiries you send us from the website for up to 24 months to reply and follow up, unless you ask us to delete them sooner. Upon a deletion request, we remove it. Technical records (logs) are kept for a limited period, between 30 and 90 days, for security reasons. We keep acceptance records for the panel terms (including the IP address from which they were accepted) and the email notices of each acceptance while the person has access to the panel and for up to 5 years after that access is deactivated (if access is never enabled, for up to 5 years after the acceptance), as proof of acceptance; after that we delete them. A person's style profile is deleted within 30 days after their access is deactivated.

9. Security

We apply technical and organizational measures to protect your data: encryption in transit, panel login passwords stored hashed, connected-account credentials under restricted access (and encrypted where stored in Xerix's main database), encrypted backups, restricted access control, and isolation of each client's information. No system is infallible, but we work to minimize the risks.

10. Your rights

As the data subject, you have the right to access, rectify, update and delete your personal information, in accordance with Argentina's Personal Data Protection Law No. 25.326.

You can exercise them by writing to us at hola@xerix.ar. We respond to access requests within 10 calendar days, and to rectification, update or deletion requests within 5 business days.

The Agency for Access to Public Information (AAIP), the enforcement authority of Law 25.326, is the body before which you may file a complaint if you believe your rights were not addressed.

11. How to request deletion of your data

You can request that we delete your data at any time:

• Write to us at hola@xerix.ar with the subject "Data deletion" and tell us which data you want us to delete.
• We process the request and confirm deletion within the legal timeframes stated above.
• If you are a customer of a business that uses Xerix, or you work for one, that business is the controller of your data: you can ask it directly for deletion and, if you write to us, we will forward your request without delay, within 2 business days at the latest; the deletion is decided by that business. The exception is the record of your acceptance of the panel terms: Xerix is the controller of that record, and we handle that request ourselves.

12. Minors

Xerix is not directed at minors. The business that uses Xerix is responsible for the age and consent of its contacts. If we are informed that we are processing a minor's data without proper authorization, we delete it.

13. Changes to this policy

We may update this policy. When we do, we will publish the new version on this same page, with its update date.

14. Connected accounts: Google, Microsoft and Meta

When a business connects a Gmail (Google), Outlook (Microsoft) or WhatsApp (Meta) account, Xerix accesses that account's messages through each provider's official APIs, with the explicit authorization of the account holder or of their organization's administrator (for example, through Google Workspace domain-wide delegation), and solely to provide the service described in this policy. Messages sent or received through WhatsApp are also processed by WhatsApp/Meta under the WhatsApp Business Terms and Privacy Policy.

• Xerix's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
• We use data from your connected accounts only for user-facing product features (reading and organizing messages, recording their data in the business's CRM, learning the writing style, and preparing replies). We do not use it for advertising and we do not sell it. No one at Xerix reads your messages, except specific messages with your consent, for security purposes (for example, to investigate a bug or abuse), or where required by law.
• You can revoke access at any time from your Google, Microsoft or Meta account or, if the connection was authorized by your organization's administrator, ask them to revoke it from the admin console (for example, Google Workspace's). From that moment Xerix stops accessing it; data already stored is kept and deleted as described in section 8.

15. Independence from Meta, WhatsApp and Instagram

Xerix is an independent product operated by Rodrigo Alejandro Camacho. It is not affiliated with, associated with, authorized, endorsed, or sponsored by Meta Platforms, Inc., WhatsApp LLC, or Instagram. "WhatsApp" and "Instagram" are trademarks of Meta Platforms, Inc. Xerix uses the WhatsApp Business Platform solely to integrate with these services.

16. Contact

For any question about this policy or about your personal data, write to us at hola@xerix.ar.