Privacy Policy

Xyra Chat is operated by Mll Nexus Group SL (“Xyra Chat”, “we”, “us”), with registered office at Calle Poetas Españoles 1, Local 1, 38678 Armeñime, Santa Cruz de Tenerife, Spain. We provide a unified customer-messaging inbox with AI assistance.

This policy explains what personal data we process, why, and the rights you have. For privacy questions, contact privacy@xyrachat.com. See also our Legal notice (Aviso legal).

• Account information — name, email, company, and login credentials (passwords are hashed; we never see them in plaintext).
• Billing information — handled by Stripe; we store only subscription status and the last four digits / card brand, never full card numbers.
• Usage data — feature usage, settings, and logs needed to run and secure the service.
• Customer messages and media — conversations and attachments exchanged on WhatsApp, Instagram, Facebook Messenger, Telegram, Email and website live chat, including text, images (which our AI may analyse), voice notes (which we may transcribe), files, and metadata such as timestamps and channel identifiers. We process this content to deliver, route, transcribe, translate, and assist with replies. AI processing uses the providers listed under Subprocessors; this content is not used to train their models.
• Analytics — privacy-friendly, EU-hosted product and web analytics (no session recording).
• Support requests — anything you send us when you contact support.

• To provide, maintain, and secure the service.
• To power AI features (translation, suggested replies, knowledge-base answers).
• To process payments and manage your subscription.
• To communicate with you about your account, security, and product updates.
• To understand and improve how the product is used, in aggregate.
• To comply with legal obligations and prevent abuse.

• Performance of a contract — to deliver the service you signed up for.
• Legitimate interests — to secure, debug, and improve the service, and to prevent fraud and abuse, balanced against your rights.
• Consent — for non-essential analytics cookies and optional marketing communications, which you can withdraw at any time.
• Legal obligation — where we must retain or disclose data to comply with the law.

We use the following subprocessors to run Xyra Chat. Each is bound by a data-processing agreement and appropriate safeguards.

We keep your data for as long as your account is active. After cancellation we retain it for 30 days so you can reactivate or export, then permanently delete it from production systems (backups expire on a rolling schedule). You can request earlier deletion at any time.

By category:

Under the GDPR you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erasure (“right to be forgotten”).
• Portability — receive your data in a machine-readable format.
• Restriction of processing in certain circumstances.
• Objection to processing based on legitimate interests.

To exercise any of these, email privacy@xyrachat.com. You also have the right to lodge a complaint with your local data protection authority.

Customer data is stored in the European Union. Where a subprocessor operates outside the EU (for example, certain AI providers), transfers are protected by Standard Contractual Clauses and additional safeguards. Our analytics run on PostHog’s EU instance.

Questions about this policy or your data? Email privacy@xyrachat.com. See also our GDPR & data processing and cookie policy pages, or learn how we keep data safe on our security page. Mll Nexus Group SL.