Privacy Policy

Last updated: 16 October 2026.

Xyra Chat (the "Service"), operated by Mll Nexus Group SL ("we", "us"), is a multi-channel customer-messaging platform. This policy explains what personal data we process, why, and the rights you have. It is written to align with the EU General Data Protection Regulation (GDPR) and the UK GDPR.

1. Controller vs. processor

For the conversation data our customers handle through the Service — the messages, contacts, and channel identifiers of the people they talk to — the customer (the business using Xyra Chat) is the data controller and we act as a data processor on their instructions. For our own account and analytics data (your name, email, billing, product usage), we are the controller.

2. Data we process

• Account data: name, email, hashed password, role, organization, availability.
• Customer conversation data (on behalf of customers): message contents, contact names / phone numbers / emails / social handles (Instagram username, Messenger PSID) and profile pictures, attachments, tags, notes, conversation metadata, and opt-out status (when a contact replies STOP we flag them and stop messaging).
• Channel credentials: access tokens for connected channels, encrypted at rest in Supabase Vault (only a vault reference lives in the database).
• Billing data: plan, subscription status, and a Stripe customer reference. Card details are handled by Stripe — we never see or store them.
• Usage analytics: feature events via PostHog (EU). We do not record sessions or capture message contents in analytics.
• Content reports and blocking: when a team member reports a message, contact, Instagram comment or teammate, or blocks a contact or teammate, we store who reported it, the reason and any note they add, and a frozen copy of the reported content so our team can review it; blocked contacts are marked so their new messages are dropped. Reports are reviewed by Xyra Chat staff and kept as an audit record.

3. AI processing

AI features run only after a workspace owner or admin has accepted the AI processing disclosure in Settings → AI, and the agent-facing tools (AI Assist, Suggest reply, Translate) only after the individual team member has also accepted it. Either acceptance can be withdrawn there at any time, which stops the corresponding AI features for that workspace or person.

When they run, the following is sent to our AI sub-processors to generate the result: the message text selected or the recent messages of the customer conversation being answered; attachments the AI needs to read (images, the text of documents, and voice-note or voicemail audio for transcription); context that helps the reply — the workspace name, the contact's name and tags, relevant excerpts of the workspace's own knowledge sources — and the names of team members the assistant can hand a conversation to. Short summaries of this conversation and of earlier conversations with the same contact, how many there were and when you first spoke. We do not send passwords, payment details, access tokens, contacts' phone numbers or email addresses (only whether one is on file), or your private notes on a contact.

Anthropic (Claude) generates assistant replies, AI Assist rewrites, suggested replies, translations and conversation summaries. OpenAI computes the embeddings used for knowledge search, transcribes voice notes and voicemails (Whisper), produces voice-menu audio (TTS), and — only when a workspace selects OpenAI as its provider in Settings → AI — generates the replies instead of Anthropic. Both act as sub-processors in the United States and, per their API terms, do not train their models on data sent via their APIs.

4. Legal bases (GDPR Art. 6)

• Performance of a contract — to provide the Service.
• Legitimate interests — security, product analytics, abuse prevention.
• Consent — non-essential cookies (EU visitors) and marketing.
• Legal obligation — tax, accounting, lawful requests.

5. Sub-processors

We share data with the following sub-processors strictly to run the Service:

6. International transfers

We host primary data in the EU where possible (Supabase Ireland, PostHog EU). Some sub-processors (e.g. Anthropic, OpenAI) process data in the US under Standard Contractual Clauses and/or the EU–US Data Privacy Framework.

7. Retention

We use soft-deletion across the platform. When a workspace's paid plan ends, the workspace is paused (nothing is deleted) and, 30 days later, deactivated. Deleted and deactivated data can be restored on request and is not erased permanently on its own: you can request permanent erasure at any time by emailing privacy@xyrachat.com, and we do it within one month. Account data is kept for the life of the account plus any legally required period.

8. Your rights & how to delete your data

Under the GDPR you may request access, rectification, erasure, restriction, portability, and object to processing.

Delete your data. You can delete your account at any time: sign in and go to Settings → Account → “Delete my account” (in the mobile app: Settings → Delete account). Every workspace where you are the only owner is deleted with your account; you simply leave any other workspace, and you see the list before you confirm. A workspace owner can also delete one workspace and all its data (conversations, contacts, channels, bots, automations, broadcasts, billing and team records) without deleting their account: Settings → Team → “Delete this workspace”, then type the workspace name. Deleted data is deactivated immediately and can be restored on request for at least 30 days. To have it erased permanently, or to get an export, email privacy@xyrachat.com from your account email; we do it within one month.

End customers of a business that uses Xyra Chat should contact that business (the data controller) to exercise their rights; we act as processor and assist the business in responding.

9. Cookies

We use essential cookies for authentication. Analytics cookies (PostHog) load only after consent for visitors in the EEA, via our cookie banner.

10. Security

Data is isolated per organization via row-level security, channel access tokens are encrypted in Supabase Vault, API keys are stored only as salted hashes, and all webhooks are signature-verified.

11. Contact

Privacy questions: privacy@xyrachat.com. Operator: Mll Nexus Group SL, Calle Poetas Españoles 1, Local 1, 38678 Armeñime, Santa Cruz de Tenerife, Spain. As an EU-established company we are not required to appoint an Article 27 EU representative; we have not appointed a dedicated Data Protection Officer — privacy enquiries reach us at the address above.

Terms of Service