StrixInbox Privacy Policy

• Legal name: OPRA Sociedad Anónima
• Corporate ID (cédula jurídica): 3-101-248847
• Trade name: Hivestrix
• Platform: StrixApps
• Registered address: San Isidro de Heredia, Bodegas El Trapiche #1, Heredia, Costa Rica
• Contact and privacy email: [email protected]
• Phone: +506 6059 0207

OPRA Sociedad Anónima is a company incorporated under the laws of the Republic of Costa Rica. This Privacy Policy (the “Policy”) describes how we collect, use, store, protect, share and delete the personal data processed through StrixApps and our website, in accordance with Law No. 8968 on the Protection of Individuals with regard to the Processing of their Personal Data and its Regulations (Executive Decree No. 37554-JP).

This Policy applies to:

• The public StrixApps website, including its contact and demo request forms.
• The StrixApps operations panel (web interface) used by the agents and administrators of our business customers.
• The integration with the WhatsApp Business Platform (Meta's WhatsApp Cloud API) through which the StrixInbox module receives and sends messages on behalf of the business customer.
• Any additional channels the customer enables (email, web chat, SMS, social networks and other connectors).
• The automated customer service features assisted by artificial intelligence.

It does not apply to third party websites, applications or services (including Meta, Google and Amazon Web Services) that are governed by their own policies.

• Personal data: any information relating to an identified or identifiable natural person.
• Business customer: the company or organization that subscribes to StrixApps and connects its communication channels.
• End customer / user: the person who communicates with the business customer through WhatsApp or another connected channel.
• Operator / agent: a person authorized by the business customer to use the StrixApps panel.
• Visitor: a person who browses the public website or submits a demo request.
• Tenant: the logical, isolated data space corresponding to a business customer.
• Controller / Processor: roles defined in section 13.

StrixApps is a B2B (business to business) platform for business management and customer service. Accordingly:

• With respect to end customer data (messages, phone numbers, conversation content), the business customer acts as the Controller and Opra acts as the Processor, processing such data solely on behalf of and under the instructions of the business customer.
• With respect to operator data, website visitor data and the contractual relationship with the business customer, Opra acts as the Controller.

Sections 5 to 12 describe the categories, purposes and safeguards regardless of role; section 13 details the allocation of responsibilities.

5.1 End customer data (WhatsApp and other channels)

Received through Meta's WhatsApp Business Platform or other connected channels:

• Contact identifiers: phone number in international format (wa_id), public WhatsApp profile name, email address or social network identifier, depending on the channel.
• Message content: text of incoming and outgoing messages.
• Media files: images, audio and voice notes, videos, documents and stickers sent in the conversation, together with their technical metadata (MIME type, file name, size).
• Conversation metadata: timestamps, message identifiers, read status, labels and internal notes added by operators.
• AI extracted data: structured information that the automated customer service system infers from the message content (for example, intent, priority, sentiment or the details of an order or request) to assist in providing service.

5.1.1 Numbers connected from the WhatsApp Business app (coexistence)

The business customer may connect to StrixInbox a number it already uses in the WhatsApp Business app on its phone, without ceasing to use the app (a feature Meta calls coexistence). In that case, in addition to what is stated in section 5.1, and always at the request and with the authorization of the business customer given in Meta's flow:

• Conversation history: Meta may deliver to StrixApps the message history of the WhatsApp Business app, up to the period Meta allows (currently up to six months), only if the business customer agrees to share it during the connection.
• Contacts: the names and numbers in the WhatsApp Business app address book, and their subsequent changes, in order to identify conversations.
• Messages sent from the app: messages the business customer writes from the phone are mirrored in StrixInbox to keep each conversation complete. These messages do not trigger AI automated customer service.

This information is processed for the same purposes and with the same security measures, retention periods and deletion mechanisms as the rest of the WhatsApp channel data.

5.2 Operator and administrator data

• Operator name and identifier, email address associated with the operator account, derived initials/avatar and role within the panel.
• Activity logs necessary for security and traceability.

5.3 Configuration data and connection credentials

• WhatsApp Business account identifiers (phone number id, WABA id) and the display name of the number.
• Access credentials for the WhatsApp Platform (access tokens, app secret, verify token) and, where applicable, the identifier of the Meta user who authorized the connection (in order to handle deletion requests). These credentials are stored encrypted (see section 10).

5.4 Technical and usage data

• IP address, request identifiers, browser type and log data generated when using the panel, for security, abuse prevention and diagnostic purposes. Application logs are designed not to include message content or secrets.

5.5 Website visitor and demo requester data

When a person completes the contact form or requests a demo on our website, we process the data they voluntarily provide:

• Name of the contact person.
• Company or organization (optional field).
• Work email address.
• Message or description of the need they present to us.

This data is used exclusively to respond to the request, prepare the demo and maintain the resulting business communication. It is not used for third party advertising nor transferred for unrelated commercial purposes. With respect to this data, Opra acts as the Controller.

We do not deliberately request or process special categories of data (health, religion, orientation, etc.). If an end customer freely includes such data in a message, it will be processed as part of the conversation content under the responsibility of the business customer.

• Directly from the user: when they write to the business customer's WhatsApp number or another channel, or when they complete a form on our website.
• From the WhatsApp Business Platform (Meta): which delivers messages to StrixApps through signed webhooks, including, for numbers connected through coexistence, the history, contacts and messages sent from the WhatsApp Business app (section 5.1.1).
• From the business customer: when configuring accounts, catalogs and integrations.
• From third party integrations enabled by the customer (for example, an ERP), where applicable.

• Receiving, displaying, organizing and responding to customer service conversations: Performance of the contract with the business customer / legitimate interest of the business customer in serving its users
• Automating responses and extracting data with AI to assist customer service: Performance of the contract / legitimate interest, under the instructions of the business customer
• Storing conversation history and media files: Performance of the contract
• Handling demo requests and commercial inquiries from the website: Consent of the person when submitting the form / pre-contractual measures at their request
• Authenticating operators and protecting the system: Legitimate interest in security / legal compliance
• Complying with legal obligations and requests from authorities: Legal obligation
• Handling rights requests and data deletion requests: Legal obligation

Where the legal basis is consent, it is the business customer's responsibility to obtain it from its end customers in accordance with WhatsApp/Meta policies (opt-in) and applicable law (see section 13.2). With respect to website forms, consent is given directly by the person when submitting them and may be withdrawn at any time by writing to [email protected].

StrixApps includes, in its StrixInbox module, an optional AI assisted automated customer service feature that uses the Google Gemini language model (Google LLC) through its API.

• AI processing occurs only when the feature is enabled. Only in that case may the content of conversations (messages and, where applicable, their files) be processed by a third party artificial intelligence provider, currently Google Gemini, for the purpose of assisting in customer service. If the feature is disabled or no AI credentials are configured, no conversation data is sent to the AI and customer service is entirely manual.
• Enabling the feature is a decision of the business customer, configurable per channel or number; it may enable or disable it at any time.
• AI is used mainly to extract and classify information from the message into a structured format; business logic and responses are determined by the system, not by an uncontrolled generative model.
• Message content is transmitted to the AI provider only to the extent necessary to produce the requested assistance.
• The AI does not make automated decisions with significant legal effects on individuals without the possibility of human oversight. Operators may intervene, correct and manually take over any conversation (handoff).
• If there are no AI credentials, the system safely falls back to manual customer service.

Processing by the AI provider is additionally governed by Google's terms and privacy policy.

9.1 Recipients and processors

To provide the service we share data with:

• Meta Platforms, Inc. / Meta Platforms Ireland Ltd., as operator of the WhatsApp Business Platform, for sending and receiving messages. Meta processes this data in accordance with its own terms and policies.
• Google LLC, provider of the Gemini API for the AI feature, when the business customer enables it.
• Amazon Web Services, Inc. (AWS), cloud infrastructure provider, under the managed hosting arrangements described in section 9.2.
• Competent authorities, where there is a legal obligation or valid request.

We do not sell personal data or transfer it to third parties for their own advertising purposes.

9.2 Hosting arrangements

Where the data resides depends on the arrangement contracted by each business customer:

• Customer's own infrastructure (default arrangement). The data remains on the business customer's servers. Opra does not host it and only accesses it to the extent necessary for the technical support expressly contracted.
• Opra's own servers, when the business customer expressly requests or accepts it.
• Managed cloud hosting on Amazon Web Services (AWS) or another infrastructure provider. The provider and hosting region may be negotiated with the business customer and will be set out in the contract or service order.

The arrangement applicable to each business customer is set out in its contract or service order.

9.3 International transfers

Some of these providers may process data outside Costa Rica (for example, in the United States or the European Union). In such cases we adopt appropriate safeguards, contractual clauses, contractual commitments from providers and technical security measures, to protect the information in accordance with Law No. 8968, its Regulations and applicable international standards.

We apply appropriate technical and organizational measures, including:

• Encryption in transit: all calls to the WhatsApp Platform and all file downloads are made over HTTPS/TLS; the panel and the website are served over HTTPS.
• Encryption at rest of credentials: access tokens, the app secret and the verify token are stored encrypted with AES-256-GCM using a key managed by the operator; they are never stored in plain text or exposed in the interface or in logs.
• Tenant isolation (multitenancy): each business customer resides in an isolated data space. In database mode, row level security (RLS) enforced per tenant is applied, so that a query cannot cross data between customers.
• Webhook authenticity verification: every incoming Meta event is validated using an HMAC-SHA256 signature before being processed.
• Access control to the panel through authentication, with constant time credential comparison and protection against abuse (rate limits).
• Minimization in logs: logs are designed not to contain message content or secrets.
• Restrictive permissions on files containing sensitive data.

No measure is infallible; in the event of a security breach affecting personal data, we will act in accordance with applicable law and, where appropriate, notify the affected individuals and the competent supervisory authority.

• Conversations, messages and media: retained for as long as the relationship with the business customer exists and in accordance with its instructions and retention policies, unless a longer retention period is required by law.
• Connection credentials: retained while the WhatsApp account remains connected; deleted when it is disconnected (see section 12).
• Technical and log data: retained for the period necessary for security and diagnostics and then deleted or anonymized.
• Website form data: retained while the request is handled and, if it does not lead to a contractual relationship, for a maximum of twelve (12) months, unless the person requests its deletion earlier.

Upon termination of the contractual relationship, the data processed on behalf of the business customer is deleted or returned as agreed and in accordance with the StrixInbox Data Deletion Policy.

StrixApps implements deletion mechanisms aligned with Meta's requirements:

• Deauthorize callback: when a person removes the application from Meta, StrixApps revokes the credentials of the connected accounts and deletes the associated data.
• Data deletion request callback: upon a verified request from Meta, StrixApps deletes the associated conversations, messages, contacts, leads and media files, and returns a confirmation code and a status URL.
• These requests are cryptographically verified (signed_request signature) before being executed.
• Disconnecting a number connected through coexistence stops synchronization with the WhatsApp Business app; the phone app and its conversations are not affected by deletion in StrixApps.

The full procedure, including timeframes and request channels, is detailed in the StrixInbox Data Deletion Policy. In addition, any person may exercise their right to erasure in accordance with section 14.

13.1 Opra as Processor

With respect to end customer data, Opra:

• Processes the data only in accordance with the documented instructions of the business customer.
• Applies the security measures set out in section 10.
• Assists the business customer in responding to individuals' rights requests.
• Does not disclose the data to third parties except to the necessary processors (section 9) or where required by law.
• Deletes or returns the data at the end of the relationship, as agreed.

13.2 Obligations of the business customer (Controller)

The business customer undertakes to:

• Obtain the consent and opt-in of its end customers in accordance with the WhatsApp Business Messaging Policies and applicable law.
• Inform its end customers about the processing and provide them with this Policy where appropriate.
• Use StrixApps for lawful purposes and not send prohibited communications (spam, unlawful content).
• Respond, as Controller, to the rights requests of its end customers, with our assistance.

13.3 Opra as Controller

With respect to operator data, website visitor data and the contractual relationship, Opra acts as the Controller and directly assumes the obligations of information, security and handling of rights described in this Policy.

In accordance with Law No. 8968 and applicable regulations, individuals have the right to:

• Access their personal data.
• Rectification of inaccurate data.
• Erasure / deletion (the “right to be forgotten”).
• Objection to and restriction of processing.
• Portability, where applicable.
• Withdrawal of consent, where the processing is based on it.

How to exercise them: by writing to [email protected] or calling +506 6059 0207. We may request additional information to verify the identity of the requester. We will respond within the applicable legal timeframes, which under Law No. 8968 are five (5) business days, unless a legally permissible extension applies.

If the data relates to a person's relationship with a business customer (end customer), we will forward the request to that business customer in its capacity as Controller, providing it with assistance and notifying the requester of such referral.

StrixApps is a professional tool aimed at businesses and is not intended for minors as panel users. We do not knowingly collect data from minors. If a minor end customer communicates with a business customer, the processing of that data is the responsibility of the business customer in accordance with the law.

The StrixApps panel uses a strictly necessary session cookie to maintain operator authentication and to enable real time updates of the inbox.

The public website does not use advertising, third party tracking or profiling cookies. Nor do we use advertising identifiers or share browsing data with ad networks.

If in the future we incorporate analytics or any technology that is not strictly necessary, we will request the prior consent of the user and update this Policy.

We may update this Policy to reflect legal, technical or service changes. We will publish the current version with its “Last updated” date. Material changes will be communicated through reasonable available means and, where they affect business customers, at least thirty (30) calendar days in advance.

OPRA Sociedad Anónima, Hivestrix brand · StrixApps Corporate ID (cédula jurídica): 3-101-248847 Address: San Isidro de Heredia, Bodegas El Trapiche #1, Heredia, Costa Rica Privacy email: [email protected] Phone: +506 6059 0207

If you believe your rights have not been addressed, you may contact Costa Rica's Agency for the Protection of Inhabitants' Data (PRODHAB), or the competent supervisory authority in your jurisdiction.