Privacy Policy

1. Who is who

Our customers are businesses that sign up for Prexa. For the messages, contacts and other data a customer brings into the platform, the customer decides why and how it is used and is the data controller (the "data fiduciary" under India's Digital Personal Data Protection Act, 2023). Prexa acts as their processor and handles that data only on their instructions.

For our website visitors and for our customers' own account details, Prexa is the controller. If you are a customer of one of our customers (for example you messaged a shop on WhatsApp) and want to see or delete your data, please contact that business first. You can also write to us at prexalabs@gmail.com and we will help.

2. What we collect

• Account data: name, work email, phone number, business name, role and login credentials of our customers and their team members.
• Conversation data: messages, media, contact names and phone numbers, Instagram and Facebook profile identifiers, delivery status and timestamps that pass through the channels a customer connects.
• Connected-account data: access tokens and IDs for WhatsApp Business, Instagram, Facebook Pages, YouTube and Shopify accounts a customer chooses to connect. Tokens are stored encrypted.
• Content a customer uploads: knowledge-base documents, templates, flows, and photos or videos scheduled through the Social Poster.
• Billing data: plan, wallet balance, usage and invoices. We do not store full card numbers.
• Technical data: IP address, browser, device, pages visited and security logs.
• Website enquiries: what you type into our contact form or chat widget, which opens your email app or WhatsApp to reach us.

3. How we use it

• To provide the platform: send and receive messages, run automations and show the team inbox.
• To generate AI replies and summaries when a customer turns the AI assistant on.
• To publish posts to YouTube, Facebook and Instagram when a customer asks us to.
• To secure accounts, prevent abuse, fix bugs and meet legal duties.
• To bill, support and communicate with customers about their account.

We do not sell personal data, and we do not use customer conversations to advertise to anyone.

4. Meta platform data

Prexa is built on Meta's official WhatsApp Business Platform, Instagram and Messenger APIs. Data we receive from Meta through a customer's connection is used only to give that customer the features they asked for. We do not use it to build profiles, we do not sell it, and we do not share it with data brokers. Our handling follows Meta's Platform Terms and WhatsApp Business policies. WhatsApp, Instagram and Messenger are trademarks of Meta Platforms, Inc.; we are not affiliated with or endorsed by Meta.

5. Google and YouTube

If a customer connects YouTube, we request access only to upload videos to the channel they select. We use that access for no other purpose, and the customer can revoke it at any time at myaccount.google.com/permissions. Prexa's use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

6. AI providers

When the AI assistant is on, the relevant message text and any knowledge-base content needed to answer are sent to a third-party AI model provider (such as Anthropic, OpenAI or Google) to produce a reply. Customers choose whether to enable AI, and which provider, in their dashboard. We do not permit providers to train their models on this data under our agreements where that option is available.

7. Who we share data with

• Meta, Google and Shopify, as needed to send messages, publish posts and sync orders for a customer.
• Infrastructure and service providers: Cloudflare (hosting and database), Hostinger (this website), and email delivery services.
• AI model providers, as described above.
• Authorities, when the law requires it, or to protect rights and safety.
• A buyer, if Prexa is ever merged or acquired, under the same protections as here.

8. Where data is stored and for how long

Data is processed on Cloudflare's global network and may be handled outside India. We keep data while an account is active. After a workspace is deleted we remove its data from live systems promptly; encrypted backups are overwritten on their normal cycle. Records we must keep by law, such as invoices, are retained for the required period.

9. Security

We use HTTPS everywhere, encrypt stored access tokens and API keys, separate each customer's workspace, log administrative access, and limit staff access to what is needed. No system is perfectly secure; if a breach affects you we will notify the affected customers and authorities as the law requires.

10. Your rights

You can ask to access, correct, export or delete your personal data, withdraw consent, or complain about how it is used. Customers can delete a contact or their entire workspace from the dashboard, which removes the related chats, orders and automation records. See our data deletion page for how to ask us directly. We reply within 30 days.

11. Cookies

Our website uses only the minimal storage needed to work. The dashboard uses essential cookies and local storage to keep you signed in. We do not run third-party advertising trackers.

12. Children

Prexa is for businesses and is not directed to anyone under 18. We do not knowingly collect children's data.

13. Changes

If we change this policy in a meaningful way we will update the date above and, for customers, notify them by email or in the dashboard.

14. Contact

Questions or requests: prexalabs@gmail.com. Prexa Labs, India.