Privacy policy

Heureka Estudio S.A.S. ("Tivox", "we"), NIT 901395895-8, located at CR 51 B 80 58 OF 513 ED SMART OFFICE CENTER, Barranquilla, Colombia, is the controller of the personal data described in this policy. Contact: apps@heurekaestudio.co. General inquiries: ceo@heurekaestudio.co, phone +57 301 639 3535.

1. Scope

This policy applies to the Tivox platform, which allows businesses (our "Customers") to connect their WhatsApp Business accounts through Meta Platforms, Inc.'s WhatsApp Business Platform (Cloud API) to send and receive messages with their own contacts ("End users").

2. Data we process

• Customer account data: company name, Meta identifiers (business portfolio ID, WhatsApp Business Account ID, phone number ID), business phone number, display name and access tokens granted by Meta.
• Messaging data: End users' WhatsApp number and profile name, content of messages sent and received (text, media, button replies), date and delivery status.
• Scheduling data: appointments booked through the platform and, when the Customer connects Google Calendar or Microsoft Outlook, the free/busy information and events of the connected calendars.
• AI processing: when the Customer enables the AI assistant, message content is sent to the AI provider selected by the Customer to generate replies.
• Technical data: webhook event logs sent by Meta, IP addresses and dashboard access logs.

3. Purposes

• Provide the messaging service requested by the Customer: send messages, receive replies, manage message templates and appointments.
• Show message delivery and read status.
• Comply with legal and security obligations and with Meta's policies (WhatsApp Business Messaging Policy and Commerce Policy).

We do not sell personal data or use it for our own advertising. We do not use message content for any purpose other than providing the service to the Customer, and we do not use it to train AI models.

4. Data received from Meta / WhatsApp

We access WhatsApp Business Platform data only through the whatsapp_business_messaging and whatsapp_business_management permissions granted by the Customer via Meta's Embedded Signup. The use of this data is limited to the purposes above and complies with the Meta Platform Terms.

5. Processors and transfers

Messages are transmitted through the infrastructure of Meta Platforms, Inc. and WhatsApp LLC. The platform is hosted on Oracle Cloud Infrastructure (OCI). AI providers: Anthropic (Claude), OpenAI (GPT) or other OpenAI-compatible providers — as enabled by each Customer. Calendar providers: Google Calendar and Microsoft Outlook, when connected by the Customer. International transfers follow the safeguards required by applicable Colombian data protection law and international standards.

6. Retention

We keep messages for 12 months or while the Customer keeps its account active, unless required otherwise by law. Access tokens and API keys are stored encrypted (AES-256-GCM) and deleted when the account is disconnected.

7. Security

We use HTTPS for all communications, validate the cryptographic signature of every notification received from Meta, encrypt access tokens, hash user passwords and restrict dashboard access by role to authorized personnel.

8. Your rights

You can request access, correction, update or deletion of your data, or withdraw consent, by writing to apps@heurekaestudio.co. End users who message a Customer can also contact that Customer directly, as it is the controller of its conversations. See also how to delete your data.

9. Changes

We will publish any changes on this page with the date of the update.