Privacy Policy
Effective date: October 22, 2026
1. Introduction and Identity of the Company
1.1. This Privacy Policy (the "Policy") describes how Xandu Technology LLC, a limited liability company organized under the laws of the State of Wyoming, United States of America, with its mailing address at 30 N Gould St Ste R, Sheridan, WY 82801 (the "Company"), collects, uses, discloses and otherwise processes personal data in connection with the Iris Chat Studio platform, its website at irischat.studio and related services (collectively, the "Service").
1.2. Inquiries and requests concerning this Policy or the processing of personal data shall be addressed to privacy@irischat.studio.
2. Definitions
For the purposes of this Policy:
- "Customer" means the business or organization that registers for and uses the Service.
- "Authorized User" means any natural person who accesses the Service on behalf of a Customer.
- "End User" means any natural person who communicates with a Customer through the Customer's WhatsApp Business number.
- "Personal Data" means any information relating to an identified or identifiable natural person.
- "Sub-processor" means any third party engaged by the Company to process Personal Data in connection with the Service.
3. Role of the Company
3.1. With respect to the Personal Data of Authorized Users, the Company acts as the data controller.
3.2. With respect to the Personal Data of End Users, the Customer acts as the data controller and the Company acts as a data processor, processing such data solely on behalf of the Customer and in accordance with its documented instructions. The Customer's own privacy notice governs the relationship between the Customer and its End Users. End Users who wish to exercise their rights should first contact the relevant Customer; the Company shall assist the Customer in responding to such requests.
4. Categories of Personal Data Processed
| Category | Description | Source |
|---|---|---|
| Account data | Name, email address, authentication events, two-factor authentication settings, organization and role. | Authorized Users, through the Company's authentication provider. |
| Customer content | Documents, website content, questions and answers, prices, policies and agent configuration supplied by the Customer. | The Customer. |
| Messaging data | End User telephone numbers, profile names, message content and media, and details of the Customer's WhatsApp Business Account and telephone number. | Meta's WhatsApp Business Platform, on behalf of the Customer. |
| Billing data | Subscription plan, invoices, billing name and country. Payment card data is processed exclusively by the Company's payment provider and is not stored by the Company. | The Customer, through the payment provider. |
| Technical data | IP address, browser information, error and security logs, and cookies strictly necessary for authentication. | Devices used to access the Service. |
5. Purposes of Processing
5.1. The Company processes Personal Data for the following purposes:
- (a) to provide the Service, including connecting WhatsApp Business numbers, receiving and sending messages, and generating responses based on the Customer's own information;
- (b) to assist Customers in configuring and improving their agents, including the review of conversation samples when requested by the Customer;
- (c) to maintain the security and integrity of the Service, prevent fraud and abuse, correct errors and provide support;
- (d) to administer billing for paid plans; and
- (e) to comply with applicable legal obligations.
5.2. The Company does not sell Personal Data, does not use Personal Data for advertising purposes, and does not use Customer content or messaging data to train artificial intelligence models.
6. Processing by Artificial Intelligence Providers
6.1. In order to generate responses, the Service transmits relevant message history and Customer content to artificial intelligence model providers, namely OpenAI and Anthropic, through their commercial application programming interfaces.
6.2. Under their commercial terms, such providers do not use this data to train their models and may retain it for a limited period, not exceeding thirty (30) days, solely for abuse monitoring, unless zero data retention arrangements apply.
6.3. Responses are generated automatically and may contain inaccuracies. Customers may review conversations and assume control of any conversation at any time.
7. WhatsApp Business Platform
7.1. The Service relies on Meta's WhatsApp Business Platform (Cloud API). Customers connect their telephone numbers through Meta's Embedded Signup process and retain ownership of their WhatsApp Business Accounts. Customers may revoke the Company's access at any time through Meta Business Suite.
7.2. Messages are also processed by Meta in accordance with WhatsApp's business terms and policies. The Service does not identify the Company to End Users; communications are conducted in the name of the Customer.
8. Sub-processors
8.1. The Company engages the following Sub-processors:
| Sub-processor | Purpose |
|---|---|
| Meta Platforms, Inc. (WhatsApp Cloud API) | Transmission of WhatsApp messages |
| OpenAI | Response generation and search of Customer content |
| Anthropic | Setup assistant and organization of Customer content |
| Clerk | Authentication and account management |
| Neon | Database hosting |
| Railway | Application hosting |
| Vercel | Dashboard and website hosting |
| Cloudflare (R2) | File storage |
| Upstash | Real-time messaging infrastructure and rate limiting |
| Stripe | Payment processing, when paid plans are offered |
8.2. The Company shall notify Customers prior to any material change to this list.
9. International Data Transfers
Personal Data is stored and processed in the United States of America, including the us-east-1 region and the infrastructure of the Company's Sub-processors in that country. Where Personal Data originates in the Argentine Republic or elsewhere in Latin America, it is transferred to the United States. The Company safeguards such transfers through contractual commitments with its Sub-processors and the measures described in this Policy.
10. Data Retention
10.1. The Company retains Personal Data for the following periods:
- (a) message content: thirty (30) days under the Starter plan and ninety (90) days under the Pro plan and higher plans, unless deleted earlier by the Customer;
- (b) unprocessed message deliveries received from Meta: seven (7) days;
- (c) Customer content, including documents, knowledge base and configuration: for as long as the Customer's account remains active;
- (d) security and audit logs: twelve (12) months; and
- (e) account data: for as long as the account remains active, and thereafter deleted, except to the extent retention is required for legal, tax or dispute-resolution purposes.
10.2. A valid request for erasure shall prevail over the retention periods set out above.
11. Rights of Data Subjects
11.1. Subject to applicable law, data subjects may request access to, rectification, erasure or a copy of their Personal Data, and may object to or request the restriction of certain processing.
11.2. Requests shall be submitted to privacy@irischat.studio. The Company shall respond within thirty (30) days of receipt. Requests concerning End User data shall ordinarily be handled in coordination with the Customer acting as controller.
12. Security
The Company implements technical and organizational measures designed to protect Personal Data, including encryption in transit (TLS) and at rest, and access controls that segregate the data of each Customer. No system can guarantee absolute security. In the event of a security incident affecting Personal Data, the Company shall notify affected Customers and, where required, the competent authorities, without undue delay.
13. Minors
The Service is intended for businesses and is not directed to persons under eighteen (18) years of age.
14. Provisions Specific to the Argentine Republic
The data subject has the right to access their Personal Data free of charge at intervals of no less than six (6) months, unless a legitimate interest is demonstrated, in accordance with Section 14, subsection 3 of Law No. 25,326. The Agency for Access to Public Information (Agencia de Acceso a la Información Pública), as the supervisory authority under Law No. 25,326, is empowered to receive complaints and claims from persons whose rights have been affected by non-compliance with applicable personal data protection regulations.
15. Amendments
The Company may amend this Policy from time to time. Amendments shall be published on this page with a revised effective date. Material amendments shall additionally be notified to Authorized Users by email or through the Service.
16. Contact
Xandu Technology LLC, 30 N Gould St Ste R, Sheridan, WY 82801, United States of America. Email: privacy@irischat.studio.
This Policy is also available in Spanish.