Privacy Policy
1. Who we are
This Privacy Policy describes how ORYKSA AI ("ORYKSA", "we", "us", or "our"), operated by W8 Atlantic, processes personal information when you visit oryksa.com, use the ORYKSA AI platform at app.oryksa.com, or otherwise interact with our services (collectively, the "Service").
For the purposes of EU/UK GDPR and Brazilian LGPD, ORYKSA AI acts as a data controller for personal information about visitors and account holders, and as a data processor for content and end-user data that customers route through the Service.
2. Information we collect
2.1 Information you provide
- Account data: name, email address, password (hashed), business name, phone number, country, and language preference.
- Billing data: plan, subscription status, and limited card metadata (last 4 digits, brand, expiry). Full card data is processed by our payment provider and is not stored by us.
- Profile and configuration: agent name, business context, working hours, agent persona, custom instructions, and integration credentials (e.g. WhatsApp connection tokens, third-party API keys you choose to provide).
- Support communications: messages you send to or via support channels.
2.2 Information collected automatically
- Device and log data: IP address, browser type and version, operating system, referring URL, pages viewed, and timestamps.
- Cookies: see Section 6.
2.3 Content processed by the Service
When you connect WhatsApp, Telegram, a website chat widget, or another channel, the Service receives messages, attachments, contact identifiers (e.g. phone number), and metadata exchanged between you and your end users. We process this content on your behalf to generate AI replies, schedule appointments, and operate the features you have enabled.
3. How we use information
- Provide, maintain, and improve the Service.
- Authenticate users and prevent abuse, fraud, and security incidents.
- Generate AI responses through large-language-model providers under our instructions.
- Bill subscriptions and manage your account.
- Send service announcements and, where you have opted in, product updates.
- Comply with legal obligations and enforce our Terms of Use.
4. Legal bases for processing
Where GDPR or equivalent law applies, we rely on: (a) performance of a contract to deliver the Service you signed up for; (b) legitimate interests in operating, securing, and improving the Service; (c) consent, for non-essential cookies and optional marketing communications; and (d) legal obligation, where we must retain or disclose information by law.
5. Sharing and third parties
We do not sell personal information. We share it only with:
- Sub-processors that operate parts of the Service under written agreements, including: cloud hosting providers, large-language-model providers (e.g. OpenAI, Anthropic, Google), payment processors, transactional email providers, and error-monitoring tools.
- Channel providers you choose to connect (e.g. Meta WhatsApp Business, Telegram, Google) — content you route through them is governed by their own terms.
- Authorities or courts when legally required, or to protect our rights, users, or the public.
- Successors in a corporate transaction, subject to confidentiality protections.
6. Cookies and similar technologies
We use a small number of cookies and similar technologies. You can manage your choice at any time using the "Cookie Settings" link in our footer.
6.1 Categories
- Strictly necessary — required to deliver core functionality (e.g. session, authentication, security, load balancing). These cannot be disabled.
- Preferences — remember your language, region, and UI choices.
- Analytics — help us understand aggregated usage patterns. Loaded only with consent.
6.2 Your choice
On first visit you will see a cookie banner with two options: Accept all or Reject non-essential. Your decision is stored locally on your device and remains in effect until you change it via the "Cookie Settings" link in the footer or clear your browser storage.
7. Data retention
We keep account and configuration data while your account is active and for a reasonable period afterwards to meet legal, accounting, and security obligations. Conversation content is retained according to the retention period of your plan and any settings you configure. Logs are typically kept for up to 12 months.
8. Security
We apply technical and organisational measures appropriate to the risk, including encryption in transit, role-based access controls, hardened infrastructure, and routine backups. No system is perfectly secure; we cannot guarantee absolute security.
9. Your rights
Depending on where you live, you may have the right to:
- Access the personal information we hold about you.
- Request correction of inaccurate data.
- Request deletion or restriction of processing.
- Object to processing based on legitimate interests.
- Receive a copy of your data in a portable format.
- Withdraw consent for processing that relies on consent.
- Lodge a complaint with your local data protection authority (in Brazil, ANPD; in the EU, your national supervisory authority).
To exercise any of these rights, write to . We may need to verify your identity before responding.
10. Children
The Service is not intended for individuals under 16 years of age, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.
11. International transfers
ORYKSA AI is operated from Portugal and uses sub-processors located in the European Economic Area, the United Kingdom, the United States, and other regions. Where personal data is transferred outside its country of origin, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or equivalent mechanisms.
12. Changes to this policy
We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision. Material changes will be notified by email or in-product notice when reasonable.
13. Contact
Questions or requests about this policy or your personal information can be sent to .