Privacy Policy

1. Introduction

AstraChat ("we", "our", or "us"), operated by iGenius Tech SRL under its Astra Nexo brand, is committed to protecting your personal data in compliance with Costa Rica's Ley 8968 (Ley de Protección de la Persona frente al Tratamiento de sus Datos Personales) and its regulations, as enforced by PRODHAB (Agencia de Protección de Datos de los Habitantes). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our customer support platform at chat.astranexo.com.

2. Responsibility for Personal Data

iGenius Tech SRL operates AstraChat under its Astra Nexo brand. We use account, billing and service-security information to administer the service. Your organization determines how it uses the customer contacts and conversations it connects to AstraChat; we process that content on its behalf to provide the configured service. Requests about a business’s conversations should be directed to that business. For questions about data handled by us, contact [email protected].

3. Legal Basis for Processing

Under Ley 8968, we process personal data based on the following legal grounds:

• Express consent (consentimiento expreso) as required by Article 5 of Ley 8968, which you provide when creating an account or using our services.
• Contractual necessity for the delivery of our customer support platform services, where processing is required to fulfill our obligations to you.
• Legitimate interests for fraud prevention, security, and the improvement of our services, provided these interests do not override your fundamental rights and freedoms.

4. Consent Requirements

Per Ley 8968, Article 5, the following consent requirements apply to the processing of your personal data:

• Consent must be express, prior, and informed (expreso, previo e informado). You will always be told what data is collected and why before providing consent.
• Consent must be given freely and can be revoked at any time without retroactive effect, by contacting us at [email protected].
• Consent for data processing is separate from any other contractual agreements. Agreeing to our Terms of Service does not automatically constitute consent for all data processing activities.
• Processing of special or sensitive data (such as health information, political opinions, religious beliefs, or biometric data) requires explicit written consent. AstraChat does not intentionally collect sensitive data.

5. Information We Collect

Account Information

When you create an account, we collect your name, email address, and organization details. If you are an agent or administrator, we also store your role, team assignments, and authentication credentials.

Conversation Data

We process and store messages exchanged through the platform, including messages from WhatsApp, Facebook Messenger, Instagram, email, Telegram, and web chat. This includes text content, attachments, timestamps, and message metadata. This data is necessary to provide our customer support services.

Contact Information

We store contact details of individuals who communicate through your connected channels, including names, phone numbers, email addresses, social media identifiers, and any labels or notes your team associates with contacts.

Usage Data

We collect information about how you interact with the platform, including login times, IP addresses, browser type, features used, and performance metrics for reporting and service improvement purposes.

6. How We Use Your Information

We use the information we collect for the following purposes:

• To provide, operate, and maintain the AstraChat platform and its features
• To route and deliver messages across connected communication channels
• To authenticate users and manage access permissions
• To generate reports, analytics, and performance metrics for your team
• To power AI features such as conversation summaries, suggested replies, and agent assistance
• To send platform notifications, service updates, and administrative communications
• To improve our services, develop new features, and optimize platform performance
• To ensure security, detect fraud, and prevent abuse of our platform
• To comply with legal obligations and respond to lawful requests from authorities

7. AI Processing Disclosure

AstraChat includes AI-powered features (Captain AI) that can summarize conversations, suggest replies, draft responses, and assist agents in providing faster and more accurate customer support.

When these features are enabled by your organization, conversation content may be processed by AI language models. This processing is performed solely to assist your support team and improve service quality.

Important: AI processing is used to assist agents, not to train AI models on your data. Your conversation data is not used to train or fine-tune any third-party AI models.

Users may request to disable AI processing for their conversations at any time by contacting their organization's administrator or by reaching out to us at [email protected].

8. Data Sharing and International Transfers

We do not sell your personal information. Per Ley 8968, Article 14, we may share data with the following categories of recipients:

• Channel Providers: Messages are transmitted through WhatsApp (Meta), Facebook Messenger (Meta), Instagram (Meta), Telegram, and email providers as necessary to deliver your communications. Each provider has its own privacy policy governing data on their platform.
• Hosting and infrastructure: AstraChat is hosted and managed by iGenius Tech SRL. Cloudflare provides DNS services. Information may pass through the infrastructure used to operate and protect the service.
• AI Model Providers: When AI features are enabled, conversation snippets may be sent to AI model providers for processing. Data is transmitted securely and is not retained by providers for training purposes.
• Legal Requirements: We may disclose information if required by law, regulation, legal process, or governmental request, or to protect our rights, safety, and property.
• Payments: Stripe processes checkout, subscriptions, payment methods and billing details. Card details are entered directly in Stripe; AstraChat stores the identifiers and subscription state needed to manage access.
• Contact requests: Our website’s email contact form sends the information you enter through our Zoho Mail service to [email protected]. You can instead contact us through WhatsApp; the prepared message identifies AstraChat as its source.

9. Data Subject Rights

Under Ley 8968, Articles 5 through 8, you have the following rights regarding your personal data:

• Right of Access (Acceso): You have the right to request a copy of the personal data we hold about you, including information about how it is processed and with whom it has been shared.
• Right of Rectification (Rectificación): You have the right to request the correction of inaccurate or incomplete personal data we hold about you.
• Right of Erasure (Supresión): You have the right to request the deletion of your personal data when it is no longer necessary for the purposes for which it was collected, or when you withdraw your consent.
• Right of Objection (Oposición): You have the right to object to the processing of your personal data in certain circumstances, including processing based on legitimate interests.
• Right to Portability: You have the right to request that we export your personal data in a structured, commonly used, and machine-readable format.
• Right of Revocation (Revocación): You have the right to withdraw your consent for data processing at any time, without retroactive effect.

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within 5 business days as required by Ley 8968. You may be asked to verify your identity before we process your request.

10. Data Security

We implement industry-standard technical and organizational security measures to protect your personal data, including:

• Encrypted data transmission using TLS/SSL protocols for all communications
• Access controls with role-based permissions and secure authentication
• Regular security reviews and vulnerability assessments
• Encrypted data storage at rest for sensitive information
• Employee training on data protection and security best practices

However, no method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal data, we cannot guarantee its absolute security.

11. Data Retention

We retain your personal data for as long as your account is active or as needed to provide our services. Conversation data is retained according to your organization's configured retention settings.

When an account is closed or deleted, we will remove or anonymize your personal data within a reasonable period, unless we are required to retain it for legal or regulatory purposes.

You may request deletion of your data at any time by contacting us at [email protected]. Deletion requests will be processed within the timeframes established by Ley 8968.

12. Breach Notification

In the event of a personal data breach, we are committed to transparency and compliance with Ley 8968's notification requirements:

• We will notify PRODHAB (Agencia de Protección de Datos de los Habitantes) within 5 business days of discovering a data breach that affects personal data.
• We will notify affected users without undue delay once the breach has been confirmed and assessed.
• Notifications will include the nature of the breach, the categories of personal data affected, the estimated number of individuals impacted, the likely consequences of the breach, and the measures taken or proposed to address the breach and mitigate its effects.

13. Cookies

The application uses essential cookies for sessions and security. Public marketing pages use cookie-free Cloudflare Web Analytics in supported regions. Optional Google Analytics starts only when you enable it through Analytics preferences in the footer. Its measurement cookies remain on this product host. Measurement excludes account pages, messages, contact-form contents and sensitive links. Cloudflare and Google process measurement data under their own policies; processing can occur outside Costa Rica. You can change your choice at any time in the footer. Declining Google Analytics does not affect the service.

14. Children's Data

AstraChat is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from minors. If we become aware that we have collected personal data from a person under 18, we will take steps to delete that information promptly. If you believe that a minor has provided us with personal data, please contact us at [email protected].

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. For significant changes, we will notify you by posting a prominent notice on our platform or sending a notification to your registered email address. Your continued use of AstraChat after such changes constitutes your acceptance of the updated Privacy Policy. We encourage you to review this page periodically.

16. Governing Authority

This Privacy Policy is governed by the laws of Costa Rica, specifically Ley 8968 (Ley de Protección de la Persona frente al Tratamiento de sus Datos Personales) and its implementing regulations. The supervisory authority for data protection in Costa Rica is PRODHAB (Agencia de Protección de Datos de los Habitantes). If you believe that your data protection rights have been violated, you have the right to file a complaint directly with PRODHAB at www.prodhab.go.cr.

17. Contact

If you have any questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data, please contact us: