Legal
Privacy policy
This policy explains what personal data Oxtro collects, why we need it, who else handles it and what you can ask us to do with it. It covers the website at getoxtro.com, and the app and API at app.getoxtro.com.
Last updated
Who we are
Oxtro is operated by an individual based in Algeria ("Oxtro", "we", "us"). For any question about this policy or your data, write to contact@getoxtro.com.
We process personal data under Algerian Law No. 18-07 of 10 June 2018 on the protection of natural persons in the processing of personal data. Where the EU or UK General Data Protection Regulation (GDPR) applies to you, you also have the rights it gives you, described below.
Two kinds of data, two roles
Oxtro handles two different kinds of personal data, and our role is different for each.
- Data about you and your team, such as your account, your workspace and your billing. We decide how this data is used, so we are its controller.
- Data you put into Oxtro about other people, such as your contacts, the messages you send and receive, campaign recipient lists and the phone numbers you send one-time codes to. We process it only on your instructions, to provide the service. You are its controller and we are your processor.
If you are a customer of a business that uses Oxtro and you want to know what it holds about you, ask that business. If you write to us, we will pass your request on.
What we collect
| Data | What it includes | Why we need it |
|---|---|---|
| Account | Your name, email address and password, stored only as a hash. If you sign in with Google: your Google account ID, name, email address and profile picture. | To create your account and let you sign in. |
| Workspace | Workspace name, default country and time zone, members and their roles, and the email addresses of people you invite. | To run your workspace and control who can do what in it. |
| WhatsApp connections | The phone number and display name of each number you link, and the linked-device session used to send and receive on it. | To send and receive WhatsApp messages on your behalf. |
| Messages and contacts | Contact phone numbers, names, email addresses, custom fields and tags; message text, media and delivery status; conversation assignments; templates; campaigns, their recipients and variables; files you import. | This is the service: we store and deliver it for you. |
| One-time codes | The phone number, a hash of the code, the expiry time, the number of attempts and when the code was verified. The code itself is never stored in readable form. | To send and check verification codes. |
| Developer data | API keys, stored as a hash with a visible prefix; a log of API requests with the endpoint, method, status, duration and IP address; webhook endpoints and the events they receive; webhook delivery attempts with the payload and your server's response. | To authenticate API calls, apply rate limits, deliver webhooks and help you debug. |
| Billing | Your plan and billing periods, the amount, currency and payment provider of each payment, the provider's payment reference and a receipt link. | To take payment, apply your plan and keep accounting records. |
| Usage | Counts of messages, campaign recipients and verification requests. | To apply the limits of your plan. |
| Security records | An audit log of actions in your workspace: who did what and when, with the IP address. | To keep the service and your workspace secure and to investigate problems. |
| Support | What you send us when you write to us. | To answer you. |
Card and bank details are entered on the payment provider's own page. We never see or store them.
Cookies and tracking
If you accept it in the cookie banner, the website at getoxtro.com uses Google Analytics to count visits and see which pages are read. Until you accept, Google Analytics does not load and sets no cookies. Google Analytics sets first-party cookies (named _ga and _ga_<id>) that keep a random ID for your browser for up to two years, and it receives the pages you view, the page that sent you, your device and browser type and your approximate location, derived from your IP address. Google Analytics does not log or store IP addresses. We use these statistics only to improve the website, and we do not use them for advertising.
You can change your choice at any time with Cookie settings at the bottom of every page; declining removes the Google Analytics cookies. Your choice itself is kept in your browser's local storage, not in a cookie, so the banner does not ask again on every page. You can also block these cookies in your browser settings or with Google's opt-out browser add-on.
The free image resizer and image compressor process your images in your browser and do not send them to us. They keep your settings in your browser's local storage. If you accepted Google Analytics, they also count how many images and files were involved, never their names or contents.
The website uses no other trackers or advertising cookies. Its fonts and images are served from our own domain.
If you save codes in 2FA Vault, they are encrypted with your password and kept in your browser's storage on your device. We never receive them or the password. They stay until you delete them or clear this site's data. If you scan a QR code there, the camera picture or image you choose is read in your browser and is not sent to us.
The app at app.getoxtro.com keeps your sign-in tokens and the workspace you last opened in your browser's local storage. This is needed for the app to work, and it is removed when you sign out. Payment providers set their own cookies on their checkout pages.
What we do not do
- We do not sell personal data or share it for advertising.
- We do not use the messages, contacts or other content in your workspace for marketing or to train AI models.
- We access the content of a workspace only when it is needed to run the service, to investigate a problem you report or an abuse report, or when the law requires it.
Why we are allowed to process it
- To provide the service you signed up for: your account, workspace, connections, messages, codes, API and billing.
- For our legitimate interests: keeping the service secure, preventing fraud and abuse, applying rate limits and fixing faults. We keep these uses limited to what they need.
- With your consent: website statistics from Google Analytics, only if you accept them in the cookie banner. You can withdraw consent at any time.
- To meet legal obligations: keeping accounting records and answering lawful requests from authorities.
Who else handles data
We use a small number of providers to run Oxtro. Each receives only what it needs for its job.
| Provider | What for | Where |
|---|---|---|
| Hosting providers | Servers for the database, queues, media storage and WhatsApp connections | European Union |
| WhatsApp (Meta) | Messages you send and receive travel through WhatsApp under its own terms and privacy policy. Oxtro is not affiliated with WhatsApp or Meta. | Worldwide |
| Sign-in, only if you choose to sign in with Google; Google Analytics statistics for the website | Worldwide | |
| Stripe and PayPal | Payments in US dollars, depending on the method you choose | Worldwide |
| SlickPay and OneClick | Payments in Algerian dinars with EDAHABIA or CIB cards | Algeria |
We may also disclose data when the law requires it, or to protect the rights and safety of our users or the public.
Where data is stored and transferred
Our servers are in the European Union. Oxtro is operated from Algeria, so data is accessed from there to run and support the service, and some of the providers above, such as Google, Stripe and PayPal, process data in other countries, including the United States. These transfers are needed to provide the service you asked for. Where the GDPR applies, we rely on the safeguards it allows for these transfers.
How long we keep it
- Account and workspace data: for as long as your account is open. When you close your account or delete a workspace, we delete its data within 30 days. Copies in backups are deleted as those backups expire.
- Website statistics in Google Analytics: up to 14 months, then deleted by Google.
- Request logs, webhook delivery records and security records: for as long as they are useful for security and troubleshooting, then deleted.
- Billing records: for as long as accounting and tax law requires, currently up to 10 years.
- Support messages: for as long as needed to answer you and keep a record of the exchange.
Your rights
You can ask us to:
- tell you whether we process your data and give you a copy of it;
- correct data that is wrong or incomplete;
- delete your data, unless we must keep it by law;
- stop or restrict a use of your data, or object to it;
- send you your data in a common machine-readable format, where the GDPR applies.
Write to contact@getoxtro.com from the email address on your account. We may ask you to confirm your identity, and we answer within one month. You can update most account details yourself in the app.
If you think we have mishandled your data, please tell us first so we can fix it. You can also complain to the Algerian data protection authority (ANPDP) or, where the GDPR applies, to the data protection authority of the country where you live or work.
Security
Connections to Oxtro use TLS. Passwords, API keys and one-time codes are stored only as hashes, and credentials for our internal servers are encrypted. Access inside a workspace is limited by role, and actions are recorded in an audit log. No system is perfectly secure. If a breach affects your data, we will tell you without undue delay and as the law requires.
Children
Oxtro is a service for businesses and is not meant for anyone under 18. We do not knowingly collect data from children.
Changes to this policy
When we change this policy we update the date at the top of this page. If a change affects how we use your data in a significant way, we tell account owners by email or in the app before it takes effect.