Privacy Policy

Last updated: 2026-08-05

1. Who we are

Oynexa (the "Platform", "we") is operated by Al Adas Brothers for Ceramic and Porcelain Company, Al-Nasira Street, Jenin, Palestine. Privacy contact: privacy@oynexa.com.

2. Our roles

• Merchant account data (name, email, phone, subscription): we act as controller.
• The merchant's customer data (conversations, orders, addresses): the merchant is the controller and we act as processor, acting only on the merchant's instructions.

If you are an end customer who messaged a store using Oynexa, please contact that store first; you may also contact us and we will forward your request to the relevant merchant.

3. Data we process

• Merchant account data — name, email, phone, store name, plan.
• WhatsApp connection data — WhatsApp Business Account ID, phone number ID, access tokens.
• Conversation content — messages exchanged between the customer and the store, and attached media.
• End-customer data — WhatsApp phone number, WhatsApp display name, delivery addresses.
• Orders — products, quantities, prices, order status.
• Catalogue data — products, variants, prices, categories.
• Operational data — technical logs, usage counters, errors.

We do not collect payment card data, precise geolocation, or special categories of personal data. Our technical logs are designed to exclude personal data.

4. Why we process it (legal bases)

• Providing the service — receiving customer messages, generating replies, recording orders. Basis: performance of a contract.
• Support and troubleshooting — limited, logged access. Basis: legitimate interests / contract.
• Security and abuse prevention. Basis: legitimate interests.
• Billing and legal obligations. Basis: legal obligation.

We do not use personal data for advertising, we do not sell or rent it, and we do not use it to train AI models.

5. How AI processing works

To generate a reply, we send the current conversation context (messages between this customer and this store) and relevant catalogue data to a large language model provider (Anthropic). Under the provider's commercial terms, API data is not used to train models.

• Each prompt is built only from that customer's conversation — never mixed across customers or merchants.
• Model output is treated as a suggestion validated by our code: prices always come from the merchant's catalogue database, and the assistant cannot issue discounts.

6. Sub-processors

• Meta Platforms — official WhatsApp Business Platform (global).
• Anthropic — language models used to generate replies (United States).
• Supabase — database, authentication and storage (EU — Ireland).
• Railway — backend hosting (EU).
• Vercel — dashboard and website hosting (global edge network).
• Cloudflare — domain, email routing and network services (global).

Data is primarily stored in the European Union (Ireland). Where a sub-processor processes data outside the EU, we rely on standard contractual safeguards. Your use of WhatsApp itself is also governed by Meta's/WhatsApp's own policies.

7. Retention

• Account, conversation and order data is retained while the merchant's account is active.
• On account closure or a deletion request, data is deleted within 30 days of confirmation.
• Backups are purged within 90 days at most.
• Technical logs are kept for short operational periods and exclude personal data.
• We retain the minimum required by law (e.g. billing records) for the legally mandated period.

8. Security

• Encryption in transit (TLS) and at rest.
• Strict tenant isolation at the database level (Row Level Security) — no merchant can access another's data.
• WhatsApp access tokens are stored encrypted and never written to logs.
• Least-privilege internal access with two-factor authentication on sensitive systems.

9. Your rights

You may request access, rectification, erasure, restriction, objection, or portability of your personal data. Merchants: email privacy@oynexa.com and we will respond within 30 days. End customers: contact the store you messaged, or contact us and we will forward your request. See also our Data Deletion Instructions.

10. Children

The service is intended for business use and is not directed to children under 16.

11. Cookies

This marketing website uses no tracking cookies and no analytics. The merchant dashboard uses strictly necessary cookies to maintain the login session.

12. Changes

We will update the "Last updated" date above and notify subscribed merchants by email before any material change takes effect.

13. Contact

Al Adas Brothers for Ceramic and Porcelain Company — Al-Nasira Street, Jenin, Palestine
Privacy: privacy@oynexa.com · Support: support@oynexa.com