Privacy Policy — Joxy.ai

01

Who we are

Joxy.ai ("Joxy", "we", "us") is an AI-powered business automation platform operated by Joxy AI Ltd. We help entrepreneurs run their marketing, sales, support, and operations through a team of AI agents.

For privacy enquiries, contact us at privacy@joxy.ai.

02

What we collect

We collect information you give us directly and information generated by your use of the service.

Account information: Your name, email address, and password (stored as a bcrypt hash — we never see it in plaintext). If you sign in via Google or another OAuth provider, we receive only your name, email, and profile picture.

Business data you connect: When you connect integrations (Meta Ads, Google Ads, Klaviyo, Shopify, etc.), we store the access tokens and the data returned from those APIs — ad performance, email metrics, order data — solely to power your agents.

Messages and instructions: The messages you send to Joxy agents are stored so agents can reference context and history.

Usage data: Pages visited, features used, session duration, and error logs. We use this to improve the product.

Payment data: Billing is handled by Stripe. We store only your subscription status and plan tier. We never see or store your card number.

Device & technical data: IP address, browser type, and operating system — for security and fraud prevention.

03

How we use your data

To operate, maintain, and improve the Joxy platform and AI agents
To authenticate your account and keep it secure
To execute agent tasks on your behalf (running ads, sending emails, outreach, etc.)
To send transactional emails (account alerts, billing receipts, task summaries)
To send product updates — you can opt out at any time
To detect abuse, fraud, and security threats
To comply with legal obligations

We do not use your business data (ad accounts, email lists, revenue data) to train AI models. Your business data belongs to you and is used exclusively to serve your account.

04

Who we share it with

We do not sell, rent, or trade your personal data. We share data only in the following circumstances:

Service providers: Trusted third parties who process data on our behalf under strict data processing agreements — including Stripe (payments), AWS (hosting), OpenAI (AI inference), Postmark (transactional email), and Cloudflare (security & CDN).

Integrations you authorise: When you connect a third-party platform (Meta, Google, Klaviyo, etc.), data flows between Joxy and that platform as necessary to operate your agents.

Legal requirements: If required by law, court order, or to protect the rights and safety of Joxy, our users, or the public.

Business transfers: If Joxy is acquired or merges with another entity, your data may transfer as part of that transaction. We will notify you before that happens.

05

Storage & security

Data is stored on servers located in the European Union and the United States, protected by:

TLS 1.3 encryption in transit on all connections
AES-256 encryption at rest for sensitive fields
Bcrypt hashing for all passwords
Strict access controls — only the systems that need your data can access it
Regular security reviews and vulnerability scanning
Automatic session expiry and JWT-based authentication

🔐 We take security seriously. No system is 100% impenetrable, but we build Joxy as if it holds data we'd trust our own business with — because we do.

06

Retention

We keep your data for as long as your account is active or as needed to provide the service. Specifically:

Account data: Retained until you delete your account
Agent conversation history: Retained for 12 months, then automatically purged
Connected integration data: Deleted within 30 days of disconnecting an integration
Billing records: Retained for 7 years as required by tax law
Usage logs: Retained for 90 days

When you delete your account, all personal data is purged within 30 days, except records we are legally required to retain.

07

Your rights

Depending on your location, you have the following rights:

Access: Request a copy of all data we hold about you
Correction: Fix inaccurate or incomplete data
Deletion: Request we delete your personal data ("right to be forgotten")
Portability: Export your data in a machine-readable format
Objection: Object to certain types of processing
Restriction: Ask us to limit how we use your data
Opt-out: Unsubscribe from marketing emails at any time via the link in any email

To exercise any of these rights, email privacy@joxy.ai. We respond within 30 days.

08

Cookies

We use a minimal set of cookies:

Session cookie: Keeps you logged in. Required to use the platform.
Preference cookie: Remembers your UI settings (theme, etc.).
Analytics: We use privacy-respecting analytics. No third-party ad trackers.

You can disable cookies in your browser settings. Some features of the platform require session cookies to function.

09

Children

Joxy is not directed at children under 16. We do not knowingly collect personal data from anyone under 16. If you believe a child has created an account, contact us at privacy@joxy.ai and we will delete it promptly.

10

Changes to this policy

We may update this policy as the product evolves. When we make material changes, we will notify you by email and update the "Last updated" date at the top of this page. Your continued use of Joxy after changes take effect constitutes acceptance.

11

Contact us

For any privacy-related questions, data requests, or concerns:

Email: privacy@joxy.ai
Platform: app.joxy.ai
Response time: Within 5 business days for general enquiries, 30 days for formal data requests.