Legal

Privacy Policy

Effective Date: 14 October 2025
Last Updated: 9 July 2026

Introduction

IXXO Cart Ltd ("we," "our," "us") provides an all-in-one SaaS platform for businesses, including email, helpdesk, live chat, and related tools ("Services").

This Privacy Policy explains how we collect, use, and protect your personal data when you visit our website, create an account, or use our Services.

By using our website or Services, you agree to this Privacy Policy. If you do not agree, do not use our Services.

Data Controller

The data controller responsible for your personal data is:

IXXO Cart Ltd
Email: privacy@ixxo.com

Data We Collect

We collect and process the following categories of personal data:

a. Information you provide directly

Name, email address, company name, and password (for account creation)
Billing and payment information (processed securely by third-party providers)
Any messages or content you send through helpdesk, forms, or live chat
Files or attachments uploaded to your account

b. Information collected automatically

IP address, browser type, operating system, device identifiers
Pages visited, time spent, and other analytical data
Cookies and similar tracking technologies

c. Information from third parties

We may receive limited data from third-party services you connect to IXXO Cart Ltd, such as payment gateways or integrations (e.g., Google, Stripe).

Legal Basis for Processing

We process personal data under the following lawful bases as defined by the EU General Data Protection Regulation (GDPR):

Contractual necessity: To provide and maintain the Services you request
Legitimate interest: To improve our platform, ensure security, and prevent fraud
Legal obligation: To comply with accounting, tax, or regulatory requirements
Consent: For optional communications or non-essential cookies

How We Use Your Data

Your data is used to:

Create and manage user accounts
Process payments and provide invoices
Respond to support requests
Send important system notifications and updates
Monitor usage and improve functionality
Ensure the security of our Services
Comply with applicable laws and regulations

We do not sell or rent your personal data.

Data Sharing

We only share your data with:

Service providers who help operate our platform (hosting, payments, analytics, communication tools)
Legal authorities if required to comply with law or court orders
Business successors if our company is merged or acquired

All processors are contractually bound to handle your data securely and in compliance with GDPR.

International Data Transfers

Your personal data may be transferred to and processed outside the European Economic Area (EEA). In such cases, we ensure appropriate safeguards, such as the EU Commission's Standard Contractual Clauses (SCCs), are in place.

Data Retention

We keep your personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by law.

When you delete your account, we delete or anonymize your data within a reasonable period unless retention is required for legal obligations.

Data Security

We apply industry-standard security measures to protect your data, including:

Encryption (HTTPS/TLS)
Access controls and authentication
Regular audits and monitoring

While we take all reasonable precautions, no system is completely secure. You use our Services at your own risk.

IXXO Hub Mobile App

This section applies to the IXXO Hub mobile app for iOS and Android, the official companion for the IXXO Hub platform. The app is a client for your organization's own IXXO workspace: most data you view or enter is stored in and controlled by that workspace (by your workspace administrator, the data controller), not by us.

Information the app handles

Connection details: your workspace domain and API token, stored securely on your device and sent only to your workspace.
Sign-in credentials: your username and password, used to authenticate. Your password is stored on your device only if you enable biometric sign-in (Face ID / Touch ID / fingerprint), protected by your device's secure keystore; otherwise it is not retained after login. A session identifier is stored on-device to keep you signed in.
Business content you view or create: clients and organizations, appointments, emails, team chat messages, tasks, notes, timesheets, and any photos or files you attach. This is stored in your workspace.
Client contact details (e.g. a phone number) used to open your device's Messages app for appointment reminders. The reminder is sent through your own phone; the app does not transmit it.

How it's used

Solely to provide the app's features and connect you to your workspace. We do not use your data for advertising or profiling.

What the app does NOT do

No advertising and no advertising identifiers.
No third-party analytics, tracking, or marketing SDKs.
No selling or sharing of your data with third parties.
No access to your location, contacts, microphone, or camera. Photo attachments use the system photo picker, only with your permission.

Storage and security

Connection details, credentials (when biometric sign-in is enabled), and the session identifier are stored in your device's secure storage (iOS Keychain / Android Keystore). All communication with your workspace uses encrypted HTTPS connections. Business content is stored on your workspace's servers under your administrator's control.

Permissions

Face ID / Touch ID / fingerprint: optional, for quick sign-in.
Photo library: only when you attach a photo or video to a message or email.
Foreground service (Android): in-app audio/video media playback.

Data retention and deletion

On-device data is removed when you log out or uninstall the app. Business content in your workspace is retained and deleted according to your administrator's policies. To request deletion of your account or data, use Settings → Help & support → Contact support in the app, contact your workspace administrator, or email us at privacy@ixxo.com.

Your Rights (under GDPR)

You have the following rights regarding your personal data:

Access: Request a copy of your data
Rectification: Correct inaccurate information
Erasure: Request deletion of your data ("right to be forgotten")
Restriction: Limit how your data is processed
Portability: Receive your data in a structured format
Objection: Object to data processing based on legitimate interests
Withdrawal of consent: For processing based on consent

To exercise these rights, contact us at privacy@ixxo.com

We may request proof of identity before fulfilling your request.

Cookies

We use cookies for essential functionality, analytics, and personalization.

You can disable or manage cookies in your browser settings. However, disabling cookies may affect some features of our Services.

Children's Privacy

Our Services are not intended for children under 16 years of age. We do not knowingly collect personal data from minors. If you believe we have collected such data, contact us immediately for removal.

Third-Party Links

Our website may contain links to third-party websites or services. We are not responsible for their privacy practices. Review their policies before interacting with them.

Changes to This Policy

We may update this Privacy Policy from time to time. Your continued use of our Services after an update means you accept the revised terms.

Contact Us

If you have questions, requests, or complaints about this Privacy Policy or our data practices, contact: