Privacy Policy

XChat is a customer-messaging inbox for merchants, operated by SeloraX. It lets a business read and reply to the messages and comments its own customers send on Facebook Messenger, Instagram, WhatsApp, email, and its website — from one place.

Two different groups of people appear in this policy. Merchants are our customers: the businesses that sign up and connect their accounts. End customers are the people who message those businesses.

That distinction decides who is responsible for what. For merchant account data we are the controller — we decide why and how it is processed. For the conversations inside a merchant’s inbox, the merchant is the controller and we act as their processor, handling that data on their instructions and only to provide the service. A request about a specific conversation is ultimately the merchant’s to answer, and we help them answer it.

Merchant account data. Name, email address, phone number, the workspace and team-member records needed to run the account, and billing status.

Data from Meta platforms. When a merchant connects a Facebook Page, Instagram professional account, or WhatsApp Business number, we receive and store:

• Messages and public comments sent to that Page, account, or number — including text, attachments, and images
• The sender’s display name, profile picture, and platform-scoped identifier (a Page-scoped or Instagram-scoped ID, or a WhatsApp phone number). These identifiers are issued per business and cannot be used to identify someone across unrelated merchants.
• Context about the post a comment was left on: the post ID, its caption, a thumbnail, and a permalink
• Access tokens issued by Meta that authorise us to send and receive on the merchant’s behalf, and the identifier of the account that granted them

Data from other channels. Email messages sent to a connected address, and messages sent through the merchant’s website chat widget.

Data merchants add. Notes, tags, and internal records a merchant attaches to a contact or conversation.

Technical data. Logs needed to operate and secure the service. Credentials are redacted before anything is written to a log.

We do not buy data, we do not collect data about people who have not contacted a merchant, and we do not build advertising profiles.

The XChat Android app is a staff tool for the same inbox described above. In addition to the data above, on mobile we handle:

• Your phone number, used to sign you in with a one-time code (OTP). We store it on your account and send the code by SMS.
• A device push token, so we can deliver new-message notifications to your phone. It is removed when you sign out or uninstall.
• On-device storage only for conveniences like unsent drafts, a message cache, and your theme choice. This stays on your device and is not sent to us.

The app requests notification permission (to alert you to new chats) and, only if you enable floating chat heads, the “display over other apps” permission. It does not collect location, contacts, or advertising identifiers.

You can permanently delete your account and personal data at any time from selorax.io/delete-account.

To display conversations in the merchant’s inbox, deliver their replies back to the originating platform, notify their staff of new messages, and produce statistics about their own inbox.

Where a merchant enables our AI features, message content and the relevant conversation context are used to draft or send replies on their behalf.

To operate, secure, support, and bill for the service, and to meet our legal obligations.

We rely on the contract with our merchants to process their account data, on our legitimate interest in operating and securing the service, and on merchants’ own instructions and lawful basis for the conversations in their inbox.

Data received through Meta’s APIs is used only to provide the messaging inbox to the merchant whose account it came from. Specifically, we commit that we do not:

• Sell, license, rent, or purchase this data
• Transfer it to a data broker, ad network, advertising exchange, data monetisation service, or any similar intermediary
• Use it for advertising, ad targeting, retargeting, look-alike audiences, or to build advertising or behavioural profiles
• Use it to make eligibility decisions about anyone — including credit, insurance, housing, employment, education, government benefits, or immigration status
• Use it for surveillance, including on behalf of any government
• Use it to train our own machine-learning models
• Attempt to re-identify anyone from de-identified data, or combine it with data from other sources for any purpose not described in this policy
• Use it to discriminate against anyone unlawfully

We delete data received from Meta when any of these happens:

• The person it relates to asks us to
• The merchant closes their account or disconnects and deletes the channel
• We no longer need it to provide the service
• Meta asks us to
• Our agreement with the merchant, or with Meta, ends

Removing our app from your Facebook settings triggers this automatically — Facebook notifies us and we act on it without any further request from you. See deleting your data.

We share data only with service providers who need it to run the service. Each is bound by contract to protect it, to use it only for the service they provide to us, and to honour the same restrictions we accept above. We remain responsible for what they do with it.

• AI processing. When a merchant enables AI features, message content is sent to OpenAI to generate a reply. It is processed to answer that request and is not used to train models.
• Infrastructure. Hosting, database, file storage, email delivery, and push-notification providers.
• Payments. Payment processors handle billing. They receive what they need to take payment, not conversation content.
• The platform the message came from. Replies are delivered back to Meta, which is what makes them reach the customer.

We do not sell personal data and we do not share it with advertisers or data brokers. We disclose data to authorities only where we are legally required to, and we do not grant any government bulk or direct access.

If the business is ever sold or merged, data may transfer to the acquirer, who would remain bound by this policy until you are told otherwise.

Our providers may process data in countries other than your own. Where data moves across borders we rely on the safeguards our providers offer, such as standard contractual clauses, and we require the same protections wherever it is handled.

Conversations and contacts are kept for as long as the merchant’s account is active, because the inbox is a working record they rely on. Disconnecting a channel stops new data flowing but leaves past conversations readable, so the merchant can reconnect without losing their history.

Access tokens are erased when a channel is deleted, when a deletion request is made, or when the merchant removes our app from their Meta account.

When an account is closed we delete its workspace and everything in it. We keep only what the law requires us to, such as billing records, and use it for nothing else.

Wherever you are, you can ask us to:

• Tell you what data we hold about you and give you a copy
• Correct anything that is wrong
• Delete it
• Restrict or object to how we use it
• Withdraw consent, where we relied on consent

Write to hello@selorax.io. We do not charge for this and we will respond within 30 days. If your request concerns a conversation inside a merchant’s inbox, we will pass it to that merchant and support them in carrying it out, because the record is theirs.

Anyone can ask us to delete the data we hold about them. Our data deletion page explains every route, including the automatic one through Facebook’s app settings.

Data is encrypted in transit. Access tokens are held server-side and are never exposed to the browser, and credentials are stripped from error messages before anything is logged. Incoming platform events are verified cryptographically before we act on them, so third parties cannot inject messages into a merchant’s inbox. Staff access is limited to what an employee needs to operate and support the service.

No system is perfectly secure. If a breach affects your data we will notify affected parties and regulators as required by law.

XChat is a business tool and is not directed at children. We do not knowingly collect data from children under 13, and we delete it if we discover we have.

We will update this page when our practices change and revise the date at the top. Material changes will be communicated to merchants directly before they take effect.

Write to hello@selorax.io with any question about this policy, about data we hold, or to make a complaint. You also have the right to complain to your local data protection authority.