Privacy Policy
1. Who we are
This Privacy Policy describes how ORYKSA AI ("ORYKSA", "we", "us", or "our"), operated by W8 Atlantic, processes personal information when you visit oryksa.com, use the ORYKSA AI platform at app.oryksa.com, or otherwise interact with our services (collectively, the "Service").
For the purposes of EU/UK GDPR and Brazilian LGPD, ORYKSA AI acts as a data controller for personal information about visitors and account holders, and as a data processor for content and end-user data that customers route through the Service.
2. Information we collect
2.1 Information you provide
- Account data: name, email address, password (hashed), business name, phone number, country, and language preference.
- Billing data: plan, subscription status, and limited card metadata (last 4 digits, brand, expiry). Full card data is processed by our payment provider and is not stored by us.
- Profile and configuration: agent name, business context, working hours, agent persona, custom instructions, and integration credentials (e.g. WhatsApp connection tokens, third-party API keys you choose to provide).
- Support communications: messages you send to or via support channels.
2.2 Information collected automatically
- Device and log data: IP address, browser type and version, operating system, referring URL, pages viewed, and timestamps.
- Cookies: see Section 6.
2.3 Content processed by the Service
When you connect WhatsApp, Telegram, a website chat widget, or another channel, the Service receives messages, attachments, contact identifiers (e.g. phone number), and metadata exchanged between you and your end users. We process this content on your behalf to generate AI replies, schedule appointments, and operate the features you have enabled.
We use this conversation content only to operate the Service on your behalf. We do not use your conversations to train AI models. Conversation history is shown in your dashboard only if you opt in (a setting you can turn off at any time, for example before delegating account access to a member of staff), and the dashboard shows only a recent window; that display limit does not delete anything. We recommend connecting a dedicated business number rather than a personal one.
3. How we use information
- Provide, maintain, and improve the Service.
- Authenticate users and prevent abuse, fraud, and security incidents.
- Generate AI responses through large-language-model providers under our instructions.
- Bill subscriptions and manage your account.
- Send service announcements and, where you have opted in, product updates.
- Comply with legal obligations and enforce our Terms of Use.
4. Legal bases for processing
Where GDPR or equivalent law applies, we rely on: (a) performance of a contract to deliver the Service you signed up for; (b) legitimate interests in operating, securing, and improving the Service; (c) consent, for non-essential cookies and optional marketing communications; and (d) legal obligation, where we must retain or disclose information by law.
5. Sharing and third parties
We do not sell personal information. We share it only with:
- Sub-processors that operate parts of the Service under written agreements, including: cloud hosting providers, large-language-model providers (e.g. OpenAI, Anthropic, Google), payment processors, transactional email providers, and error-monitoring tools.
- Channel providers you choose to connect (e.g. Meta WhatsApp Business, Telegram, Google) - content you route through them is governed by their own terms.
- Authorities or courts when legally required, or to protect our rights, users, or the public.
- Successors in a corporate transaction, subject to confidentiality protections.
Connected email and Google user data
When you connect an email account (for example Gmail or Outlook) or another integration, ORYKSA accesses that account only to provide the features you request in the product: reading, organising, drafting, sending and replying to your messages.
- We use this data only to provide and improve those user-facing features. We do not sell it, use it for advertising, or use it to train generalised AI/ML models.
- We do not share it with third parties except as needed to run the feature you asked for, to comply with the law, or with your consent.
- Access tokens and credentials are stored encrypted at rest.
- Revoke access anytime: disconnect the integration in your dashboard (Integrations), or from your Google Account at myaccount.google.com/permissions.
- Delete your data: disconnecting removes the stored tokens immediately; deleting your account (Account > Delete account) wipes stored credentials and schedules removal of your data. You can also email [email protected].
ORYKSA's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Shopify stores: chat contacts
When a merchant installs the ORYKSA app on a Shopify store, the store chat is provided through a Shopify theme app extension. If a visitor leaves an email address in that chat, ORYKSA creates a customer record in that merchant's own Shopify admin with the email and, when given, the name, tagged "ORYKSA chat", so the merchant can follow up. This data belongs to the merchant, who is the controller under Shopify's terms. ORYKSA does not send phone numbers, message contents or marketing consent to Shopify, does not use these contacts for its own purposes, and the merchant can delete the record in Shopify at any time. Visitors can ask the merchant, or write to [email protected], to have their data removed.
WordPress and WooCommerce sites: the ORYKSA Chat plugin
When a WordPress website uses the ORYKSA Chat plugin, we receive its published content (pages, posts and products) so the AI can answer visitors. If the store uses WooCommerce and a shopper buys after talking to the chat, we receive the order number, total, currency and product names to alert the owner of the sale. We do not receive addresses or payment data. The plugin stores a technical cookie in the visitor's browser (oryksa_visitor, 30 days) that only links the conversation to the purchase.
ORYKSA AI Employees MCP server (AI coding tools)
If you connect ORYKSA to an AI coding tool (for example Claude Code, Codex, Cursor or VS Code) through our official MCP server at https://mcp.oryksa.com, you sign in on auth.oryksa.com and approve the connection. The tool then acts on your ORYKSA account only through the actions listed on that page.
- What we receive: the business details and the website content (visible page text, prices, FAQs) that the tool sends, or that we read from the public website address you give us. We store it in your agent's knowledge base so the AI can answer your customers.
- What the tool receives: an access token, never your password. We keep only a hash of the token. The tools cannot delete your account, make payments or connect WhatsApp.
- Website content is used only to run your AI agent. We do not sell it, use it for advertising, or use it to train generalised AI models.
- Revoke access at any time in your account (Account > Security > Connected tools) or by emailing [email protected]; the token stops working immediately. Deleting your account removes the tokens and the stored website content.
ORYKSA browser extension
The ORYKSA extension (ORYKSA AI Employees, for Chrome, Edge, Firefox, Opera and Brave) works in your browser's side panel after you sign in with your ORYKSA account. It only acts after a request you type or dictate in the panel, and it never confirms a purchase, a booking or a payment without your yes.
- Pages of a task you ask for: when you ask for a task (for example find businesses to contact, book a table, search hotels, flights or products, prepare a spreadsheet), the extension sends to our servers, step by step, the address, the title and the content (text, links, prices, images) of each page it works on, so it can carry out the task and show you the result.
- Routines you choose to record: if you choose to record a routine in the extension menu, it saves the steps you take (the addresses you visit, the fields you fill in and a reduced screenshot of each step) and sends them to your account so the routine can be repeated. It never saves passwords or card numbers, and it only records between the moment you start and stop the routine.
- Outside these tasks and routines, the extension does not read your pages and does not keep your browsing history.
- Details you give for a task: if a task needs your details (for example the name and phone number for a restaurant booking), the extension fills them in on that site and sends them to our servers only to prepare the task.
- Your requests: the text you type, the voice you dictate and the images you send in the panel go to your ORYKSA account to be understood and answered, using the large-language-model providers listed in section 5.
- Meeting recording (Google Meet): only when you press "Record meeting" in the panel and confirm a consent notice. The extension then tells the participants in the meeting chat. The audio of that tab is sent in short blocks to your ORYKSA account to be transcribed and summarised (summary, decisions, tasks). The audio is not stored, neither on your computer nor on our servers; the transcript and the summary stay in your account. You can switch meeting recording off in the extension settings.
- Alerts: the extension checks your own ORYKSA account for new customer messages and bookings, and may register a browser push subscription so the alerts arrive in real time. We keep that subscription (an address and keys created by your browser) only to send you those alerts; signing out of the extension cancels it.
- Connected browser: while you are signed in, the extension tells your account every 30 seconds that this browser is connected (browser type, operating system and a device identifier), so the ORYKSA app knows which computer can receive the tasks you send to it.
- Stored on your computer: your ORYKSA session, the language and theme you chose, your preferences (notifications, microphone, meetings), the privacy notice you accepted, the side panel conversation, routines waiting to be sent and a device identifier are kept in the extension's storage in your browser. Uninstalling the extension removes all of them.
- We use this data only to carry out the tasks you ask for and to run your ORYKSA account. We do not sell it or use it for advertising.
ORYKSA skill for Alexa
The ORYKSA AI Employees skill lets you talk to your ORYKSA account on Amazon Alexa devices (for example "Alexa, open ORYKSA").
- Your Amazon account email and name: only if you allow it, in the Alexa app or by voice, Amazon shares with us the email address and the name of your Amazon account. We use the email only to find the ORYKSA account with the same address and sign you in without a password; if there is no ORYKSA account with that email, we create one for you and send you an email to finish the setup on our website. You can withdraw this permission at any time in the Alexa app (Skills, ORYKSA, Settings, Manage permissions).
- Linking your account: you can also link the skill by signing in to ORYKSA from the Alexa app. We then keep an access token for Alexa, which you can revoke at any time in your ORYKSA account or by disabling the skill.
- What you ask: Amazon turns your voice into text and sends us the text of your request, your Amazon user and device identifiers, and the language and time zone of the device. We use them to answer from your ORYKSA account (conversations, agenda, contacts, tasks), to keep the conversation in your account history as on every other ORYKSA surface, and to count the interactions of your plan. We never receive your voice recordings: they stay with Amazon, under the Amazon privacy notice.
- Actions: the skill only creates an event or sends a reply after you confirm it by voice.
- We do not sell this data or use it for advertising. Disabling the skill stops all data from Alexa; deleting your ORYKSA account deletes what was kept in it.
SMS messages
If you choose to receive SMS alerts, W8 Atlantic (ORYKSA AI) uses your mobile number only to send the messages you asked for under Account > Notifications > SMS: booking and appointment reminders, alerts about new messages and bookings handled by your AI assistant, account and service notices, and support replies. SMS is optional and off by default; it starts only after you tick the SMS consent box. Message frequency varies. Message and data rates may apply. Reply STOP at any time to opt out and HELP for help, or write to [email protected]. See how SMS opt-in works.
We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes. Your mobile number and SMS consent are shared only with our SMS provider (Twilio) to deliver these messages, and never with third parties or affiliates for marketing or promotional purposes.
6. Cookies and similar technologies
We use a small number of cookies and similar technologies. You can manage your choice at any time using the "Cookie Settings" link in our footer.
6.1 Categories
- Strictly necessary - required to deliver core functionality (e.g. session, authentication, security, load balancing). These cannot be disabled.
- Preferences - remember your language, region, and UI choices.
- Analytics - help us understand aggregated usage patterns. Loaded only with consent.
6.2 Your choice
On first visit you will see a cookie banner with two options: Accept all or Reject non-essential. Your decision is stored locally on your device and remains in effect until you change it via the "Cookie Settings" link in the footer or clear your browser storage.
7. Data retention
We keep account and configuration data while your account is active and for a reasonable period afterwards to meet legal, accounting, and security obligations. Conversation content is retained according to the retention period of your plan and any settings you configure. Logs are typically kept for up to 12 months.
8. Security
We apply technical and organisational measures appropriate to the risk, including encryption in transit, role-based access controls, hardened infrastructure, and routine backups. No system is perfectly secure; we cannot guarantee absolute security.
9. Your rights
Depending on where you live, you may have the right to:
- Access the personal information we hold about you.
- Request correction of inaccurate data.
- Request deletion or restriction of processing.
- Object to processing based on legitimate interests.
- Receive a copy of your data in a portable format.
- Withdraw consent for processing that relies on consent.
- Lodge a complaint with your local data protection authority (in Brazil, ANPD; in the EU, your national supervisory authority).
To exercise any of these rights, write to . We may need to verify your identity before responding.
10. Children
The Service is not intended for individuals under 14 years of age, and we do not knowingly collect personal information from children under 14. Users between 14 and 18 use it with the consent of a parent or legal guardian, and where local law sets a higher age for consent to data processing (for example 16 in some EU countries), that consent is required up to that age. If you believe a child under 14 has provided us with personal information, contact us and we will delete it.
11. International transfers
ORYKSA AI is operated from Portugal and uses sub-processors located in the European Economic Area, the United Kingdom, the United States, and other regions. Where personal data is transferred outside its country of origin, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or equivalent mechanisms.
12. Changes to this policy
We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision. Material changes will be notified by email or in-product notice when reasonable.
13. Contact
Questions or requests about this policy or your personal information can be sent to .