Privacy Policy

This Privacy Policy explains how Proxxie ("Proxxie," "we," "us" or "our") collects, uses, shares and protects personal information when you visit theproxxie.com, use the dashboard at app.theproxxie.com, or interact with a chatbot that runs on our platform (together, the "Service"). It also explains the choices and rights you have.

If you do not agree with this policy, please do not use the Service. Capitalised terms not defined here have the meaning given in our Terms of Service.

1. Who this policy covers

Proxxie handles personal information in two different roles, and your rights depend on which one applies to you.

• Account holders and website visitors. If you create a Proxxie account, apply for access, contact us, or browse theproxxie.com, Proxxie decides how your information is used. We are the "controller" (or "business") for that information, and this policy applies to it in full.
• People who chat with a customer's chatbot ("Chat Visitors"). If you use a chatbot that a business or agency has added to its own website, that business decides why and how your information is collected and is the controller for it. Proxxie stores and processes it on that business's behalf, as its "processor" (or "service provider"), under our Terms of Service and the business's instructions. Section 9 explains what this means for you.

2. Information we collect

Information you give us when you sign up or manage an account. Your first and last name, email address, password (stored as a one-way hash, never in plain text), the name of your business or agency, your account type (business owner or agency) and your chosen plan. When you create an account, we also record that you accepted our Terms of Service and this Privacy Policy: which versions, the date and time, and the IP address you signed up from. If you applied through our waitlist, we also keep what you entered on that form.

Billing information. Payments are handled by Stripe. When you subscribe, Stripe collects your card details directly; Proxxie never receives or stores your full card number. We receive your billing email, the last four digits and brand of your card, your subscription status and plan, and the dates of payments and cancellations.

Content you add to the Service ("Customer Content"). The text and web page content you add to a chatbot's knowledge base, the chatbot's name, instructions (system prompt), welcome and fallback messages, branding (colours and logo), the client business names an agency creates, and the email address you choose to receive lead alerts at.

Chat Visitor information. When someone chats with a chatbot on a customer's website, we collect the messages they type and the chatbot's replies, a random session identifier generated for that conversation, and, if the visitor chooses to share them, their name and email address. The pre-chat form asks for name and email only, and visitors can skip it. We do not collect phone numbers, postal addresses or any other fields through the chat widget.

Usage and device information. When you use the dashboard or a chatbot, our servers automatically record technical data such as your IP address, browser type and version, operating system, the pages and features you use, the date and time of requests, and error logs. We use IP addresses to rate-limit sensitive actions (for example password resets), to detect abuse, and as part of the record that you accepted our Terms of Service and this Privacy Policy.

Communications. If you email us, we keep the message and our reply so we can help you and keep a record of the conversation.

Information from cookies and similar technologies. See section 6.

We do not knowingly collect sensitive personal information such as health, financial account, government identification or biometric data, and we ask you not to put it into a knowledge base or a chat.

3. How we use information

We use personal information to:

• Provide the Service: create and secure your account, verify your email address, run your chatbots, store knowledge bases, answer chat messages, record leads and conversations, and show them to you in the dashboard.
• Send lead alerts: when a Chat Visitor shares an email address, we email the visitor's name, email and the recent conversation to the lead-alert address the account holder has set.
• Bill you: start your free trial, process subscriptions through Stripe, apply plan limits, and send receipts, failed-payment notices and renewal reminders.
• Communicate with you about your account: verification links, password resets, trial reminders, security notices, changes to the Service or to these policies, and replies to your messages.
• Send product and marketing email to account holders about Proxxie features, tips and offers. Every such email has an unsubscribe link, and opting out does not stop the account emails listed above.
• Improve and protect the Service: monitor performance, fix bugs, understand which features are used, enforce our Terms, detect fraud, abuse and security incidents, and keep audit logs of administrative actions.
• Advertise Proxxie: measure the results of our ads on Meta and Google (see section 6). We do not use Customer Content or Chat Visitor conversations for advertising.
• Comply with law: meet legal obligations, respond to lawful requests, and establish or defend legal claims.

How the AI works. To answer a chat message, we send the message, the recent conversation and the relevant passages from the chatbot's knowledge base to our AI provider, which returns a reply. We also use the AI provider to create "embeddings" (numerical representations) of knowledge base text so the right passages can be found. We use the provider's business API, under terms that prohibit it from using the content to train its models. See section 7.

Legal bases (EEA, UK and Switzerland). Where these laws apply, we process personal information to perform our contract with you (providing and billing the Service), for our legitimate interests (securing, improving and marketing the Service, and preventing abuse), to comply with legal obligations, and, for advertising cookies and marketing email, with your consent, which you can withdraw at any time.

4. Automated decisions and training

Proxxie's chatbots generate replies automatically from the knowledge a customer has provided. These replies are informational; they are not legal, medical, financial or other professional advice, and no decision with legal or similarly significant effect on you is made automatically by the Service.

We do not use Customer Content or Chat Visitor conversations to train AI models, and we contractually require our AI provider not to. We may use aggregated, de-identified usage statistics (for example, average number of conversations per chatbot) to improve the Service and describe it publicly.

5. When we share information

We do not sell personal information, and we do not rent or trade it. We share it only:

• With service providers that process it on our behalf and only under our instructions, listed in section 7.
• With the business whose chatbot you used. Chat Visitor messages, names and email addresses are shown to the account holder that owns that chatbot, and emailed to the lead-alert address they chose.
• With a payment processor (Stripe) to take payment.
• For advertising measurement, through the Meta Pixel and Google Ads tag on theproxxie.com (section 6). Under some US state laws this counts as "sharing" for targeted advertising, and you can opt out as described there.
• When required by law or to respond to a valid legal request, protect the rights, property or safety of Proxxie, our customers or others, enforce our Terms, or investigate fraud or security issues.
• In a business transfer. If Proxxie is involved in a merger, acquisition, financing, reorganisation or sale of assets, personal information may be transferred as part of that transaction. We will notify you by email or a notice on the Service before your information becomes subject to a different privacy policy.
• With your direction or consent.

6. Cookies, local storage and advertising tags

theproxxie.com (marketing site). The site itself sets no cookies. On our production domain only, it loads two advertising tags:

• Meta Pixel (Meta Platforms, Inc.), which may set cookies and record page views and sign-up conversions so we can measure and improve our ads on Facebook and Instagram.
• Google Ads conversion tag (Google LLC), which may set cookies and record page views and conversions for our Google Ads campaigns.

Both providers receive your IP address, browser information and the pages you viewed, and may combine this with information they already hold about you under their own privacy policies. You can opt out through Meta's ad settings, Google's ad settings, browser settings that block third-party cookies, or a browser or extension that sends the Global Privacy Control signal, which we honour as an opt-out of sharing for targeted advertising.

app.theproxxie.com (dashboard). The dashboard uses your browser's local storage, not cookies, to keep you signed in (a session token that expires after one hour of inactivity), to remember an email address while you verify it, and to remember small interface preferences such as a dismissed notice. This storage is strictly necessary to operate the Service and contains no advertising identifiers. The dashboard contains no third-party analytics or advertising tags.

The chat widget on customer websites. The widget uses the host page's session storage to remember, for the current browser tab only, whether its teaser message has already been shown. Each conversation uses a random session identifier that is not stored in the browser between visits and is not used to track you across sites. The widget sets no cookies and loads no advertising or analytics tags. The website you are visiting may set its own cookies, which are covered by that website's privacy policy.

Do Not Track. We honour the Global Privacy Control signal as described above. Because there is no agreed standard for "Do Not Track" browser signals, we do not respond to them.

7. Service providers (sub-processors)

We use the following companies to run the Service. Each receives only the information needed for its task and is bound by a contract that restricts its use of that information.

Provider	Purpose	Information involved	Location
Xano, Inc.	Application backend and database hosting	All account data, Customer Content, Chat Visitor data, logs	United States
OpenAI, L.L.C.	Generating chatbot replies and knowledge base embeddings	Chat messages, recent conversation, relevant knowledge base passages, chatbot instructions	United States
Stripe, Inc.	Subscription payments and billing portal	Name, email, card details (collected by Stripe directly), plan and payment history	United States
Resend, Inc.	Sending transactional email (verification, password reset, lead alerts, account notices)	Recipient email address and the email contents	United States
Cloudflare, Inc.	Hosting and delivering the website, dashboard and chat widget, DDoS protection	IP address, request logs	United States and global edge network
Meta Platforms, Inc.	Advertising measurement on theproxxie.com only	See section 6	United States
Google LLC	Advertising measurement on theproxxie.com only	See section 6	United States

We will update this list when we add or replace a provider. Customers who need advance notice of sub-processor changes under a data processing agreement can ask for it at legal@theproxxie.com.

8. International transfers

Proxxie is based in Seattle, Washington, and the Service is hosted and operated in the United States. If you use the Service from outside the United States, your information will be transferred to, stored and processed in the United States, where privacy laws may differ from those in your country. Where the law of the EEA, UK or Switzerland applies, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum) with our providers, or on their certification under the EU-U.S. Data Privacy Framework, to protect those transfers.

9. If you chatted with a business's chatbot

The business whose website you were on controls the information you shared in that chat. It decides how long to keep conversations (it can turn history off, or set a retention period after which we delete the messages automatically), who at the business sees your name and email, and how it follows up with you.

To access, correct or delete what you shared, contact that business directly; its own privacy policy should say how. If you contact us at legal@theproxxie.com instead, we will pass your request to the business and help it respond, and we will delete your information if the business instructs us to or no longer uses the Service.

Proxxie uses what you share in a chat only to run the chatbot and deliver your details to that business. We never contact Chat Visitors for our own marketing, and we never combine Chat Visitor data across different businesses.

10. How long we keep information

• Account information: for as long as your account exists. After it is closed, it may be deleted after 90 days; until then you can reactivate or ask for your data. We may keep billing records for up to 7 years where tax and accounting laws require it.
• Customer Content (knowledge bases, chatbot settings, branding): until you delete it or close your account. After the account is closed, it may be deleted after 90 days.
• Chat conversations: according to each chatbot's history setting chosen by the account holder. With history off, we store the visitor's name and email and the number of messages but not the message text. With history on, messages are kept until the chatbot or account is deleted.
• Leads (Chat Visitor names and emails): until the account holder deletes them, deletes the chatbot, or closes the account.
• Expired trials: accounts whose free trial ended without a subscription, and their content, may be deleted 90 days after the trial ends.
• Logs and rate-limit records: rate-limit records for 24 hours; other technical logs are kept for as long as needed for security and troubleshooting, generally no more than 12 months.
• Backups: deleted data may remain in encrypted backups for up to 30 days before it is overwritten.

We may keep information longer where needed to comply with a legal obligation, resolve a dispute or enforce our agreements, and we may keep de-identified or aggregated data indefinitely.

11. Security

We protect personal information with technical and organisational measures that include encryption in transit (TLS) for every connection to the Service, encryption at rest by our hosting provider, hashed passwords, email verification for new accounts, rate limiting on sensitive endpoints, per-account access checks on every request, audit logs of administrative actions, and access to production data restricted to the people who need it. Chatbots that are not activated cannot be reached from the public internet.

No system is completely secure, and we cannot guarantee that unauthorised access will never occur. If we learn of a breach that affects your personal information, we will notify you and any relevant authority as required by law. Keep your password private, choose one you do not use elsewhere, and tell us at support@theproxxie.com immediately if you think your account has been compromised.

12. Your rights and choices

Depending on where you live, you may have the right to:

• Access the personal information we hold about you and receive a copy in a portable format.
• Correct inaccurate or incomplete information. Account holders can update most account details in the dashboard.
• Delete your personal information. Account holders can delete chatbots, knowledge sources and leads in the dashboard, and can ask us to close and delete the whole account.
• Object to or restrict our processing, including processing based on legitimate interests.
• Opt out of marketing email (use the unsubscribe link or email us) and of "sharing" for targeted advertising (section 6).
• Withdraw consent where processing is based on consent, without affecting processing that happened before.
• Not be discriminated against for exercising any of these rights.
• Appeal a decision we make about your request, and complain to a supervisory authority (in the EEA, your national data protection authority; in the UK, the Information Commissioner's Office).

To exercise any of these rights, email legal@theproxxie.com from the address on your account, or tell us how we can verify that you are the person the information is about. We will respond within 30 days (or sooner where the law requires it), and we may ask for more information to confirm your identity. You may use an authorised agent to make a request if you give the agent written permission and we can verify your identity.

We do not sell personal information and have not done so in the preceding 12 months. We do not knowingly sell or share the personal information of anyone under 16.

Chat Visitors should see section 9.

13. Children

The Service is for businesses and is not directed to children. We do not knowingly collect personal information from anyone under 16 through our website or dashboard, and customers may not deploy chatbots that are directed to children. If you believe a child has provided us with personal information, email legal@theproxxie.com and we will delete it.

14. Changes to this policy

We may update this policy from time to time. We will post the new version here with a new "Last updated" date. If a change materially reduces your rights or changes how we use personal information we already hold, we will notify account holders by email or a notice in the dashboard at least 14 days before it takes effect. Your continued use of the Service after that date means you accept the updated policy.

15. Contact us

Proxxie, Seattle, Washington, United States.

Privacy questions and rights requests: legal@theproxxie.com Account and security help: support@theproxxie.com