Privacy Policy

This Service processes the personal information of two distinct groups, and it is important to understand which one applies to you:

• Account Holders. Businesses and the individuals who register for, pay for, and operate a Broxon account. Most of the rights and obligations in this policy relating to accounts, billing, and login apply to Account Holders.
• Message Senders (End Users).Members of the public who send direct messages to a Facebook Page or Instagram Business account that an Account Holder has connected to Broxon. We process Message Senders’ information on behalf of the Account Holder in order to generate automated replies. If you are a Message Sender, you likely have no direct relationship with Broxon, but you still have privacy rights, which are set out in Section 9.

Roles under data protection law. For Account Holder information, Broxon acts as a data controller. For Message Sender information processed through a connected account, Broxon acts as a data processoracting on the documented instructions of the Account Holder, who is the controller. Both parties’ responsibilities are described in our Terms & Conditions and, where required, in a separate Data Processing Addendum (DPA) available to Account Holders on request.

Because the Service accesses data through Meta’s APIs, we additionally commit to the following, consistent with the Meta Platform Terms and Developer Policies:

• Purpose limitation. Data received from Meta is used solely to provide the messaging functionality the user expects, and not for any independent purpose.
• Page-Scoped User IDs (PSIDs). We use PSIDs only to facilitate the conversation for which they were provided. We do not attempt to correlate a PSID with any other identifier, across Pages, or with data obtained outside the Meta platform.
• No onward sale or unauthorized transfer. We do not sell Meta-derived data and do not transfer it to any party except the service providers in Section 5, each of which is contractually bound to equivalent use and protection restrictions.
• Token handling. Access tokens are stored encrypted (Section 6) and deleted upon disconnection.

We do not sell, rent, or trade personal information. We share information only in the following limited circumstances:

We implement industry-standard technical and organizational measures to protect personal information:

• All data is transmitted over HTTPS with TLS encryption.
• Meta access tokens are stored encrypted using AES-256 and are never exposed in plaintext outside secure server processes.
• Access to production systems and personal data is restricted to authorized personnel on a need-to-know basis.
• We perform regular security reviews of our infrastructure.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. In the event of a breach involving personal information, we will notify affected individuals and the relevant authorities as required by law. For PIPEDA, this means notification where the breach creates a real risk of significant harm. For the GDPR/UK GDPR, we will notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach, and will notify affected individuals where the breach is likely to result in a high risk to their rights and freedoms.

We retain personal information only as long as necessary for the purposes it was collected:

• Account data: Retained for the duration of the account and for up to 90 days following account deletion, after which it is permanently erased.
• Message content:Processed in real time via our queue system. Broxon does not store it persistently beyond what is required to generate a response, except where retained in conversation logs for the Account Holder’s own review within the dashboard (up to 90 days). Our AI provider, Retell AI, retains transmitted message content for up to 90 days to generate responses, after which it is deleted; it is not used for training.
• Billing records: Retained for 7 years as required by Canadian tax law.
• Log data: Retained for up to 90 days for security and debugging.
• Meta access tokens: Stored encrypted and deleted immediately upon account disconnection.

We use the following types of cookies and similar technologies:

• Strictly necessary cookies: Authentication session tokens required to keep you logged into the Service. These cannot be disabled without affecting core functionality.
• Preference cookies: Store UI preferences such as theme settings.

We do not use advertising cookies, third-party tracking pixels, or sell data to advertising networks. Cookies can be controlled through browser settings, though disabling necessary cookies will prevent use of the Service.

Rights apply to both Account Holders and Message Senders. Depending on your location, you may have the following rights regarding your personal information:

How Message Senders exercise rights. If you sent messages to a business using Broxon and wish to exercise any right, you may contact us at support@broxon.ca. Because we process your information on behalf of that business (the controller), we will either action your request directly or forward it to the relevant Account Holder and assist them in responding. You may also contact the business directly.

To exercise any right, contact us at support@broxon.ca. We will respond within 30 days. We may need to verify your identity before processing your request.

Where individuals are in the EEA or UK, we rely on the following legal bases:

The Service is not directed to individuals under the age of 18, and Account Holders must be at least 18. We do not knowingly collect personal information from children. If you become aware that a child has provided us with personal information without parental consent, please contact us at support@broxon.ca and we will take steps to delete such information.

Broxon is based in Ontario, Canada, and our own infrastructure stores data in Canada. However, some of our service providers (such as Retell AI and our payment processor) may process data in other countries, including the United States. Where data is processed outside your jurisdiction:

• For PIPEDA: We take steps to ensure comparable protection through contractual means when transferring data outside Canada, and remain accountable for that information.
• For GDPR/UK GDPR:Where we transfer personal data of EEA or UK individuals to a country without an adequacy decision, we put in place appropriate safeguards — specifically the European Commission’s Standard Contractual Clauses (SCCs) (and the UK International Data Transfer Addendum where applicable). A copy of the relevant safeguards is available on request.

The Service may contain links to third-party websites or services (such as Meta’s developer portal). This Privacy Policy does not apply to those third-party sites. We encourage you to review the privacy policies of any third-party services you visit. We are not responsible for the privacy practices or content of third-party sites.

We may update this Privacy Policy to reflect changes in our practices, technology, legal requirements, or Meta’s platform policies. We will post the updated policy here with a revised “Last updated” date and, for material changes, notify Account Holders by email. Continued use of the Service after changes constitutes acceptance of the revised policy.

If you have any questions, concerns, or complaints about this Privacy Policy or our data practices, please contact our Privacy Officer:

If you are in Canada and are not satisfied with our response, you may file a complaint with the Office of the Privacy Commissioner of Canada (OPC) at www.priv.gc.ca. If you are in the EEA or UK, you may lodge a complaint with your local supervisory authority.