Privacy policy

1. Who processes the data

The controller of personal data related to registration, account administration, billing, contact requests and the operation of our own website is ZOXIO s.r.o., Company ID 23468866, Průběžná 6178/2, 708 00 Ostrava, Czech Republic. Privacy contact: zoxio@zoxio.eu.

Where a Customer processes data of website visitors, of people calling its voicebot or personal data in knowledge sources through ZOXIO AI Chat, the Customer will normally be the controller and ZOXIO its processor. A visitor’s or caller’s request concerning a particular chatbot or voicebot should therefore usually be addressed to that Customer.

2. Data we may process

• account data: name, email, authentication and security data, selected language and user role;
• company and billing data: name, address, company and VAT identifiers, billing email and order history;
• payment metadata: payment identifier, amount, status and time; full card details are handled by the payment gateway;
• operational and security data: IP address, request time, browser, device, domain, logs, error reports and feature usage;
• Service configuration and content: chatbot instructions, knowledge content, documents, URLs, product feeds, integration settings and uploaded files;
• conversation data: visitor and AI messages, time, session identifier, feedback, query category and related technical metadata;
• voicebot call data: the caller’s phone number, the time and duration of the call, the text transcript of the call and the results of its analysis (for example a summary, topics and query categories). We do not store audio recordings of calls – the voice is processed only in real time during the call to convert speech to text and produce a spoken answer;
• communications: emails, support requests, complaints and contact messages;
• cookie preferences and data from optional analytics or marketing tools where enabled and supported by an appropriate legal basis.

3. Purposes and legal bases

We process data only to the extent required for a defined purpose:

• providing the account, chatbot, administration, support and billing — performance of a contract or pre-contractual steps;
• accounting, tax, complaints and duties towards authorities — compliance with a legal obligation;
• security, abuse prevention, diagnostics, protection of rights and proportionate Service improvement — legitimate interests;
• sending requested messages and responses — performance of a contract or legitimate interests;
• optional analytics and marketing cookies — consent where required by law;
• processing content, conversations and call transcripts, including their analysis, for the Customer — the Customer’s documented instructions within a processor relationship.

4. Sources of data

We receive data directly from the Customer during registration, chatbot configuration, payment or communication. Other data is generated through use of the Service or submitted by a visitor in a conversation or by a caller during a call with the voicebot. Knowledge content may also come from a URL, file, product feed or system connected by the Customer.

The Customer is responsible for having authority to use connected sources and personal data and for providing all notices required by applicable law.

5. Recipients and subprocessors

Where necessary, data may be processed by vetted providers of hosting and cloud infrastructure, AI models, speech-to-text and text-to-speech, telephony, email and support tools, security services, the GoPay payment gateway and analytics tools enabled under an appropriate legal basis.

Providers are bound by appropriate contractual and security requirements. Data may also be disclosed to public authorities or legal advisers where required by law or necessary to protect our rights. We do not sell personal data.

6. Transfers outside the EEA

Some technology providers may process data outside the European Economic Area. In that case we use a mechanism permitted by the GDPR, such as an adequacy decision or Standard Contractual Clauses, and assess supplementary safeguards where appropriate.

The scope of a transfer depends on enabled features and the providers used at the relevant time. More specific information may be requested at zoxio@zoxio.eu.

7. Retention

• account and contract data is retained for the relationship and subsequently as long as needed to protect legal claims;
• accounting and tax records are retained for the period required by law, typically up to 10 years;
• visitor conversation transcripts, including any contact details entered before the chat, and call transcripts, including the results of their analysis and the caller’s phone number, are retained according to the Customer's plan for at most 90 days from the start of the conversation or call (CHAT and VOICE 14 days, CHAT+ and VOICE+ 90 days), after which they are deleted automatically;
• call audio is processed only for the duration of the call and no audio recording is stored;
• chatbot content and settings (knowledge base, documents, sources) are retained while the Service is active or until deleted by the Customer; after termination they may remain in backups for a limited period;
• security and operational logs are retained for a period proportionate to diagnostics, security and incident evidence;
• contact and support communications are retained while handled and then according to the request and potential legal claims;
• data based on consent is processed no longer than until consent is withdrawn unless another legal basis applies.

8. Customer duties towards visitors

The Customer must clearly inform visitors and callers that they are communicating with AI, identify the controller, describe why messages are used, who may receive them and how rights can be exercised. The Customer must also reflect the use of ZOXIO AI Chat in its own privacy notice. For the voicebot, callers must be told at the start of the call, for example in the greeting, that they are speaking with AI and that a text transcript of the call is made.

The Customer should apply an appropriate retention period, minimise collection and avoid asking visitors to share passwords, full card details, health information or other sensitive data without a clear legal and security framework.

9. Security

We apply technical and organisational measures proportionate to the Service and risk, including access control, communication protection, Customer account separation, backups, logging and ongoing maintenance. No internet system can, however, be described as absolutely secure.

Customers must protect credentials, use strong passwords and promptly report a suspected incident. The Provider and Customer will cooperate on personal data breaches within their respective roles.

10. Your rights

Depending on the circumstances, you may request access, rectification, erasure, restriction or portability, object to processing based on legitimate interests, and withdraw consent at any time without affecting earlier lawful processing.

• For account, payment or direct ZOXIO communication data, contact zoxio@zoxio.eu.
• For data in a chatbot on a particular website, first contact that website operator, who is normally the controller.
• You may lodge a complaint with the Czech Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7, Czech Republic, uoou.gov.cz, or your local supervisory authority.

11. Automation, cookies and updates

ZOXIO AI Chat generates responses automatically, but this is not in itself a ZOXIO decision producing legal or similarly significant effects for an account user. If the Customer uses the chatbot in its own decision-making, the Customer is responsible for legality and any required human review.

Information about cookies and similar technologies is available on the Cookie settings page. We may update this Policy when the Service, providers or legal requirements change and will give proportionate notice of material changes. The Czech version is the governing version if the translations differ.