Privacy Policy

1. Scope

This Policy applies to personal data we process as a controller when:

• You visit tixlabs.io or any subdomain we operate;
• You submit a form, request a demo, subscribe to communications, or contact us;
• You message us or our customers through the WhatsApp Business Platform via Chatix;
• You receive messages or advertising attributed to our campaigns through Meta or Google.

When our customers use our products to process their end-users' data, those customers are the controller and Tix Labs acts as a processor on their behalf. In that case the customer's privacy policy applies to those end-users, and our role is governed by the written agreement between Tix Labs and that customer.

2. Personal data we collect

2.1 Data you give us directly:

• Identification — Full name, company name, job title;
• Contact — Email address, phone number, WhatsApp number;
• Commercial — Country, industry, use case, message content you send to us;
• Account — Username, password (hashed), authentication tokens;
• Billing — Tax ID (NIT), billing address, payment confirmation reference (we do not store full card numbers).

2.2 Data collected automatically. When you interact with our websites or products we collect, via cookies, SDKs, server logs, and pixels:

• IP address, approximate geolocation derived from IP, user agent, device and browser identifiers, language settings;
• Pages viewed, referrer URL, session duration, click events, form submissions;
• Marketing attribution parameters (UTM tags, fbclid, gclid, click IDs);
• Crash logs and diagnostic data.

2.3 WhatsApp messages. When you message a Chatix-powered number — ours or our customers' — your WhatsApp phone number, profile name (if visible), message content, attachments, and conversation metadata are processed by Meta and transmitted to our infrastructure to deliver the requested service. See Section 4.2.

3. Why we process personal data

We process personal data only when we have a lawful basis: to perform a contract with you, to comply with a legal obligation, with your consent, or for our legitimate business interests where those interests are not overridden by your rights. Specific purposes:

• Respond to your inquiry, demo request, or support ticket;
• Provide our products and platform features;
• Send service emails (security alerts, billing, product changes);
• Send marketing communications when you opt in;
• Run, measure, and attribute advertising via Meta and Google;
• Operate Chatix and route WhatsApp conversations;
• Detect, prevent, and investigate fraud, abuse, and security incidents;
• Comply with tax, accounting, and other legal obligations in Guatemala.

You may withdraw consent at any time without affecting the lawfulness of processing already carried out.

4. How we share personal data

We do not sell personal data. We share it only with the parties below.

4.1 Service providers (processors). Hosting, email delivery, error monitoring, customer support, analytics, and payment processors that act on our documented instructions and are bound by written confidentiality and security obligations.

4.2 Meta Platforms, Inc. We share specific data with Meta for the following purposes:

• Conversions API (CAPI): When you submit a form or complete a key event on our sites, we send Meta a hashed (SHA-256) version of your email address, phone number, and other identifiers, together with the event name, event time, source URL, IP address, and user agent. This is used to attribute the event to ad campaigns and to improve ad delivery. We deduplicate against client-side Pixel events;
• Meta Pixel: Loaded on our marketing pages to record page views, clicks, and standard events;
• WhatsApp Business Platform: Messages exchanged through Chatix flow through Meta's infrastructure. Meta processes the message content to deliver it and applies its own retention rules in addition to ours;
• Custom Audiences: Hashed email or phone lists may be uploaded to build advertising audiences. You can opt out (Section 7).

Meta's processing of this data is governed by Meta's own terms and privacy policy at https://www.facebook.com/privacy/policy.

4.3 Google LLC. We use Google products for analytics and advertising. Google Analytics (GA4) tracks page views, sessions, events, and user journeys; IP addresses are processed by Google for geolocation. With Google Ads and Google Tag Manager, when you click a Google ad and reach our site we record the click ID (gclid) and report conversions back to Google to attribute the event and improve ad delivery. Google's processing is governed by its privacy policy at https://policies.google.com/privacy. You can opt out of Google Analytics via https://tools.google.com/dlpage/gaoptout.

4.4 WhatsApp opt-out. You can stop messages at any time by replying STOP or by blocking the number in WhatsApp.

4.5 Other recipients. CRMs, ERPs, and integrations chosen by our customers: we sync the leads and events that the customer instructs us to sync. Professional advisors: lawyers, auditors, accountants, under confidentiality. Authorities: where required by Guatemalan law, a court order, or a binding request from a competent authority. In a corporate transaction: a successor in interest, with notice to you.

5. Payments

We use third-party payment processors (such as Stripe, Paggo, or similar) to collect payments. We do not store full payment card numbers on our infrastructure. We receive a transaction reference, last four digits, brand, and authorization status.

6. Data retention

We keep personal data only for as long as we need it. Concrete retention periods:

• Marketing leads (no contract signed) — 24 months from last interaction, then deleted or anonymized;
• Customer account data — Duration of the contract + 5 years (Guatemala tax/accounting requirements);
• WhatsApp conversation history (where we process for our own marketing) — 12 months;
• WhatsApp conversation history (where we process on behalf of a customer) — Per the customer's written instructions; default 6 months;
• Website analytics and CAPI event logs — 13 months;
• Billing records and invoices — 5 years (Código Tributario, Guatemala);
• Backups — Overwritten on a rolling 30-day cycle.

After these periods we delete or irreversibly anonymize the data.

7. Your rights

You have the right to:

• Access the personal data we hold about you and obtain a copy in a portable format;
• Rectify inaccurate or incomplete data;
• Delete your data ('right to be forgotten'), subject to legal retention duties;
• Restrict or object to processing, including for direct marketing;
• Withdraw consent at any time.

How to exercise your rights: Send a request to hello@tixlabs.io with the subject line 'Data Rights Request — [your action]'. We respond within 30 days.

Data deletion shortcut for Meta reviewers and end-users: To request deletion of your data, email hello@tixlabs.io with the subject 'Delete my data' and include the email address, phone number, or WhatsApp number associated with your data. We confirm deletion within 30 days. For WhatsApp-specific deletion requests, include 'WhatsApp deletion' in the subject — we will purge conversation history tied to your number.

8. Visitors from outside Guatemala

Our services are operated from Guatemala. If you access them from another country, your data may be transferred to and processed in Guatemala, the United States (where Meta, Google, and our hosting providers operate infrastructure), the European Union, and other countries where our processors operate. If you are located in a jurisdiction with stronger data protection rights — such as the European Union, the United Kingdom, Brazil, Mexico, Colombia, or California — you may still exercise the rights described in Section 7 by contacting hello@tixlabs.io, and we will honor them in line with applicable local law.

9. Children's privacy

Our products are not directed at children under 13. We do not knowingly collect data from children under that age. If you believe we have, contact hello@tixlabs.io and we will delete the data promptly.

10. Security

We apply administrative, technical, and physical safeguards proportionate to the risk: TLS in transit, encryption at rest for sensitive fields, role-based access control, audit logs, principle of least privilege, vendor due diligence, and incident response procedures. No system is perfectly secure; we encourage you to use strong, unique passwords and to report suspected incidents to hello@tixlabs.io.

11. Cookies and similar technologies

We use cookies, local storage, pixels (Meta Pixel, Google Analytics), and SDKs to make our sites work, remember preferences, analyze traffic, and measure advertising. You can manage or block cookies through your browser settings; blocking certain cookies may reduce functionality. You can opt out of Google Analytics tracking via https://tools.google.com/dlpage/gaoptout and manage Meta ad preferences in your Facebook/Instagram account settings.

12. Third-party links

Our sites and messages may link to third-party services. We are not responsible for their privacy practices. Review their policies before sharing data with them.

13. Changes to this Policy

We may update this Policy. When we do, we change the 'Last updated' date and, for material changes, we notify you by email or a prominent notice on the site at least 15 days before the change takes effect.

14. Contact us

Data Controller: De Origen Noble, S.A. — Address: Guatemala City, Guatemala — Email: hello@tixlabs.io

Under the Constitution of the Republic of Guatemala (Article 31) you have the right to access information held about you and to request correction, deletion, or update. Direct any such request to the email above.