1. Who we are
This service ("Pixie") is operated by BytesPlatform ("we", "us", "our"). When you message our WhatsApp, Messenger, or Instagram accounts, or use one of our chat widgets, we act as the data controller for the personal data you share during that conversation. Contact us at hello@pixiebot.co for any privacy question.
2. What data we collect
- Your phone number / social handle — provided by WhatsApp, Messenger, or Instagram when you message us.
- The content of your messages — text, images, voice notes (transcribed), location pins, and files you upload (logos, documents).
- Business details you share to build a website, chatbot, ad, or report — business name, industry, services, pricing, hours, and contact details.
- Payment records if you buy a paid service — Stripe handles card data; we receive only the payment status, the name and email on the receipt, and the amount.
- Technical metadata — message timestamps, the business number you reached us on, and the channel (WhatsApp / Messenger / Instagram).
3. Why we use it (legal bases)
- To deliver the service you asked for (Art. 6(1)(b) GDPR — performance of a contract).
- To improve the service and prevent abuse (Art. 6(1)(f) — legitimate interests). We log conversations so a human can step in when the bot gets stuck.
- To comply with legal obligations (Art. 6(1)(c)) — accounting and tax records for paid transactions.
4. Who else sees it
We use a small number of sub-processors to run the service. None of them sell your data:
- Meta Platforms — WhatsApp / Messenger / Instagram messaging infrastructure.
- Anthropic and OpenAI — to generate replies. We send only the context needed for the current reply; no data is retained for training under the API terms.
- Supabase — primary database for conversations, payments, and generated sites.
- Netlify — hosting for generated websites.
- Stripe — payment processing (independent controller for card data); see stripe.com/privacy.
- SendGrid — transactional email (lead notifications, receipts).
- Namecheap / NameSilo — domain registration (only if you choose a custom domain).
- Render / Vercel — server hosting.
5. How long we keep it
- Conversation history — kept while your account is active; deleted on request, or after 24 months of inactivity.
- Generated assets — kept while you remain a paying customer; removed within 30 days of cancellation unless you ask us to keep them.
- Payment records — retained for 7 years for accounting and tax.
6. Your rights
Under GDPR (and equivalent laws in the UK, California, and other regions) you can access, correct, export, restrict, or object to the processing of your data, withdraw consent, and ask us to delete your data. To exercise any of these, use our data deletion page or email hello@pixiebot.co. We respond within 30 days.
7. International transfers
Our sub-processors operate primarily from the United States. Where we transfer data outside the EEA / UK, we rely on the European Commission's Standard Contractual Clauses.
8. Children
This service is not intended for users under 16. If you believe a minor has provided us with data, contact us and we'll delete it.
9. Changes to this policy
When we change anything material we'll update the "last updated" date above and, where the change affects data we already hold, notify you before it takes effect.