Politique de confidentialité

Ce document est disponible en roumain et en anglais. La version anglaise est affichée ci-dessous.

This policy explains what personal data Xelak processes through the xelaktech.com website and the Xel platform, why we process it, and how you can exercise your rights.

Dernière mise à jour: 28 septembre 2026

1. Who we are

This policy is issued by Xelak Technology, IDNO 1024600013225, registered office at MD-2086, mun. Chișinău, s. Dobrogea, str. Ion Creangă 9, of. 18, Republic of Moldova ("Xelak", "we"). For any question about personal data, email contact@xelaktech.com or call +373 60 494 719.

2. Scope

This policy covers:

the xelaktech.com website;
the Xel platform (the app.xelak.ai console, the API, the chat widget and connectors) that businesses use to run AI assistants in conversations with their customers;
the "Xel" app on Meta platforms (Instagram, Facebook Messenger, WhatsApp) and the Xel bots on Telegram.

3. Our roles

Our role depends on how you interact with us:

Controller — when you visit our website, contact us, or use the Xel console as a user of a business: we decide the purposes and means of processing, as described in this policy.
Processor — when you message a business (a shop, a clinic, etc.) that uses Xel, on Instagram, Messenger, WhatsApp, Telegram or through the widget on its website: the business is the controller of your data, and we process it only on its behalf and on its instructions. Please also read the business's own privacy policy.

4. Data we process

We do not ask for, and try not to process, special categories of data (e.g. health data), card data or national identification numbers (IDNP); if they appear in a conversation, they are masked in technical logs.

Website visitors: data sent through the contact form (name, email, phone, company, message); technical data (IP address, browser type, pages visited, security events); cookie preferences.
Xelak customers and console users: name, email, phone, role in the organisation; account and sign-in data; access and audit logs; billing and payment data.
Administrators who connect Meta accounts through Facebook Login: app-scoped user ID, access tokens, the list of authorised Pages and Instagram accounts.
People who message a business that uses Xel: platform identifier, displayed name or username, the content of messages and comments addressed to the business, files sent, date and time; data provided for an order or booking (e.g. name, phone, delivery address); communication preferences, including opt-outs.

5. Purposes and legal bases

We process data only for clear purposes, each with its own legal basis:

Answering enquiries and preparing offers — pre-contractual steps and our legitimate interest in responding.
Providing the Xel platform to businesses (accounts, conversations, orders, analytics, support) — performance of the contract with the business.
Processing end customers' conversations — on behalf of and on the instructions of the business (the controller), under the data processing agreement (DPA).
Security, abuse prevention and audit logs — legitimate interest in protecting the platform and its users; legal obligations.
Invoicing and accounting — legal obligation.
Marketing about Xelak's products — consent or, for existing customers, legitimate interest, with an opt-out at any time.
Improving the service — aggregated or de-identified metrics only, kept separately for each business. We do not train AI models on customer data.

6. AI assistants

Xel assistants follow these rules:

They introduce themselves as automated assistants at the start of a conversation and when a conversation returns from a human to the assistant; businesses cannot switch this disclosure off.
Prices, stock, delivery costs and delivery times given by the assistant come from the business's own systems; they are not generated by the model.
You can ask to speak to a human at any time; the business's team then takes over the conversation.
We do not make decisions that produce legal or similarly significant effects on you based solely on automated processing.
AI model providers process data only to generate the response, through APIs that do not use the data to train their models.

7. Data received from Meta platforms

When a business connects its Meta accounts (Instagram, Messenger, WhatsApp) to Xel:

we process this data solely on behalf of that business and on its instructions, to provide the service it requested;
each business's data is kept separate from other businesses' data and is never used for other businesses;
we do not sell, license or purchase this data; we do not use it for advertising, surveillance, eligibility decisions (credit, employment, insurance, housing, etc.) or to build profiles for any other purpose;
we delete the data when it is no longer needed, when the business disconnects its accounts or stops using Xel, when you or Meta request it, or when the law requires it — see our data deletion page.

9. International transfers

The Xel platform is hosted in the European Union (Germany and Finland). Some AI model processing may take place in the USA (OpenAI, Voyage AI), under lawful transfer mechanisms (the EU–U.S. Data Privacy Framework and/or standard contractual clauses). At a business's request, we can enable the "EU strict" option, in which AI models run only in European Union regions.

10. How long we keep data

Default retention periods are:

website contact form messages: up to 24 months after the last contact, then deleted unless a contract has started;
end customers' conversations: 12 months (configurable by the business); leads: 24 months (configurable by the business);
technical logs and AI traces: 30 days;
usage records and invoices: 5 years (tax obligations); audit log: 3 years;
a business's data after the contract ends: 30 days for export, then deletion;
backups: overwritten within 35 days; cookie preferences: 12 months.

11. Security

Data is encrypted in transit and at rest; each business's data is isolated at database level; each business's secrets (tokens, keys) are encrypted with dedicated keys managed separately from the data; staff access is role-based, with two-factor authentication and logging; sensitive data is masked in logs.

12. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability, objection and withdrawal of consent, and the right not to be subject to a decision based solely on automated processing. For conversations with a business that uses Xel, you can contact the business directly or contact us — we help the business respond. We reply within the legal deadline, normally within 30 days.

You may lodge a complaint with the National Center for Personal Data Protection (Republic of Moldova) or, if you live in the EU, with the data protection authority of your country (in Romania — ANSPDCP).

13. Data deletion

Full instructions, including for people who connected accounts through Facebook Login, are on our "Data deletion" page, linked in the site footer.

14. Children

Xelak's services are aimed at businesses. We do not knowingly collect children's data for our own purposes; businesses that use Xel are responsible for the compliance of their communications with customers who are minors.

15. Changes

We may update this policy when our services, providers or legal obligations change. The current version is published on this page with its last-updated date; we inform customers of significant changes by email or in the console.