ALCRUXIA SAS · RUT 220830600016 · Young, Río Negro, Uruguay
Alcruxia SAS ("Alcruxia") is the data controller for personal data processed
through its conversational automation and artificial intelligence services, including
Alcruxia Chat (chat.alcruxia.com), this website, and integrated messaging
channels. This policy describes what data is collected, how it is used, with whom it is shared,
and what rights data subjects hold, pursuant to Law 18.331 on Personal Data Protection
and Habeas Data Action of the Republic of Uruguay and its regulatory Decree 414/009.
1. Data We Collect
Alcruxia collects only the information necessary to operate and improve its Services:
Account data: name, email address, company, phone number, and access
credentials of users authorized by the Client.
Conversation content: messages, attachments, and metadata managed on the
platform (source channel, date, time, conversation identifier).
Usage data: dashboard activity logs, operational actions, system
configurations, and recorded events.
Technical data: IP address, browser type, device, operating system, and
connection logs.
Contact form data: when a visitor voluntarily completes the website contact
form (name, company, email address, industry, WhatsApp, and message).
Navigation data: behavioral information on the website collected via Google
Analytics 4 (pages visited, session duration, traffic source, device), as described in
section 10.
When a messaging channel (WhatsApp, Instagram, among others) transmits end-user data from
Clients, Alcruxia processes only the information that channel provides for customer service
management purposes, acting as data processor as described in section 3.
2. How We Use Data
Personal data is used exclusively for the following purposes, with the legal basis indicated
in each case pursuant to Law 18.331:
Provision of contracted services — Legal basis: performance of contract
Management of conversations, automations, and channel integrations — Legal basis: performance of contract
Technical support and Client service — Legal basis: performance of contract
Compliance with legal obligations applicable in Uruguay — Legal basis: legal obligation
Aggregate usage analysis and service improvement — Legal basis: Alcruxia's legitimate interest
Alcruxia does not send marketing communications without the data subject's
explicit consent. Commercial communications from the website are sent only in response to
inquiries voluntarily initiated by the user.
3. Data Controller and Data Processor
Alcruxia acts in two distinct roles depending on the type of data processed:
Data Controller: for data of its own Clients (dashboard users), website
visitors, and contact form submissions. In this role, Alcruxia determines the purposes and
means of processing.
Data Processor: for data of Clients' end users — i.e., individuals who
interact with chatbots and inboxes configured by businesses that contract Alcruxia's
Services. In this role, Alcruxia processes data under the Client's instructions; the Client
is the data controller vis-à-vis its end users.
Alcruxia's Clients are responsible for having a valid legal basis to process their end users'
personal data, for adequately informing them about processing, and for ensuring compliance
with applicable data protection law in their respective countries.
4. Third-Party Processors and Services
To provide the Services, certain data may be processed by external technology providers acting
as data processors under Alcruxia's instructions:
OpenAI API (USA): messages or conversation fragments may be sent to OpenAI
for AI processing functions (suggestions, classification, automated responses). Privacy
policy:
openai.com/privacy
DeepSeek API (China): same for AI functions. Data may be subject to Chinese
law. See section 5. Privacy policy:
deepseek.com/privacy
WhatsApp / Meta API: WhatsApp channel messages are transmitted pursuant to
Meta's policies. Privacy policy:
facebook.com/privacy/policy
Instagram / Meta API: Instagram channel messages are transmitted pursuant
to Meta's policies.
Chatwoot and n8n: self-hosted components on Alcruxia's own infrastructure,
operated under Alcruxia's security and access controls.
Hetzner Online GmbH (Germany / USA): server infrastructure provider hosting
the Services. Data is processed on servers located in the USA (US-West region). Privacy
policy:
hetzner.com/legal/privacy-policy
Amazon Web Services — Amazon S3 (USA): storage of file attachments from
conversations (us-east-1 region). Privacy policy:
aws.amazon.com/privacy
Google Analytics 4 — Google LLC (USA): website traffic analytics. See
section 10.
Alcruxia does not authorize these providers to use data for purposes other than providing the
contracted service. The listed providers act as data processors or connected platforms as
applicable.
5. International Data Transfers
Some of the providers listed in section 4 operate outside Uruguay, which means certain personal
data may be transferred internationally:
OpenAI (USA): transferred data may be covered by standard contractual
clauses or other recognized mechanisms. OpenAI is subject to US federal law.
DeepSeek (China): data sent to DeepSeek may be subject to Chinese
cybersecurity and data protection law, including the Personal Information Protection Law
(PIPL) and potential access requests from Chinese government authorities. Use of AI features
powered by DeepSeek constitutes acceptance of this transfer. The Client may request Alcruxia
configure the service to use only AI models from alternative providers.
Hetzner and Amazon Web Services (USA): infrastructure and storage data is
hosted on US territory and subject to US law.
Google Analytics 4 (USA): website behavioral data is sent to Google's
servers in the United States.
Alcruxia takes reasonable measures to ensure international transfers carry adequate protections
pursuant to Law 18.331 and applicable regulations. For specific inquiries about safeguards for
international transfers, contact
contact@alcruxia.com.
6. No Sale of Data
Alcruxia does not sell, rent, assign, or share personal data with third parties for
commercial, advertising, or profiling purposes.
Data is shared only when strictly necessary for service delivery (technology providers listed
in section 4, under confidentiality and data protection agreements), when the Client connects
an external messaging channel, or when required by law or a competent authority.
7. Data Retention
Account data: retained for the full duration of the active commercial
relationship with the Client.
Conversations and content: retained pursuant to the contracted plan and
Client-defined configuration.
After service cancellation: Client data will be deleted within
30 business days of the effective cancellation date, unless legal retention
obligations apply or the Client requests prior data export.
Contact form data: retained for the time necessary to handle the inquiry
and, if applicable, for the duration of the resulting commercial relationship.
8. User Rights
Pursuant to Law 18.331 of the Republic of Uruguay and applicable regulations, personal data
subjects have the right to:
Access: know what personal data Alcruxia processes and for what purpose
Rectification: correct inaccurate, incomplete, or outdated data
Deletion: request data erasure where no legal retention obligation exists
Portability: receive data in a structured, machine-readable format, where technically feasible
Objection: object to data processing in cases provided by law, particularly for direct marketing purposes
Requests must be sent to
contact@alcruxia.com, indicating full name, request
type, and contact details. Alcruxia will respond within the timeframe established by applicable
regulations.
End users who interact with a business served through Alcruxia's Services may exercise their
rights against that business (data controller), or contact Alcruxia where Alcruxia acts as
data controller for their data.
Regardless of the above, data subjects have the right to file a complaint with the
Uruguayan Personal Data Protection and Privacy Unit (URCDP), the data
protection supervisory authority in Uruguay:
urcdp.gub.uy
9. Security
Alcruxia implements reasonable technical and organizational measures to protect personal data,
including:
HTTPS encryption on all platform communications
Role-based and permission-based data access controls
Authentication controls and operational activity logging
Self-hosted infrastructure with security policies, automated backups, and SSH key-restricted access
Periodic review of access permissions and security configurations
No security system is absolute. Alcruxia cannot guarantee full immunity against external
incidents, but commits to acting with reasonable diligence, containing and mitigating risks,
and notifying affected parties of relevant security incidents pursuant to applicable law.
10. Cookies and Tracking Technologies
Alcruxia's website uses the following technologies:
Essential technical cookies: necessary for the site's operation (theme
preferences, platform session, authentication). They do not collect behavioral information
and are not used for advertising purposes.
Google Analytics 4 — Google LLC: a web analytics tool that collects
visitor behavioral data (pages visited, session duration, device, operating system, traffic
source, among others). This data is sent to Google's servers in the United States and is
used to improve the service and understand site usage. Google may process this data pursuant
to its own privacy policy:
policies.google.com/privacy.
Visitors may opt out of Google Analytics tracking via the official opt-out extension:
tools.google.com/dlpage/gaoptout.
Alcruxia does not use advertising tracking cookies or profiling technologies
for marketing purposes on this site.
11. Minors
Alcruxia's Services are directed exclusively to legal entities and individuals over
18 years of age acting in a professional or business capacity. Alcruxia does not
intentionally collect or process personal data from minors. If data from a minor is found to
have been collected without valid required consent, Alcruxia will proceed with its deletion
as promptly as possible.
12. Changes to This Policy
This policy may be updated to reflect legal, technical, or product changes. Material changes
will be notified by email at least 15 calendar days in advance to the
Client's registered address.
The current version will always be published at
alcruxia.com/privacy with the corresponding
update date. Continued use of the Services after changes take effect constitutes acceptance.
13. Applicable Law and Jurisdiction
This policy is interpreted and applied pursuant to Law 18.331 on Personal Data
Protection and Habeas Data Action and its regulatory Decree 414/009, in force in the
Republic of Uruguay.
For disputes related to personal data processing, the ordinary courts of Montevideo, Uruguay
shall have jurisdiction, unless mandatory law provides otherwise. Data subjects may also
contact the Uruguayan Personal Data Protection and Privacy Unit (URCDP):
urcdp.gub.uy
14. Contact
For privacy inquiries, rights exercise, or personal data-related requests, contact Alcruxia
at: