Legal

Stravax Engage Merchant Terms of Service and Data Processing Addendum

Published: 24 October 2026

Version: 1.1 | Effective: on acceptance while linking your store

Acceptances stamped "1.0" recorded acceptance of the general Terms of Service version 1, which remains available at https://engage.stravax.ai/terms/v/1/. The separate merchant agreement 1.0 was never published or shown through that acceptance link. Agreement 1.1 is the first merchant agreement shown on its own pages. Existing acceptance records are preserved; they are not acceptance of agreement 1.1.

Part A. Terms of Service (summary)

The service. Stravax Engage is a business messaging engagement platform operated by Stravax Group LLC, a limited liability company licensed by Sharjah Media City Free Zone Authority (Shams), Sharjah, United Arab Emirates (Licence No. 2537844.01), registered at Sharjah Media City (Shams), Al Messaned, Al Bataeh, Sharjah, UAE. The connected e-commerce platform app sends business messaging abandoned-cart and order-recovery messages to your customers, on your instruction, and reports whether they led to a completed order.
Your account. You are responsible for the accuracy of your account details, for keeping your login credentials secure, and for the actions of the users you invite.
Your responsibilities as the merchant. You are the controller of your customers' data. You are responsible for having a lawful basis and the consent required to message your customers on business messaging, and for complying with the messaging policies of the connected messaging platforms and their operators. Recovery sending checks the contact's stored marketing opt-in. A contact can be created and retained before that check, including when no recovery message is sent.
Fees. Cart recovery is billed through connected e-commerce platform's managed pricing at the plan price shown in the app. Business messaging costs are metered and drawn from your prepaid wallet balance.
Acceptable use. You will not use the service to send unlawful, deceptive, or unsolicited messages, or to message customers who have not consented.
Availability and liability. The service is provided on a commercially reasonable-efforts basis. Nothing here excludes liability that cannot be excluded under UAE law.
Termination. You may uninstall the app at any time. Uninstall disables the connected e-commerce platform integration and removes its stored access token. Connected e-commerce platform privacy handling deletes certain checkout records as described in Part B, section 7; it does not erase the whole workspace or every copy of your customers' data.

Part B. Data Processing Addendum (DPA)

1. Roles

For the customer personal data processed through the connected e-commerce platform integration:

You (the merchant) are the data controller.
Stravax Group LLC is the data processor, acting only on your documented instructions.

Installing the app and enabling cart recovery is your instruction to process this data for the purpose in section 3.

2. Categories of data and data subjects

Data subjects: your customers whose checkout, order, contact or message data is handled through the integration, and people whose details are included in a privacy request.
Checkout data: customer name and phone, checkout token and recovery URL, currency, cart total, item count and timestamps. The parser can take a name or phone from an address without storing the full address in the checkout row.
Other records: workspace contacts; recovery and order-status messages; order-notification records linked to the contact and message; and administrative audit records. A connected e-commerce platform data-access request copies the supplied customer id, email and phone, requested order ids and request id into the audit log. Messages and requests can contain additional personal data supplied by the sender.

3. Purpose and scope of processing

We process the data for your recovery and order-status messaging, recovery reporting and privacy-request handling. Contact and conversation records can also be used by connected workspace features described in section 5, including notifications, AI, CRM and advertising integrations. The current messaging-consent check does not automatically apply to every other integration.

We do not sell your customers' data or use it to build our own marketing lists or profile customers across merchants. Section 5 identifies service-provider and connected-recipient paths.

4. Confidentiality and security

We apply the following technical and organisational measures:

Encryption in transit: TLS/HTTPS for all data. Every inbound connected e-commerce platform webhook is verified by HMAC-SHA256 signature before processing; unsigned or mis-signed requests are rejected.
Encryption at rest: Our hosting provider's database and object storage encrypt stored data at rest at the platform level. Your connected e-commerce platform Admin API access token is additionally encrypted with AES-256-GCM at the application layer before storage.
Tenant isolation: every record carries your organisation id; customer-data reads are scoped to that organisation or to record ids already resolved inside it. Your store's binding to your account is established only through a verified connected e-commerce platform OAuth install, never from a client-supplied value, which prevents another party from claiming your store.
Access control and logging: administrative and compliance actions are recorded in an administrative audit log. Entries have no scheduled deletion; organisation-reference columns can be changed by limited organisation-deletion paths without removing the entry's detail.

5. Sub-processors

You authorise the following sub-processors, and you instruct us to send data to the connected recipients you choose to use. The table describes the implemented data paths. Optional integrations receive data only when connected or used. Customer content in these paths can contain names or phone numbers.

Service provider or connected recipient	When it is used	Personal data it can receive
our hosting provider	Hosting, database, object storage, queues, security, transactional email, hosted AI and vector-search services	Platform data, database backups, logs, email recipients and content; audio for speech transcription and speech-to-English translation; document chunks and customer queries for knowledge retrieval
Connected messaging platforms	Connected messaging channels	Recipient phone numbers or channel identifiers, message content and attachments; names used in messages or templates
Connected rich business messaging platform	A connected RCS channel sends a message	Recipient phone number and message content, including media information for supported message types
Mobile push relay and operating-system push services	Mobile notifications	Device push tokens, notification title and body, and workspace and conversation identifiers; inbound-message alerts include the contact's name or phone number and a message preview
Browser push service selected by the browser	Web notifications	Push endpoint and delivery metadata, plus an encrypted notification payload; web message previews follow the browser subscription's preview setting
our AI provider	AI qualification and playbook tests, reply suggestions, conversation insights, transcript translation into languages other than English, voicemail summaries and support-ticket triage; text-based site audits and creative or email drafting where those features are available	Conversation text and voice transcripts, known lead fields, reference-document excerpts, support-ticket subject and body, and supplied or fetched drafting and audit text; enabled image-reading can also send images, and enabled order lookup can send order status and tracking information
Connected advertising platforms	Configured conversion integrations	Conversion events and identifiers, which can include hashed email addresses and phone numbers, click or browser identifiers, and, for supported integrations, IP address and user agent; connected platform operator audience uploads can also send hashed contact or lead identifiers and selected audience values
Connected CRM platforms	A workspace connects a CRM and synchronises leads	Lead name, email, phone, company and deal information, according to the connector and field mapping
the ticketing provider and workspace-configured ticket or outbound webhook destinations	Connected ticket or event integrations	Ticket subject, body, status and priority, or the subscribed event payload, which can include contact identifiers, phone numbers and message text; platform support tasks use a separate reduced payload
connected e-commerce platform	Connected store webhooks, billing and order lookup	Supplies checkout and order data; also receives connected-store API requests, including order-lookup requests for a supplied order number
the connected payment provider	Subscription billing, wallet top-ups and payment links a workspace sends from its own account with the connected payment provider	Business billing and checkout information and workspace references; for payment links, the amount, currency, the agent's description and request identifiers, then the customer's payment on the connected payment provider's page; the message-delivery path does not send customer conversations to the connected payment provider
our operational email provider	Engage operational mailboxes	Emails sent to or received by those mailboxes, including sender and recipient information and any personal data included in the email
External sign-in providers	A team member chooses that sign-in method	Sign-in requests and identity-provider tokens or codes used in authentication
our error-monitoring provider	Server error forwarding, if configured	Error severity, type, an identifier-only source and workspace identifier; the forwarding payload excludes free-text error details and message content
our product-analytics provider	Web telemetry and legacy server product events, if configured	Limited application events and workspace or user identifiers; the web client disables autocapture and replay and applies its email, phone and URL-query scrubber
Configured media-generation providers	A media-generation task is explicitly routed to a configured provider	Generation prompt and task parameters, including any personal data supplied in that prompt; the code has no default provider route
the fallback website reader	A site audit uses the configured fallback reader	The requested public website URL and request metadata; the reader fetches the page content

The AI qualifier has its own enable switch, but turning the qualifier off does not turn off every AI feature. Other AI features can send content to our AI provider when they run while workspace AI is enabled. This includes conversation text and voice transcripts from connected messaging channels. Workspace AI defaults to enabled, and the current apps do not ask individual members for an AI choice before these features run. Conversation text, transcripts, images, reference documents and support requests can themselves contain names, phone numbers or other personal data. We do not filter all such details out before sending content to an AI provider.

We will give you notice of any new sub-processor that would process the customer name or phone before it takes effect.

6. Personal data breach notification

If we become aware of a personal data breach affecting your customers' data, we will notify you without undue delay, and no later than 72 hours after becoming aware, with the information you reasonably need to meet your own notification obligations: the nature of the breach, the data and approximate number of records affected, the likely consequences, and the measures we have taken or propose to take. Our incident-handling process is described in the Incident Response Policy.

7. Deletion and return of data

On uninstall: the integration is disabled and its stored connected e-commerce platform access token is removed. For an eligible uninstalled store, shop/redact deletes the store's abandoned-checkout rows. Reconnection protects the store from that erase.
Customer deletion: customers/redact deletes the store's abandoned-checkout rows that match the phone in the request. Missing or unmatched phone numbers result in no rows deleted, including cases where a guest checkout's phone is available only on its address.
Data access: customers/data_request writes an audit entry for an operator to handle. It does not automatically return the customer's data. Logging or accepting a request is not evidence that it has been fulfilled.
Checkout retention: a daily scheduled job deletes abandoned-checkout rows at least 90 days old when it succeeds. The 90-day checkout purge does not delete the separate contact record, recovery or order-status messages, order-notification records or administrative audit entries. Those copies currently have no automatic expiry. A contact can be created before the recovery consent check, including when no recovery message is sent.
Other copies and backups: connected e-commerce platform privacy handlers do not delete separate contacts, conversations, messages, order-notification records, administrative audit entries or existing backups. The documented backup retention window is 90 days from backup creation. A restore can bring deleted records back because deletions are not automatically reapplied. The product has no complete customer or populated-workspace erasure routine. Requests can be raised with privacy@engage.stravax.ai, but this text does not promise a complete 30-day erasure process.

8. Audits and assistance

We will provide reasonable information to help you demonstrate compliance and to respond to data subject requests, taking into account the nature of the processing and the information available to us.

9. Governing terms

This DPA supplements and is governed by the Terms of Service in Part A. In case of conflict on data-protection matters, this DPA prevails.

Acceptance: By accepting the checkbox while linking your store to Stravax Engage, you accept these Terms of Service and this Data Processing Addendum, version 1.1, on behalf of your business.

Stravax Group LLC, Sharjah, UAE · Data protection contact: privacy@engage.stravax.ai

For the current provider list, or to object to a provider, contact privacy@engage.stravax.ai. This correction does not supply earlier notice or authorisation retroactively.