Privacy Policy

Last updated: 28 September 2026

This policy explains how Stravax Group LLC handles data on Stravax Engage. It covers two different roles: the data we control as the operator of the platform, and the data we process on behalf of our business customers.

1. Who we are and our two roles

Stravax Engage is operated by Stravax Group LLC, United Arab Emirates (licence 2537844.01), registered at Shams Business Center, Sharjah Media City Free Zone, Al Messaned, Sharjah, UAE.

• As a controller, we decide how we handle the account and admin data of the businesses that sign up, and visitors to this website.
• As a processor, we handle the messages, contacts, and related data that our customers route through the platform. In that case the customer is the controller or, where the customer uses the platform for its own clients, the client is the controller and the customer is its processor; either way, we act on the instructions the customer gives us. If you are an end-customer messaging a business that uses Engage, that business, not Stravax, is responsible for your data; please contact them.

2. Information we collect as controller

• Account data: name, work email, business details, and login credentials of the people who administer an Engage account.
• Access and billing data: plan, usage volumes, invoices, and payment status (card details are handled by our payment processor, not stored by us).
• Enquiries: anything you send us by email or through our enquiry forms.
• Website data: standard analytics such as pages viewed, device, and approximate location.

3. Data we process on your behalf

When you use Engage, we process the data you route through it so we can deliver the Service. This includes your contacts' phone numbers, channel identifiers, profile names and email addresses; the content and metadata of messages you send and receive, including voice notes; lead, pipeline and ticket records; and the conversion events and customer lists you choose to sync. We process this on your instructions and do not use it for our own purposes. We do not sell or share this data with third parties for their own purposes, for advertising, or for any purpose beyond operating the Service for you. You are responsible for having a valid opt-in and legal basis for the contacts you message.

For merchants who enable WhatsApp cart and order recovery through our Shopify app, we store, per abandoned checkout, only the customer's name, their phone number (used as the WhatsApp recipient), and non-personal cart metadata (checkout token, cart recovery URL, currency, cart total, item count, timestamps). We do not store the customer's email address, billing or shipping address, payment details, or order line-item contents through this integration, except that when a customer makes a data request through Shopify, we keep a record of that request, including the email address and phone number Shopify sends with it.

4. How we use data

We use controller data to provide and secure the Service, to bill you, to provide support, and (with your consent where required) to send service updates. We use processor data only to operate the platform for you: routing messages on the channels you connect, storing your inbox, running automations and cart recovery, and syncing the conversions you configure.

Where the EU General Data Protection Regulation (GDPR) or the UK GDPR applies, our legal bases for the data we control are:

• Contract, and legitimate interests for team members: to create and run the organisation's account, provide the Service, bill the account holder, give support, and send service messages about the account. Where you are the business that holds the account, we rely on the contract between us. Where you are a team member added to someone else's organisation, you are not a party to that contract, so we rely instead on our legitimate interests in delivering the Service to the organisation that added you and in keeping its account secure.
• Legal obligation, or legitimate interests: to keep billing and tax records and to respond to lawful requests from authorities. Where the obligation is one that EU or UK law places on us, we rely on legal obligation. Where it arises under UAE or other non-EU law, we rely on our legitimate interests in complying with the law that applies to us and in keeping accurate financial records.
• Legitimate interests: to keep the Service secure, prevent fraud and abuse, monitor errors, and understand how the product is used so we can improve it.
• Consent, where required: to send marketing emails where the law requires consent, including in the European Economic Area, the UK and Switzerland. Elsewhere we rely on our legitimate interests in marketing to business contacts. You can withdraw consent or unsubscribe at any time.

For data we process on your behalf, you are the controller, or your client is where you act for it, and the controller decides the legal basis.

5. Service providers

We use a focused set of providers to run the Service. Each processes data only as needed and under its own terms. The table covers three groups: our subprocessors, which are the providers listed in our Data Processing Agreement; platforms you connect, which work under your own agreement with them (see below and section 6); and providers that handle only data we control, such as Google, Apple, Brevo, Sentry and PostHog.

Platforms you connect are not our subprocessors. Meta, for the WhatsApp, Instagram and Messenger channels you connect from your own accounts, Shopify, Stripe for payment links sent from your own Stripe account, the ad platforms (Meta, Google, Microsoft Advertising, TikTok and Snapchat), the CRMs and any ticketing tool you connect receive data on your instruction and act as independent controllers or as your own processors under your agreement with each of them, not under ours. They are listed here for transparency. Section 3 describes what we hold from Shopify, and section 6 describes what we send to the ad platforms, CRMs, ticketing tools and Stripe.

We also use everyday business tools, such as email and support ticketing, which receive only what is needed to handle your request. We keep this list current and take reasonable steps to ensure each provider protects data appropriately.

6. Platforms you connect

If you enable Ad Sync, we send the conversion events you configure to the ad accounts you connect: Meta, Google, Microsoft Advertising, TikTok or Snapchat. Email addresses and phone numbers are hashed before they are sent; click identifiers, IP address and browser details may be sent so the platform can match the event. On the Scale plan you can also upload customer lists to Meta audiences you choose; contacts' email addresses and phone numbers are hashed before upload. If you connect HubSpot, Salesforce or Zoho, or your own ticketing tool, we sync the lead, contact and ticket data you choose to it. You control which events, lists and records are sent and to which accounts, and you can disconnect at any time. Each platform handles the data it receives under its own policies.

Payments in chat. If you connect your own Stripe account, your team can send a customer a payment link in a conversation. We create that link on your Stripe account and send Stripe only the amount, the currency, the description your team writes, and internal references to your organisation and to the payment request. We do not send Stripe your contact's name or phone number. The link itself is delivered to the customer as an ordinary message on the channel you are using. Your customer enters their card details on Stripe's own page: those details never reach our servers, and the payment settles to your Stripe account. Stripe handles the data it receives under its own terms and under your agreement with Stripe.

7. Data retention

We retain account and billing data for as long as you have an account and as required for legal and tax purposes afterwards. Message content and media are retained while your account is active, remain available for export for 30 days after termination, and are then deleted as described in our Data Processing Agreement. Enquiries from our website forms are kept in our enquiry store for up to 90 days. We also add them to our customer relationship system (Brevo) and our email follow-up records, where they stay until you ask us to delete them.

Abandoned-checkout records from the Shopify integration (customer name, phone, and cart metadata) are retained for up to 90 days from the time the checkout was abandoned, and are then deleted. They are deleted sooner when Shopify sends us an erasure request: customers/redact for one customer, or shop/redact for your whole store, which Shopify sends about 48 hours after you uninstall the app. A customers/data_request is not a deletion: we log it, including the contact details Shopify sends with it, and fulfil it manually. A checkout or order also creates or updates the customer's contact record in your workspace (name, phone number and consent status), and cart-recovery and order messages stay in your conversation history. Neither is removed by these requests or by the 90-day limit; to have them deleted, ask us at privacy@engage.stravax.ai.

8. Security

Data is encrypted in transit. At rest, our database and file storage are held in Cloudflare's infrastructure, which encrypts them at the platform level; in addition, each merchant's stored Shopify Admin API access token is separately encrypted at the application layer using AES-256-GCM before it is written to the database. Each customer's data is isolated to its own tenant, and access is scoped and controlled. Message media is stored separately from metadata, and secrets are managed with our hosting provider's secret storage. No system is perfectly secure, but we take reasonable technical and organisational measures to protect data.

9. International transfers

Stravax Group LLC is based in the United Arab Emirates, and our providers, including our hosting provider, Cloudflare, operate global infrastructure, so personal data may be processed outside the country where it was collected. The UAE does not have an adequacy decision from the European Commission, the UK or Switzerland. Where a customer in the European Economic Area, the UK or Switzerland, or a customer whose processing is subject to the GDPR, the UK GDPR or the Swiss Federal Act on Data Protection, routes personal data to us through the Service, the transfer is covered by the European Commission's Standard Contractual Clauses and, for UK data, the UK International Data Transfer Addendum, which are incorporated into our Data Processing Agreement. Where our providers process personal data outside those regions, we rely on the safeguards in their data processing terms, such as Standard Contractual Clauses.

10. Your rights

Depending on where you live, including under the UAE Personal Data Protection Law, the GDPR and the UK GDPR, you may have the right to:

• access the personal data we hold about you and receive a copy;
• have inaccurate data corrected;
• have your data deleted;
• restrict or object to our processing, including objecting at any time to direct marketing;
• receive data you gave us in a portable format; and
• withdraw your consent at any time where we rely on consent, without affecting processing that took place before.

To exercise these rights, email privacy@engage.stravax.ai. We may need to verify your identity. We respond within one month, and we will tell you within that month if we need longer because the request is complex or because you have made several, in which case we may take up to two further months as the law allows. You also have the right to complain to a data protection authority, in particular in the country where you live or work. If your data reaches us from the European Economic Area, the UK or Switzerland through a business that uses Engage, you can also send a complaint about how we handle it to privacy@engage.stravax.ai, and we will deal with it promptly and tell that business. If you are an end-customer of a business that uses Engage, please direct your request to that business, which controls your data; we will assist them as their processor.

11. Cookies and analytics

Our website uses essential cookies and standard analytics to understand usage and improve the site. You can control cookies through your browser settings.

12. Mobile apps

We ask for camera, microphone, location and contacts access only the first time you use the feature that needs it, and for notification permission when you sign in. You can refuse any permission, or withdraw it later in your device settings.

• Camera and photos. To take a photo or video, or choose one, to send in a conversation. Photos you choose come through your device's own picker; the app does not read your photo library.
• Saving images. If you tap Download on an image you received, the app asks for permission to add it to your photo library.
• Microphone. To record a voice note you choose to send. The app does not record at any other time.
• Files. To send a document you pick, and to open documents you receive. Opened documents are kept only temporarily in the app's cache.
• Location. Only when you tap "Send location", to put your current position in a message. The app never uses your location in the background. On iOS you may see a Motion and Fitness permission text, because the location component links an Apple framework; the app does not use motion or fitness data.
• Contacts. Only the one contact you pick, to fill in a new contact or to send it as a contact card. The app never reads your whole address book, and never uploads or syncs it.
• Notifications. If you allow notifications, we link your device's notification token to your account so we can alert you to new messages. We delete it when your sign-out reaches us, when you change or reset your password, and when your account is deactivated.
• Crash and error reports. If the app hits an error, it sends a report to our own servers: the error type, your device platform, the app version, the screen, a technical trace with email addresses and phone numbers removed, and whether the error closed the app. We store the report with your account and workspace, and delete it within 30 days. Reports never include message content or images. The app itself contains no third-party analytics or crash-reporting code. Our servers send basic technical details of the error, never message content, to our error-monitoring provider, Sentry.

Photos, videos, voice notes, files, locations and contact cards that you send become message content, and we handle them like any other message content in this policy.

Removing access and deleting your account. The owner of your workspace can remove your access to it. If it is your home workspace, the owner can deactivate your account instead, which blocks sign-in and removes your devices' notification registrations. To have your account and its data deleted, email privacy@engage.stravax.ai.

13. Children

Engage is a business tool and is not directed to children. We do not knowingly collect data from anyone under 18 through our account signup.

14. Changes to this policy

We may update this policy as the Service evolves. Material changes will be notified in the app or by email before they take effect.

15. Contact

Stravax Group LLC, Sharjah, UAE. Privacy and data requests: privacy@engage.stravax.ai.