Last updated: September 17, 2026

Privacy policy

Huxi is a CRM with an artificial-intelligence assistant that answers a business's WhatsApp. Here, in plain language, is what data passes through Huxi, what it is used for and how it is deleted. If anything is unclear, write to privacidad@iahux.com.

Who is responsible

Huxi (iahux.com), in Colombia. We are the data controller for the people who use the panel (the client businesses and their teams) and we act as a processor for the data of the people each business talks to: that data belongs to the business, which decides what it uploads and for how long.

What data Huxi handles

• About the business account: name, email, phone, password (hashed, we never see it), logo and colors, business hours and the assistant's configuration.
• About the business's contacts: name, WhatsApp number, the messages exchanged over WhatsApp and whatever the business chooses to note on each record (a debt, an appointment, a tag, a note).
• From WhatsApp: the access token for the business's number, stored encrypted. Messages come and go through the official WhatsApp Business API (Meta).
• Files: the ones the business uploads (catalog, payment proofs, case documents) and the ones its contacts send. They are served only through signed, expiring links.
• Payments: we never see or store card numbers. Charges are processed by the gateway the business connects (for example ePayco or Wompi); Huxi stores the reference and the status of each payment.

What it is used for

• So the assistant can reply on WhatsApp with the information the business itself uploaded.
• To book appointments and send the reminders and follow-ups the business configured.
• So the business's team can see its conversations, its board and its reports.
• To bill the business for its subscription and notify it of upcoming due dates.

We do not sell data, we do not use it for advertising and we do not train AI models on customers' conversations. The assistant uses a language model from an external provider (OpenAI), which receives the message and the context needed to reply; under its API terms, that provider does not use this data for training.

Google Calendar data

If a business connects its Google Calendar from the panel ("Connect with Google"), Huxi requests these permissions and uses them only for this:

• See your availability (calendar.freebusy): so the assistant never offers a time you already have taken. It only reads whether a range is free or busy; it does not read the title, description or attendees of your events.
• Create and edit events (calendar.events): to copy every appointment booked in Huxi into your calendar, remove it if it is cancelled, and create a Google Meet room when the appointment is a video call. Huxi only touches the events it created; it never edits or deletes yours.
• Your email (userinfo.email): to show you which account is connected.

Only the access token (encrypted) and the email of the connected account are stored. Availability data is queried at the moment and never stored. You can disconnect the account at any time from the panel (Business hours → Your Google Calendar) or from your Google account permissions; when you do, the token is revoked and deleted. Events already created in your calendar stay, because they are yours.

Huxi's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. That information is not transferred to third parties except to provide the feature described, is not used for advertising, and is not read by any person except with your explicit permission, for security purposes, or when required by law.

Who it is shared with

Only with the providers needed for the service to work, and only what each one needs: Meta (WhatsApp Business API) to send and receive messages; OpenAI so the assistant can reply; the payment gateway the business connects; Google, if the business connects its calendar; and the hosting provider where Huxi runs. None of them receives data for their own purposes.

How long it is kept

For as long as the business account is active. If a business closes its account, its data (contacts, conversations, files, appointments) is deleted within 30 days at most, except what the law requires us to keep (for example, billing records). Backups are rotated and disappear within the same period.

Your rights

Under Colombian Law 1581 of 2012 and its regulations, you can access, update, correct and request the deletion of your data, and withdraw your consent. If you are a person who talked to a business that uses Huxi, the request goes to that business, which decides about your data; if you cannot reach it, write to us and we will forward the request. We answer within 15 business days at privacidad@iahux.com.

Security

Everything travels encrypted (HTTPS). WhatsApp, payment-gateway and Google tokens are stored encrypted. Each business sees only its own data: isolation between clients is checked with automated tests on every release. Passwords are stored hashed and never in plain text.

Changes

If this policy changes in any way that matters, client businesses are notified by email before it applies. The date above says when it last changed.