Privacy policy

Mojara Technologies FZ-LLC
Compass building - Al Hulaila,
AL Hulaila Industrial Zone-FZ,
Ras Al Khaimah, United Arab Emirates

Email: [email protected]

This website and asktrix run exclusively on servers of a hosting provider in the EU, bound by a data processing agreement (Art. 28 GDPR). All traffic passes through the network of a content delivery and security network provider (based in the USA), which fends off attacks and encrypts the connection; as our processor, the provider processes IP addresses and connection data for this, also in the USA, based on the EU-US Data Privacy Framework or standard contractual clauses. When you visit, the server processes technically necessary data (IP address, time, requested URL, user agent) to deliver the page and fend off attacks. Legal basis is Art. 6(1)(f) GDPR. Log files contain no message contents and are rotated automatically: older entries are overwritten once the fixed size limit is reached.

We use no analytics, advertising or tracking cookies and load no fonts or scripts from third parties. Only technically necessary cookies are set:

• __Host-ls_session – Sign-in session (only after login)
• ls_locale – Chosen language
• ls_theme – Light/dark theme
• ls_sidebar – Sidebar collapsed/expanded (app only)

Our help center runs our own asktrix chat widget. It keeps a random visitor ID in your browser's local storage (localStorage) so a started conversation survives the next page load, and records the pages you view and an approximate location (country/city, derived locally from the IP address, no third party). This lets us help you in the chat (Art. 6(1)(f) GDPR). For periods see "Retention".

For registration we process name, email address and a password hash to perform the contract (Art. 6(1)(b) GDPR). Data that our customers collect from their own customers via chat, email or help center is processed by us as a processor under Art. 28 GDPR based on a data processing agreement; the respective customer is the controller.

Paid plans are billed through Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland). You enter payment details such as card or account numbers directly with Stripe; we never receive them. We pass your email address and the chosen plan to Stripe; Stripe collects name, billing address and any VAT ID itself during checkout. We only store Stripe identifiers, the plan and the payment status. The legal basis is performance of the contract (Art. 6(1)(b) GDPR); statutory retention obligations for invoices remain unaffected. Stripe may also process data in the USA based on the EU-US Data Privacy Framework or standard contractual clauses. Details: stripe.com/privacy.

Trix only uses the AI provider and API key the customer configures (e.g. Anthropic, OpenAI or a self-hosted server). Messages are only sent to that provider if the customer has enabled Trix.

With LiveLens, an employee of our customer can ask to see the page on which a visitor has opened the chat widget. Nothing is transmitted until the visitor explicitly agrees in the widget, and the visitor can stop it at any time. What is transmitted is the structure of the current page (HTML, texts, mouse movements, scroll position) – no video, no other tabs, programs or files. Form field inputs are masked in the visitor's browser before anything is sent. If enabled, the employee can scroll and click on that page. The data is relayed through our servers in real time and is neither stored nor recorded. The legal basis is the visitor's consent (Art. 6(1)(a) GDPR); the respective customer is the controller, asktrix acts as a processor.

System emails (confirmation, invitations, notifications) and campaign emails are sent through an email delivery provider that, as a processor (Art. 28 GDPR), only receives the recipient address and content of the respective email. If you enable push notifications, delivery runs through the push service of your browser or device (e.g. Apple, Google, Mozilla); the content is end-to-end encrypted in transit. If a customer connects a Telegram bot, messages in that channel are transmitted via Telegram, whose terms apply in addition.

We keep account data for as long as the account exists; when an account or workspace is deleted, its data is deleted and backups age out after 30 days at most. Billing records are kept for as long as the law requires. Deleted or anonymized automatically, among others: visitor page views after 90 days, IP address, city and coordinates of visitor sessions after 30 days, the sessions themselves after 180 days, anonymous visitors without a conversation after 180 days, IP addresses in login sessions after 90 days.

Our company is based outside the EU (see section 1). The data is stored on servers in the EU; only we ourselves access it from outside the EU, to operate and support the service. Where service providers process data in third countries (e.g. Stripe and our content delivery network provider in the USA), we rely on adequacy decisions of the European Commission or standard contractual clauses (Art. 45, 46 GDPR).

If you write to us, we process your details to handle the request (Art. 6(1)(b) or (f) GDPR) and delete them once they are no longer needed and no retention obligations apply.

You have the right of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR), and the right to lodge a complaint with a data protection supervisory authority. Just send us an email.