Legal

Stravax Engage Privacy Policy

Last updated: 24 October 2026

1. Who we are

Stravax Engage is operated by Stravax Group LLC, a limited liability company licensed by Sharjah Media City Free Zone Authority (Shams), Government of Sharjah, United Arab Emirates (Licence No. 2537844.01). Registered address: Sharjah Media City (Shams), Al Messaned, Al Bataeh, Sharjah, United Arab Emirates.

Stravax Engage is a business messaging engagement platform. Our connected e-commerce platform app sends business messaging abandoned-cart and order-recovery messages to a merchant's customers, on the merchant's behalf and on the merchant's instructions.

We act in two roles:

As a data controller for the merchant's own account information (the business's login, billing, and administrative data).
As a data processor for the customer personal data a merchant's store sends us for recovery messaging. For that data the merchant is the controller and Stravax Group LLC is the processor, acting only on the merchant's documented instructions.

Stravax Engage is used through a web app and an Android and iOS mobile app, and it connects to connected messaging channels as well as to connected e-commerce platform. This policy covers the whole platform:

Section 2 covers the customer personal data received through the Connected e-commerce platform integration, where we act as a processor for the merchant.
Section 3 covers the personal data handled in the Stravax Engage web and mobile apps, which is what a team member using the apps needs to know.

Throughout this policy, "workspace" means the business account a team member signs in to, and "workspace administrator" means the person at that business who provisions and removes team members.

2. Customer personal data we process through connected e-commerce platform

When a merchant connects a store on a connected e-commerce platform, we receive checkout and order webhooks. The abandoned-checkout record stores the customer's name and phone number, checkout token, cart recovery URL, currency, cart total, item count and timestamps. The app can also create a separate workspace contact containing the name and phone number: for a checkout, before the recovery consent check, including when no recovery message is sent; for an order, when order-status notifications are enabled.

Recovery and order-status messaging creates message records and order-notification records linked to the customer. A connected e-commerce platform data-access request is also copied into the administrative audit log, including the supplied customer id, email address and phone number, requested order ids and request id. The checkout parser can use a name or phone from the shipping or billing address without storing the full address in the checkout record. This is not a promise that personal data included in messages, requests or logs is excluded from storage.

3. Personal data in the Stravax Engage web and mobile apps

People use the apps as workspace account holders and team members. Accounts can be created through business sign-up or by a workspace administrator.

3.1 Account data (we are the controller)

Name and email address, supplied during business sign-up or account creation.
Password, stored only as a salted hash. We never store it in a readable form.
Two-factor secret, only if the team member chooses to turn on two-factor authentication.
Trusted-device records and an IP address, used to recognise a device and, where a workspace has enabled an IP allowlist, to enforce it.
Push registrations, including a mobile push token or a browser push endpoint and encryption keys, linked to the account and session. When you sign out of the mobile app and the sign-out reaches us, the app deletes that device's registration. Signing out of the web app, a mobile sign-out that does not reach us, and session expiry leave stored registrations in place; delivery is checked against a live session and workspace access. Password changes, password resets and account deactivation remove the account's push registrations; invalid mobile tokens can also be removed after a delivery rejection.

3.2 Workspace content shown in the apps (we are the processor)

The apps display the conversations, contacts, leads and campaigns belonging to the workspace. That content includes messages and media exchanged with the business's own customers. The business is the controller of that content; we hold and display it on their instruction. A team member sees it because their administrator granted them access to that workspace.

3.3 Content a team member chooses to send

Each item below is handled only when the team member actively chooses to send it, and each is requested at first use behind an in-app explanation. Declining any of them leaves the rest of the app working.

What	When it is used	What reaches our servers
Photos and videos	Taking a photo or picking one to send	The image or video, as a message
Voice notes	Recording a voice message in a conversation	The audio recording, as a message
Documents	Picking a file to send	The file, as a message
Location	Choosing "Send location"	The device's current coordinates at that moment
A contact card	Choosing to share a contact	The name and phone numbers of the one contact selected

Two limits are worth stating plainly, because they are enforced in the app rather than merely promised. We never upload the address book: only the single contact the team member picks is read. And location is foreground only, captured at the moment of sending. The apps cannot access location in the background, and no background-location permission is requested.

3.4 Advertising and analytics

The mobile app does not collect an advertising identifier or include a third-party analytics SDK. The workspace has separate advertising integrations: configured conversion sync can send customer identifiers and event data to ad platforms, and a manual connected platform operator audience upload can send selected lead or contact identifiers. These paths do not automatically exclude a contact because they have withdrawn messaging consent or are blocklisted. A workspace administrator must account for this when choosing data to upload. The web client also has a conditional telemetry integration described in section 7.

We do not sell personal data.

3.5 Why we process it

Account data is processed to operate the service: to authenticate the team member, to keep the account secure, to deliver notifications, and to bill the business. Workspace content is processed only to provide the messaging, CRM and campaign features the business uses the product for, on that business's instruction.

Mobile apps

We ask for camera, microphone, location and contacts access only the first time you use the feature that needs it, and for notification permission when you sign in. You can refuse any permission, or withdraw it later in your device settings.

Camera and photos. To take a photo or video, or choose one, to send in a conversation. Photos you choose come through your device's own picker; the app does not read your photo library.
Saving images. If you tap Download on an image you received, the app asks for permission to add it to your photo library.
Microphone. To record a voice note you choose to send. The app does not record at any other time.
Files. To send a document you pick, and to open documents you receive. Opened documents are kept only temporarily in the app's cache.
Location. Only when you tap "Send location", to put your current position in a message. The app never uses your location in the background. On iOS you may see a Motion and Fitness permission text, because the location component links an the operating-system provider framework; the app does not use motion or fitness data.
Contacts. Only the one contact you pick, to fill in a new contact or to send it as a contact card. The app never reads your whole address book, and never uploads or syncs it.
Notifications. If you allow mobile notifications, we send the device push token, notification title and body, and workspace and conversation identifiers to a mobile push relay for delivery through operating-system push services. Inbound-message alerts include the contact's name, or phone number if no name is available, and a preview of the message of up to 140 characters. These providers receive readable notification content over HTTPS. The mobile app has no separate preview-off setting. Device settings can control notification permission and what appears on the lock screen. When you sign out and the sign-out reaches us, the app deletes this device's push registration. If it does not reach us, or the session expires, the registration stays stored, but delivery checks exclude a session that has ended. A delivery already authorised or in progress may still complete. Password change, password reset and account deactivation remove the account's registrations. Browser push uses an encrypted payload and a separate preview preference.
Crash and error reports. If the app hits an error, it sends a report to our own servers: the error type, your device platform, the app version, the screen, a technical trace with email addresses and phone numbers removed, and whether the error closed the app. We store the report with your account and workspace, and delete it within 30 days. Reports never include message content or images. The app itself contains no third-party analytics or crash-reporting code. Our servers send basic technical details of the error, never message content, to our error-monitoring provider.

Photos, videos, voice notes, files, locations and contact cards that you send become message content, and we handle them like any other message content in this policy.

Removing access and requesting deletion. A workspace administrator can remove workspace access or deactivate an account in its home workspace. These actions do not erase the account or workspace content. Section 9 explains the current deletion limits and how to contact privacy@engage.stravax.ai.

4. Why we process the connected e-commerce platform data, and our lawful basis

We process connected e-commerce platform data for the merchant's recovery and order-status messaging, recovery reporting and privacy-request handling. Contact and conversation records can also be used by connected workspace features described in section 7.

The merchant is responsible for the lawful basis and permissions needed for its use of these features. Recovery messaging checks the contact's stored marketing opt-in. The app can create and retain the contact before that check, including if the recovery message is skipped. That messaging check is not a universal consent check for other workspace features.

We do not use connected e-commerce platform customer data to build our own marketing lists or profile customers across merchants.

5. Sharing data to provide workspace features

We do not sell customer personal data. We share data to operate the service and the integrations a workspace uses, including messaging, mobile notifications, AI processing, CRM connections and advertising integrations. Section 7 describes the recipients and the data involved. Hashed email addresses and phone numbers sent to ad platforms remain identifiers used to match people; hashing is not a promise of anonymity.

6. How we protect it

In transit: all data is encrypted with TLS/HTTPS. Every inbound connected e-commerce platform webhook is verified by HMAC-SHA256 signature against our app secret before it is processed; an unsigned or incorrectly signed request is rejected.
At rest: data is stored in our hosting provider's database and object storage, which our hosting provider encrypts at rest at the platform level. In addition, each merchant's stored connected e-commerce platform Admin API access token is separately encrypted at the application layer using AES-256-GCM before it is written to the database.
Tenant isolation: every stored record is tagged with the owning merchant's organisation id, and customer-data reads are scoped to that organisation or to record ids already resolved inside it. There is no code path by which one merchant can read another merchant's customer data. The merchant binding for a store is established only through a verified connected e-commerce platform OAuth install, not from any client-supplied value.
Administrative records: privileged and compliance actions are recorded in an administrative audit log. Entries have no scheduled deletion; some organisation-deletion paths change the organisation-reference columns without removing the entry or its detail.

7. Sub-processors

The following service-provider and connected-recipient paths are implemented in the platform. Optional integrations receive data when connected or used; their inclusion does not mean every workspace uses them. A connected e-commerce platform-origin contact or message can reach these paths when used by the corresponding workspace feature.

Service provider or connected recipient	When it is used	Personal data it can receive
our hosting provider	Hosting, database, object storage, queues, security, transactional email, hosted AI and vector-search services	Platform data, database backups, logs, email recipients and content; audio for speech transcription and speech-to-English translation; document chunks and customer queries for knowledge retrieval
Connected messaging platforms	Connected messaging channels	Recipient phone numbers or channel identifiers, message content and attachments; names used in messages or templates
Connected rich business messaging platform	A connected RCS channel sends a message	Recipient phone number and message content, including media information for supported message types
Mobile push relay and operating-system push services	Mobile notifications	Device push tokens, notification title and body, and workspace and conversation identifiers; inbound-message alerts include the contact's name or phone number and a message preview
Browser push service selected by the browser	Web notifications	Push endpoint and delivery metadata, plus an encrypted notification payload; web message previews follow the browser subscription's preview setting
our AI provider	AI qualification and playbook tests, reply suggestions, conversation insights, transcript translation into languages other than English, voicemail summaries and support-ticket triage; text-based site audits and creative or email drafting where those features are available	Conversation text and voice transcripts, known lead fields, reference-document excerpts, support-ticket subject and body, and supplied or fetched drafting and audit text; enabled image-reading can also send images, and enabled order lookup can send order status and tracking information
Connected advertising platforms	Configured conversion integrations	Conversion events and identifiers, which can include hashed email addresses and phone numbers, click or browser identifiers, and, for supported integrations, IP address and user agent; connected platform operator audience uploads can also send hashed contact or lead identifiers and selected audience values
Connected CRM platforms	A workspace connects a CRM and synchronises leads	Lead name, email, phone, company and deal information, according to the connector and field mapping
the ticketing provider and workspace-configured ticket or outbound webhook destinations	Connected ticket or event integrations	Ticket subject, body, status and priority, or the subscribed event payload, which can include contact identifiers, phone numbers and message text; platform support tasks use a separate reduced payload
connected e-commerce platform	Connected store webhooks, billing and order lookup	Supplies checkout and order data; also receives connected-store API requests, including order-lookup requests for a supplied order number
the connected payment provider	Subscription billing, wallet top-ups and payment links a workspace sends from its own account with the connected payment provider	Business billing and checkout information and workspace references; for payment links, the amount, currency, the agent's description and request identifiers, then the customer's payment on the connected payment provider's page; the message-delivery path does not send customer conversations to the connected payment provider
our operational email provider	Engage operational mailboxes	Emails sent to or received by those mailboxes, including sender and recipient information and any personal data included in the email
External sign-in providers	A team member chooses that sign-in method	Sign-in requests and identity-provider tokens or codes used in authentication
our error-monitoring provider	Server error forwarding, if configured	Error severity, type, an identifier-only source and workspace identifier; the forwarding payload excludes free-text error details and message content
our product-analytics provider	Web telemetry and legacy server product events, if configured	Limited application events and workspace or user identifiers; the web client disables autocapture and replay and applies its email, phone and URL-query scrubber
Configured media-generation providers	A media-generation task is explicitly routed to a configured provider	Generation prompt and task parameters, including any personal data supplied in that prompt; the code has no default provider route
the fallback website reader	A site audit uses the configured fallback reader	The requested public website URL and request metadata; the reader fetches the page content

The AI qualifier has its own enable switch, but turning the qualifier off does not turn off every AI feature. Other AI features can send content to our AI provider when they run while workspace AI is enabled. This includes conversation text and voice transcripts from connected messaging channels. Workspace AI defaults to enabled, and the current apps do not ask individual members for an AI choice before these features run. Conversation text, transcripts, images, reference documents and support requests can themselves contain names, phone numbers or other personal data. We do not filter all such details out before sending content to an AI provider.

8. How long we keep it

Account profiles and workspace content. Account profile details and workspace conversations, contacts, leads, campaigns and message media currently have no automatic expiry or complete account or workspace erasure routine. Removing access or deactivating an account does not erase that content.

Connected e-commerce platform checkouts. A daily scheduled job selects abandoned-checkout rows at least 90 days old, measured from abandonment, and deletes those rows when the job succeeds. This is a scheduled cleanup, not a guarantee that every copy of a customer's data disappears at exactly 90 days. The 90-day checkout purge does not delete the separate contact record, recovery or order-status messages, order-notification records or administrative audit entries. Those copies currently have no automatic expiry. A contact can be created before the recovery consent check, including when no recovery message is sent.

Public links, widgets and forms. We store visitor IP addresses, user agents, referrers, landing URLs and attribution identifiers from public links and widgets, and the answers submitted through pre-chat questions or forms. Click and lead-touchpoint records currently have no automatic expiry.

Administrative audit records. These can include a phone number added to a blocklist, and the customer identifiers, email, phone, requested order identifiers and request identifier from a connected e-commerce platform data-access request. Audit entries currently have no scheduled deletion. Removing a blocklist entry does not remove the earlier audit copy.

Diagnostic logs. Runtime logs can contain email recipients, conversion-event identifiers, IP addresses, user agents and personal data echoed in provider errors. These logs are separate from the original customer and conversion records.

Backups. Database backups can contain older copies of personal data. The documented backup retention window is 90 days from backup creation. Removing data from the live database does not erase an existing backup. A restore can bring deleted records back because there is no automatic process to reapply deletions.

9. Exercising data rights (access, correction, deletion)

Because the business is the controller of its customers' data, customers should send access, correction and deletion requests to that business. The connected e-commerce platform privacy handlers currently work as follows:

Customer deletion (customers/redact). The handler deletes abandoned-checkout rows for the store whose stored phone matches the phone in the request. If the request has no phone, or its phone does not match, it deletes no rows. A phone stored only on a checkout address can therefore be missed.
Store deletion (shop/redact). For an eligible uninstalled store, the handler deletes its abandoned-checkout rows. A reconnected store is protected from that erase.
Data access (customers/data_request). The handler records the request in the administrative audit log for an operator to handle. It copies the supplied customer id, email and phone, requested order ids and data-request id. It does not automatically return the customer's data.

These handlers do not erase the separate contacts, conversations, messages, order-notification records, audit copies or existing backups. Deleting a contact in the app is not a complete customer erasure and can fail when linked records exist. There is no complete customer-erasure routine today. You may contact privacy@engage.stravax.ai about a request; we do not describe a request as fulfilled merely because its webhook was accepted or logged.

9.1 Removing access and requesting account or workspace deletion

A workspace administrator can remove a guest member's access to that workspace or deactivate an account in its home workspace, subject to the account's role and the last-administrator safeguards. Deactivation removes the account's notification registrations. These actions do not delete the account profile or the workspace's conversations, contacts, leads, campaigns or media.

You can email privacy@engage.stravax.ai from your account address to request deletion. We currently have no complete erasure routine for a team-member account or a populated workspace. The product does not automatically delete your name, email, password hash, two-factor secret and personal settings on request. We cannot promise complete deletion within 30 days through the current product.

A business can request workspace deletion at the same address, but removing access, uninstalling connected e-commerce platform or deleting a contact does not erase the whole workspace. Administrative records and existing database backups can also retain personal data, as described in section 8.

10. International transfers

Data may be processed outside the UAE by the service providers and connected recipients listed in section 7. The reviewed production configuration does not set an EU jurisdiction for the main data stores, and the app does not set an EU processing region for our AI provider, mobile push, hosted AI service or vector-search service. This policy makes no EU-only storage or processing promise. Transfers rely on those providers' own safeguards.

11. Contact

Stravax Group LLC, Sharjah, UAE.

Privacy and data requests: privacy@engage.stravax.ai

12. Children

Stravax Engage is a business tool and is not directed to children. We do not knowingly process data relating to anyone under 18.

13. Changes to this policy

We update this policy as the service evolves. Material changes will be posted here before they take effect.

14. Website visitors, enquiries, cookies and analytics

We act as controller for visitors to this website and for enquiries you send by email or through our enquiry forms. Enquiries include anything you submit. Website data includes pages viewed, device and approximate location. We use this data to respond to enquiries, provide support, secure and improve the site and, with consent where required, send service updates and marketing emails. You can withdraw marketing consent or unsubscribe at any time.

Enquiries from our website forms are kept in our enquiry store for up to 90 days. We also add them to our customer relationship system (our customer relationship and email provider) and our email follow-up records, where they stay until you ask us to delete them. You can make that request at privacy@engage.stravax.ai. A request is not itself evidence of deletion, and this website description does not promise the complete account or workspace erasure that is currently unavailable under section 9.

Where the GDPR or UK GDPR applies, we rely on our contract to run the business account, and on legitimate interests to provide the service to team members, answer enquiries, secure and improve the service and prevent abuse. For billing records and lawful authority requests, we rely on legal obligation where EU or UK law imposes it, and otherwise on legitimate interests in complying with the law that applies to us and keeping accurate financial records. We rely on consent for marketing emails where required, including in the EEA, UK and Switzerland, and otherwise on legitimate interests in marketing to business contacts.

Our website uses essential cookies and website analytics to understand usage and improve the site. Website analytics is linked to our advertising platform account for advertising measurement, with ads personalisation and cross-device analytics signals switched off. Where consent is required, analytics and marketing stay off until you accept through the consent banner, and the relevant external platform's tags do not load until analytics is accepted. Elsewhere analytics and marketing are on by default; this is not recorded as consent. If analytics is turned off, analytics storage stops at once and the tags stop loading from the next page. If marketing is off, the tags are instructed not to read or write advertising cookies or use personal data for advertising; cookieless measurement requests can still be sent while tags are loaded. You can change choices through Cookie settings in the website footer or your browser settings. Our Cookie Policy lists the cookies, storage, consent records, regional rules and controls in detail.

Depending on applicable law, you may have rights of access, correction, deletion, restriction, objection, portability and withdrawal of consent. Email privacy@engage.stravax.ai to exercise them; we may need to verify your identity. We respond within one month and tell you within that month if complexity or several requests requires up to two further months as the law allows. A response is not a claim that complete erasure is available. You may complain to a data protection authority, particularly where you live or work. The controller of customer data routed through Engage decides its legal basis, as explained above.

The general Data Processing Agreement covers business customers across the platform. The separate merchant agreement applies when accepted while linking a store. The current provider list is available on request at privacy@engage.stravax.ai.