Privacy Policy

1. Corporate Identity & Legal Disclosures

This Privacy Policy governs the access, collection, processing, storage, and automated lifecycle erasure of personal data by LUXIRA KOZMETİK TİCARET LİMİTED ŞİRKETİ (operating as Luxira Holding LLC, hereinafter “Company”, “we”, “us”, or “our”) in operation of the LUXIRA Omnichannel Communications Platform (hosted at https://webluxira.com).

2. Scope of Service & Meta Graph API v23.0 Integration

LUXIRA CRM provides software infrastructure enabling businesses to aggregate, triage, route, and respond to incoming customer inquiries originating from Facebook Messenger and Instagram Direct via official integration with the Meta Graph API v23.0.

Our system acts exclusively as a Data Processor executing customer communications workflows for authorized business clients. The client organization maintaining the connected Facebook Page or Instagram Professional Account acts as the independent Data Controller.

3. Specific Meta Graph API Permissions & Functional Scope

LUXIRA CRM requests and utilizes solely the minimum operational permissions required to deliver customer support triage via Meta Graph API v23.0:

4. Data Ingestion & Purpose of Processing

When an end-user sends a communication to a business connected to LUXIRA CRM, our backend ingests only the following concrete data points:

• Page-Scoped Identifiers: Meta Page-Scoped IDs (PSID) or Instagram-Scoped IDs (IGSID) generated cryptographically by Meta to identify conversations. Scoped IDs do not reveal personal telephone numbers, personal email addresses, personal Facebook profile URLs, or national identification numbers.
• Sender Display Name: First and last name as provided in the Meta public profile payload.
• Message Content: Inbound and outbound message text and conversation transcripts.
• Media Attachments: Images, audio voice notes, video clips, or document attachments transmitted by the sender.
• Delivery Timestamps: Exact ISO-8601 message timestamps and delivery status flags.

Strict Operational Purpose: These data points are processed strictly and exclusively for routing, assigning, and resolving customer service inquiries via the internal unified CRM team inbox.

5. Explicit Prohibitions & Zero-Sale Guarantee (Meta Terms Section 4.a)

In accordance with Section 4.a of the Meta Platform Terms:

• Zero-Sale Guarantee: LUXIRA KOZMETİK TİCARET LİMİTED ŞİRKETİ does not sell, lease, rent, trade, monetize, or transfer customer conversation data or Meta platform data to third-party data brokers, advertising networks, or commercial syndicators under any circumstance.
• No Commercial Profiling: We do not construct consumer behavioral profiles, psychological scores, credit evaluations, or audience segmentation models from customer communications.
• Zero Cross-Context Behavioral Advertising: Message contents and customer identifiers are never utilized to serve or optimize targeted advertisements across third-party platforms.
• No Machine Learning Model Harvesting: Customer communication transcripts are strictly isolated and are never ingested into foundation models or utilized for training external artificial intelligence systems.

6. Strict 90-Day Retention & Automated Purging Policy

In compliance with data minimization principles and Meta Platform Policies:

• 90-Day Operational Lifecycle: Ingested chat logs, conversation transcripts, Page-Scoped IDs, and media attachments are retained in active storage for an operational lifecycle of exactly ninety (90) calendar days from the timestamp of the latest message in the thread.
• Automated Hard Purge: Upon reaching the 90-day lifecycle limit, an automated scheduled database daemon permanently excises all conversation records, attachments, and customer identifiers from PostgreSQL databases and block storage volumes.
• Early Deletion on Demand: If a user requests data erasure prior to the 90-day limit, all corresponding records are permanently purged within 48 business hours pursuant to Section 4.d of the Meta Platform Terms.

7. Technical Security Measures & Sub-Processors (Meta Terms Section 4.b)

We implement comprehensive organizational and technical security measures to ensure data confidentiality:

• In-Transit Encryption: All communications between Meta Graph API webhooks, LUXIRA backend systems, and client web browsers are strictly encrypted using Transport Layer Security (TLS 1.3 / modern HTTPS).
• At-Rest Encryption: Production databases and file storage instances are secured using AES-256 disk encryption. Access credentials and Meta Page Access Tokens are encrypted using symmetric cryptography (Fernet / AES-CBC) with isolated environment key distribution.
• Role-Based Access Control (RBAC): Access to customer message threads is strictly restricted to authenticated, role-verified support personnel authorized by the subscriber organization.

Authorized Third-Party Sub-Processors

8. Data Subject Rights & Deletion Procedures (Meta Terms Section 4.d)

In accordance with Section 4.d of the Meta Platform Terms, GDPR Article 17, and CCPA, individuals have the absolute right to request the permanent erasure of their personal data. For detailed instructions, visit our User Data Deletion Instructions page.