Privacy Policy

This policy explains how XRE Software processes data when you use the WhatsApp by XRE application for Bitrix24. For the personal data of your contacts and employees, you (the Bitrix24 account owner) are the data controller and we act as your data processor.

1. Data we process

• Bitrix24 account data: account domain and member ID, OAuth access and refresh tokens issued by Bitrix24, user IDs and names of employees (to assign roles and show statistics).
• WhatsApp messages: messages, voice notes and files exchanged on connected numbers pass through our servers to be delivered between WhatsApp and Bitrix24. We keep the last 40 messages of each chat to provide translation, qualification, the AI assistant, statistics and reports.
• Media files: stored temporarily so Bitrix24 can download them, and deleted automatically after 8 days.
• Statistics and reports: message counts, response times and report contents. Report links stop working after 90 days.
• Technical logs: Bitrix24 REST API requests and responses (without tokens, long texts shortened) are kept for 7 days for troubleshooting, as required by Bitrix24 Market.
• Billing data: company or person name, tax details, address and billing e-mail you enter on the Billing tab, and your payment notices.

2. Purposes

We use this data only to provide and support the Application: delivering messages, the features you enable, licensing and invoicing, security and troubleshooting. We do not sell data and do not use it for advertising.

3. AI processing

If AI features are enabled, the relevant message texts, voice notes and the AI assistant’s knowledge base are sent to OpenAI (OpenAI, L.L.C., USA) through its API to produce translations, transcripts, summaries and replies. Requests are sent with storage disabled; under OpenAI’s API terms, API data is not used to train its models. You can turn AI features off at any time in the Application settings.

4. Sub-processors

• Our hosting provider (servers that run the Application).
• OpenAI, only when AI features are enabled.
• WhatsApp (Meta) and Bitrix24, as the platforms you connect. If you connect a Meta WhatsApp Cloud API account for campaigns, its access token is stored encrypted and campaign recipients are sent to Meta.

5. Retention and deletion

When you uninstall the Application, we log out the connected WhatsApp sessions and delete the Bitrix24 tokens, stored chat history, statistics, reports and media of your account. We keep your billing records and the license periods of your numbers (so that a reinstall keeps paid time), as required for accounting. You can request earlier deletion by contacting us.

6. Security

Access to the management panel requires a Bitrix24 administrator session; data endpoints use short-lived signed tickets; Bitrix24 installations and events are verified with Bitrix24’s OAuth server; traffic is encrypted with TLS.

7. Your rights

Depending on applicable law (such as GDPR or the Turkish KVKK), you and the people whose data you process may request access, correction or deletion of personal data. Requests about your contacts should be sent to you as the controller; we will assist you. Contact us using the details below.

8. Contact