Privacy policy

Account holders: merchants who create workspaces, team members invited into a workspace, and Padorix administrators.

Website visitors: people browsing or chatting on a website that has installed the Padorix chat widget. Their data belongs to the business running that website (the "customer"). That business's own privacy notice governs how it uses that data; this policy describes how Padorix handles it as the customer's processor.

Prospects and contacts: people who visit padorix websites, contact us, or submit inquiries and complaints.

• Identity and contact: first and last name, email address, phone number, country, profile photo.
• Workspace information: workspace name, logo, website URL, primary email, department, widget appearance, business hours, FAQs, tags and notification preferences.
• Credentials and security: password (stored only as an Argon2 hash, never in readable form), one-time verification codes, login timestamps, failed-login counters and temporary account locks, device push-notification tokens.
• Activity: conversations handled, messages sent, settings changed, invitations, exports, deletions and other actions recorded in our audit log.
• Plan and billing: selected tier, workspace currency and wallet records, and, when paid plans are introduced, invoices and payment status. Card details will be handled by a payment provider, not stored by Padorix.

• Technical data: IP address, browser, operating system, device type, user agent, referrer and traffic source.
• Approximate location derived from the IP address (country, city, time zone, coarse coordinates). The lookup uses a geolocation database hosted on our own servers; the IP address is not sent to a third party for this.
• Browsing activity on the customer's website: pages viewed, visit counts, time on page, scroll depth and clicked elements, unless the customer excludes a page from tracking.
• Conversation data: the name and email the visitor provides, messages, images and attachments, replies, ratings and feedback, and offline inquiries.
• A random visitor identifier and conversation identifiers stored in the visitor's browser so the conversation can continue across pages.

• To provide the service: run workspaces, deliver chat messages in real time, show analytics, send notifications and keep conversation history.
• To secure the service: authenticate users, enforce permissions between workspaces, rate-limit and lock accounts after repeated failed logins, detect abuse, and keep an audit trail of sensitive actions.
• To communicate: verification codes, password resets, team invitations, security alerts and service notices. Optional product updates are sent only where permitted and can be switched off.
• To support and improve: troubleshoot errors, measure reliability and performance, and develop features. We use aggregated or de-identified data for this where possible.
• To meet legal obligations: respond to lawful requests, keep records required by law, and enforce our terms.
• We do not sell personal information, and we do not use customers' conversation content to advertise to anyone.

For account holders we rely on performance of our contract with you (providing the service), our legitimate interests (keeping the platform secure, preventing fraud, improving the service), compliance with legal obligations, and consent where it is required (for example optional marketing or non-essential cookies).

For website visitors, the customer running the website decides the purpose and legal basis and is responsible for its notices and any consent collection. Padorix processes that data only on the customer's documented instructions.

Padorix may offer optional AI-assisted features, such as suggested replies or answers drawn from a workspace's knowledge base. Where a customer enables such a feature, the relevant message text and knowledge-base content are sent to our AI provider (currently Google Gemini) solely to generate the response. We configure these services so that customer content is not used to train the provider's general models where the provider offers that control, and we will update this policy and the sub-processor list before enabling a new AI provider.

AI output can be wrong. Customers remain responsible for reviewing AI-assisted answers before relying on them for decisions with significant effects.

• Within a workspace: the workspace owner and the team members they invite can see that workspace's conversations, visitors and analytics. Workspaces are isolated from each other.
• Service providers (sub-processors) acting on our instructions: cloud hosting and database infrastructure, Cloudinary (image and file storage), Google Firebase Cloud Messaging (push notifications), Resend and our SMTP mail provider (transactional email), and Google Gemini (AI-assisted features, when enabled). The current list is kept in our Data Processing Agreement.
• Legal and safety: when required by law, court order or a competent authority, or to protect the rights, property or safety of users, the public or Padorix.
• Business transfers: as part of a merger, acquisition or sale of assets, subject to this policy continuing to protect the information.

Padorix is operated from Nigeria, and some providers process data in other countries, including the United States and the European Union. Where data leaves its country of origin we rely on appropriate safeguards required by the Nigeria Data Protection Act 2023 and, where applicable, the GDPR, such as adequacy decisions, standard contractual clauses and provider security commitments.

• Encryption in transit (HTTPS/TLS) for the dashboard, API, widget and real-time connections.
• Passwords hashed with Argon2; sessions in HTTP-only, secure cookies; signed per-session CSRF tokens on every state-changing dashboard request.
• Strict tenant isolation: every chat action and real-time subscription is checked against the workspace the user belongs to.
• Rate limits on login, verification-code and sign-up endpoints, plus automatic account locking after repeated failed logins.
• Least-privilege access, secrets held outside the codebase, security headers, audit logging of sensitive actions, and regular backups.
• No system is perfectly secure. If a personal data breach affects you, we will notify you and the relevant authority as required by law, and support our customers in meeting their own notification duties.

• Account and workspace data: for as long as the account or workspace is active.
• Deleted workspaces, accounts and visitor data: removed from the service immediately, kept in a recoverable state for a recovery window (currently 30 days) so accidental deletions can be reversed, then permanently erased. Copies in encrypted backups expire on the backup rotation cycle.
• Audit and security logs: kept for up to 12 months, or longer where needed to investigate an incident or meet a legal obligation.
• Billing records, when paid plans apply: for the period required by tax and accounting law.
• Customers control the retention of their visitors' data and can delete it at any time from the dashboard.

Depending on where you live (including under the Nigeria Data Protection Act 2023 and the GDPR) you may have the right to be informed, to access your data, to correct it, to have it deleted, to restrict or object to processing, to data portability, to withdraw consent, and to complain to a supervisory authority such as the Nigeria Data Protection Commission.

Account holders can change their details and password in Settings, export a workspace's data, delete a workspace, and delete their account directly from the dashboard. For anything else, email farmsaccorp@gmail.com. We may verify your identity before acting and will respond within the time the law requires (normally within 30 days).

Website visitors: please contact the business whose website you chatted on; it controls your data and can export or delete it from its Padorix dashboard. If you contact us directly, we will forward your request to that business and assist it.

The dashboard uses a strictly necessary session cookie to keep you signed in, and stores a security token for the session in your browser. The widget stores identifiers in the visitor's browser so conversations persist between pages. See our Cookie Policy for details and choices.

Padorix is a business service and is not directed at children under 18. Customers must not use the service to knowingly collect children's data without a lawful basis and appropriate safeguards. Contact us if you believe a child's data was submitted to us in error.

We will update this policy when our services, providers or legal obligations change, and update the date at the top. Material changes will be announced in the dashboard or by email before they take effect where practicable.

Privacy questions, requests and complaints: farmsaccorp@gmail.com. Please include your account email or workspace name so we can locate your records.