This Privacy Policy explains how Odinex, Inc. ("Odinex", "we", "us"), a Delaware corporation, collects, uses, shares and protects personal information through Persona (the "Service"). Persona lets businesses, creators and community owners ("Partners") build and run their own AI agents on WhatsApp and Telegram for their own audiences and customers ("End Users").
In short. We process End User conversations only to run the agent the Partner configured. We do not sell personal information. We may use information to improve our AI models, and you can opt out of model training (Section 11). You can ask us to access, correct, export or delete your data at any time.
1. Who we are and our role
Odinex, Inc., 131 Continental Dr, Suite 305, Newark, DE 19713, USA. Privacy contact: info@usepersona.dev.
Our role depends on the data:
If you are an End User, the Partner whose agent you use is responsible for the agent's purpose and for telling you about its own practices. This policy describes what Persona does behind that agent.
2. Information we collect
From Partners
- Account details: name, business name, email, phone number, country, and login credentials or authentication tokens. Sign-in is handled by our authentication provider.
- Agent configuration: the instructions, skills, knowledge, documents, brand voice, pricing, integrations, automations, webhooks, MCP servers and API keys the Partner sets up for an agent.
- Billing details: payment and payout information, handled by our payment processor. We do not store full card numbers.
From End Users
- Messaging identifiers: on WhatsApp, your phone number, display name and profile name; on Telegram, your user ID, username and display name; and message metadata (timestamps, delivery status).
- Conversation content: messages, voice notes, images, documents and links you send to the agent, and the agent's replies.
- Connected services: if you choose to connect a third-party tool (for example a calendar, email or delivery service), we store the access tokens and process only the data needed to carry out your request. You choose what to connect and can disconnect at any time.
- Credentials: usernames, passwords, API keys and other secrets added to an agent's Vault so it can sign in to or use a service. They are stored encrypted. The AI model is given their names, not their values, and the values are passed only to the browser or code environment that needs them for a task.
- Browsing: when an agent uses a web browser for you, the pages it visits and what it types and submits there. Signed-in browser sessions may be kept so the agent stays signed in later.
- Memory: facts and preferences the agent saves so it can help you later, such as a delivery address or a dietary preference.
Collected automatically
- Device, browser, IP address, log and usage data from our website and dashboards.
- Cookies and similar technologies used for sign-in, security and product analytics. We do not use cross-site advertising cookies.
- AI traces: records of each request an agent makes to an AI model, including the prompt and the response, which we use to debug, measure usage and improve quality.
From other sources
- Meta (WhatsApp Business Platform) and Telegram, which deliver messages to us, and any service you connect, within the permissions you grant.
We do not intentionally collect special categories of data (such as health, biometric or political data). End Users and Partners should avoid sending them. If an End User sends such data, we treat it as confidential and process it only to answer that message.
3. How we use information
- To run, host and deliver agents and to carry out the actions an End User requests.
- To provide the Partner dashboard, support and payouts.
- To secure the Service, detect fraud and abuse, and enforce our Terms.
- To meet legal obligations and respond to lawful requests.
- To measure and improve reliability and performance, using aggregated or de-identified data.
What we do not do. We do not sell personal information or share it for cross-context advertising. We may use information we collect to develop and improve the Service, including to evaluate, fine-tune and train the AI models that power it, subject to the opt-out and exclusions in Section 11. We do not show Partners the content of an End User's connected accounts.
4. Lawful bases (EU/UK GDPR)
Where GDPR applies, we rely on: performance of a contract (providing the Service); legitimate interests (security, abuse prevention, service improvement), balanced against your rights; legal obligation; and consent where required, for example for optional connections or marketing. You can withdraw consent at any time.
5. How information is shared
- Partners. The Partner and its team see the agent's configuration, analytics, and the End User details the Partner needs to run its audience relationship, such as the WhatsApp number or Telegram username and display name. They can also read the conversations their agent has, including chats on WhatsApp and Telegram, in the Persona dashboard.
- Subprocessors. Vendors that process data for us, listed in Section 6, under written data protection terms.
- Connected services. When an End User asks the agent to act on a connected tool, we send that service the information needed to do it.
- Legal and safety. We disclose information if required by law or to protect rights, safety and security.
- Business transfers. If Odinex is involved in a merger, financing or sale of assets, information may transfer, subject to this policy.
6. Subprocessors
We will update this list before adding a subprocessor and notify Partners by email at least 14 days in advance. Partners may object on reasonable data protection grounds.
7. International transfers
Odinex is based in the United States and operates from Israel. Information may be processed in the United States, Israel, the European Union and other countries where our subprocessors operate. Where we transfer personal data from the EEA, UK or Switzerland, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum), or an adequacy decision such as the one for Israel. For data subject to Israeli law, we transfer data only as the Privacy Protection Law and its regulations permit.
8. Retention
We may keep information longer where needed for legal claims, disputes or legal obligations.
9. Your rights
Depending on where you live (including under the GDPR, UK GDPR, the Israeli Privacy Protection Law, 5741-1981, and US state laws), you may have the right to: access your data; correct it; delete it; export it in a portable format; restrict or object to processing; withdraw consent; and not be subject to a decision based solely on automated processing that significantly affects you. Israeli law also gives you the right to review information held about you and to request its correction or deletion.
To exercise a right, email info@usepersona.dev from the account concerned, or with the WhatsApp number or Telegram username concerned. We respond within 30 days. If you are an End User and your request concerns a Partner's use of your data, we will help route it. You can also complain to your data protection authority, including the Israeli Privacy Protection Authority or your EU supervisory authority.
10. Security
- Encryption in transit (TLS 1.2 or higher) and at rest (AES-256) for stored data.
- Connected-service tokens stored encrypted and never shown to Partners, and Vault credentials stored encrypted.
- Access to production data limited to authorized personnel on a need-to-know basis, with multi-factor authentication.
- Logical separation of each Partner's data and agents.
- Logging, monitoring and a documented incident response process.
We do not currently hold SOC 2 or ISO 27001 certification. No system is perfectly secure. If we learn of a breach affecting personal data, we will notify affected Partners without undue delay and within 72 hours, and notify authorities and individuals where the law requires.
WhatsApp. Messages travel over WhatsApp, which uses end-to-end encryption between users and WhatsApp's business infrastructure. Because the agent must read messages to reply, messages are decrypted when they reach our systems and our messaging provider. Meta handles message data under its own policies.
Telegram. Chats with Telegram bots are not end-to-end encrypted. Telegram handles message data under its own policies.
Agents that act. An agent that browses the web, reads email or documents, or uses connected services may meet content written to trick it, such as hidden instructions on a web page (sometimes called prompt injection), and it can make mistakes, including unintended messages or payments. We use safeguards, such as asking for approval before payments and other steps that can't be undone, but they cannot stop every attack or mistake. Give an agent only the access it needs, review what it does, and disconnect services and remove credentials it no longer needs.
11. AI processing and model training
Agents use third-party AI models to generate responses. Message content is sent to these providers to produce a reply, and we permit them to process it only on our behalf and to help us provide the Service.
We use information collected through the Service, including usage data and conversations, to develop and improve our products and technology, including to evaluate, fine-tune and train the AI models that power Persona.
Opt-out. If you do not want your information used to train AI models, you can opt out by emailing info@usepersona.dev. The opt-out applies going forward and only to model training, not to other improvements to the Service. Even if you opt out, we may still use information for model training when it is flagged for safety review, to improve our ability to detect harmful content, enforce our policies or advance safety research. We never use credentials stored in an agent's Vault to train AI models.
Google Workspace data. If you connect Google Workspace (such as Gmail, Calendar or Drive) to an agent, our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We do not use that information to evaluate, fine-tune, train or improve AI models, or to serve ads, and we do not give it to third parties for their own purposes. You can revoke access at any time by disconnecting the service or asking the agent to do so.
AI outputs can be inaccurate. End Users are told they are talking to an AI agent.
12. Children
The Service is for people aged 18 and over. We do not knowingly collect information from anyone under 18. If you believe a minor has used the Service, contact us and we will delete the data.
13. Partners' responsibilities
Partners must give End Users clear notice of how their agent uses data, obtain any consent required by law, honor End User requests, avoid collecting sensitive data without a lawful basis, and use the Service in line with our Terms of Service and the Data Processing Terms in them.
14. Region-specific information
Israel. Where Israeli law applies, Odinex acts as the owner of the Partner database, and as holder/processor for End User data processed for Partners. We maintain the registrations, security procedures and appointments the Privacy Protection Law and its regulations require.
EEA, UK and Switzerland. Odinex has no establishment in the EU or UK. Contact us at the address above for GDPR matters.
California and other US states. We do not sell or share personal information as defined by state privacy laws. You may request access, deletion and correction, and we will not discriminate against you for doing so.
15. Changes and contact
We may update this policy. We will post the new version with its date and, for material changes, notify Partners by email at least 14 days before they take effect. Questions: Odinex, Inc., 131 Continental Dr, Suite 305, Newark, DE 19713, USA; info@usepersona.dev.