Privacy Policy — the company AI Chat Agent

Version 1.1 — Effective date: 21/10/2026

This Privacy Policy ("Policy") describes how ΧΑΤΖΗΛΑΖΑΡΟΥ ΕΛΕΝΗ (CHATZILAZAROU ELENI) (company from now on), a sole proprietorship, processes personal data through its application on the Meta for Developers platform (the "App") and the automated conversational assistant it powers (the "AI Assistant"). The AI Assistant answers messages sent to the Facebook Messenger presence of businesses that use our service (each a "Client"). This Policy is provided in accordance with Regulation (EU) 2016/679 (the "GDPR"), Greek Law 4624/2019 and Meta's Platform Terms.

Who we are

---

1. Definitions

Terms such as "personal data", "processing", "controller", "processor", "data subject" and "supervisory authority" have the meanings given to them in Article 4 GDPR. "Platform Data" means any data we receive from Meta through the App.

2. About the App

The company operates the App on the Meta for Developers platform. A Client connects its Facebook Page to the App using Facebook Login for Business, which grants the App permission to receive and reply to messages sent to that Page. The App does not offer "Log in with Facebook" to the public, and members of the public do not need to install or authorise the App to message a Client's Page.

Through the App we request only the permissions needed to run the Assistant:

3. Roles of the parties (controller and processor)

• Messenger users. The Client whose Facebook Page you contact is the data controller of your personal data. the company acts as a processor on the Client's behalf and under its documented instructions, pursuant to a written data processing agreement under Article 28 GDPR. The Client's own privacy policy also applies and, in the event of conflict regarding the Client's processing, prevails.
• Client Page administrators. the company is the controller of the limited data we receive when a Client's staff member connects a Page to the App (Section 4).
• the company is also an independent controller for limited operational purposes (securing, maintaining and monitoring the App).

You can identify the relevant controller from the Facebook Page you messaged. Requests addressed to us will, where appropriate, be forwarded to the relevant Client.

4. Categories of personal data we process

About Messenger users

About Client Page administrators

We do not access Messenger users' Facebook profiles, friend lists, posts or any other account data beyond what is listed above.

Special categories of data. We do not seek, and ask that you do not send, special categories of personal data (Article 9 GDPR), such as health information. We also do not request or process payment card numbers or financial account details; please never send these in a message.

5. Purposes and legal bases of processing

Where we rely on legitimate interests, those interests are responding to your enquiry efficiently and operating a secure service; we have assessed that they do not override your interests or fundamental rights. You may object at any time (Section 11).

6. How we use Platform Data

In line with Meta's Platform Terms, we use Platform Data only to provide the Assistant to the Client and to you. In particular, we do not:

• sell, license or purchase Platform Data;
• use it to build or augment user profiles, for advertising, or to determine eligibility for credit, employment, housing or insurance;
• share it with data brokers or ad networks;
• use it to send you unsolicited messages, or marketing or promotional messages you did not ask for.

The Assistant is reactive only: it replies to messages you initiate, within the standard 24-hour messaging window permitted by Meta. Answering your questions about a Client's products or services — including sending a relevant link, photo, price or availability — is part of that reply and is not unsolicited marketing.

7. No solely automated decision-making

The Assistant uses artificial intelligence to generate replies and record requests, but it does not make decisions producing legal effects concerning you, or similarly significantly affecting you, within the meaning of Article 22 GDPR. A human is available on request by providing a telephone number.

8. Recipients and sub-processors

We disclose personal data only as necessary to provide the service:

• The Client whose Facebook Page you contacted (the controller).
• Meta Platforms Ireland Limited — transmits messages to and from Messenger, as described in Meta's Privacy Policy.
• Google Ireland Limited / Google LLC — processes the text of your message via the Gemini API to generate a reply. Content submitted through the paid API is not used to train Google's models.
• Our cloud hosting and infrastructure provider(s) — host the App and store its data on our behalf. We can tell you which provider(s) we currently use on request.

Each sub-processor is bound by a written agreement requiring it to process personal data only on our instructions, to apply data-protection obligations consistent with Article 28 GDPR, and to delete personal data when we instruct it to. We may also disclose data where required by law or by a valid request from a public authority.

9. International transfers

Some recipients (in particular our AI provider and our cloud hosting and infrastructure provider(s)) may process personal data outside the European Economic Area. Such transfers are safeguarded by a European Commission adequacy decision (including the EU–US Data Privacy Framework, where the recipient is certified) or by the Commission's Standard Contractual Clauses under Article 46 GDPR, with supplementary measures where required. You may request a copy of the relevant safeguards using the contact details above.

10. Retention and deletion of data

We keep personal data only as long as necessary for the purposes described in this Policy, and we delete it sooner where Meta's Platform Terms or applicable law require.

• Conversation content (the messages exchanged with the Assistant) is stored in our systems so the Assistant can keep context, handle follow-up messages and let us resolve any dispute or technical problem. It is automatically deleted within 90 days of the last message in the conversation. We do not keep a permanent archive; for a longer-term record, the Client can use the conversation history Meta retains in its Page inbox.
• Booking, enquiry and contact details are recorded to fulfil the request you made and are held for the Client, which decides how long to keep them under its own retention policy and legal obligations (for example tax or warranty records). Within the App we delete them when any of the conditions below applies.
• Page connection data and access tokens are deleted within 60 days after a Client disconnects its Page, removes the App, or ends its contract with us.

Deletion of Platform Data. "Platform Data" is the data we receive from Meta (see Section 1). We delete it as soon as reasonably possible when:

• it is no longer needed for a legitimate business purpose;
• we stop operating the App or the service through which we received it;
• you ask us to delete it, or you no longer have a Facebook account;
• the Client asks us to delete it, or stops using our service — in which case we delete that Client's conversations and connection data;
• Meta instructs us to delete it; or
• applicable law requires deletion.

We retain data past these points only where the law requires it, in which case we keep evidence of that legal requirement and can produce it to Meta on request.

11. Your rights

Subject to the conditions in the GDPR, you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21).

To exercise these rights, email info@voxon.gr (subject "Privacy"). We will respond within one month, extendable by up to two further months where necessary, in which case we will tell you. We may ask you to verify your identity. Exercising your rights is free of charge unless a request is manifestly unfounded or excessive.

12. Data deletion instructions

If you messaged a Page: email info@voxon.gr with the subject "Data deletion", naming the Facebook Page you contacted and the approximate date. We will delete the records we hold, forward the request to the relevant Client where applicable, and confirm completion to you within one month.

If you are a Page administrator who connected the App: you can remove the App at any time in Facebook under Settings & privacy → Settings → Business integrations, or in your Meta Business portfolio settings. When the App is removed, Meta notifies us and we delete the associated connection data and access tokens within [30] days. You can also email us as above.

13. Security

We implement appropriate technical and organisational measures under Article 32 GDPR, including encryption in transit (TLS), encryption of stored access tokens, access controls and restricted administrative access. Because we provide the service to several Clients, we keep each Client's data logically separated from every other Client's data. No system can be guaranteed to be completely secure. If a personal data breach affects you, we will notify the Client and, where required, you and the competent authority.

14. Contact and complaints

Privacy contact: ΧΑΤΖΗΛΑΖΑΡΟΥ ΕΛΕΝΗ ("the company"), Κοραή 2, 85104 Ρόδος, Greece — info@voxon.gr (subject "Privacy").

You have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of your residence, place of work or place of the alleged infringement. In Greece this is the Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα), Leoforos Kifisias 1-3, 115 23 Athens — www.dpa.gr.

15. Children

The Assistant is intended for adults and is not directed at children.

16. Changes to this Policy

We may update this Policy from time to time. The version number and effective date at the top show the current version. Material changes will be notified by updating this page and, where appropriate, through the service.

17. Governing law

This Policy is governed by the laws of Greece and the GDPR, without prejudice to mandatory data-protection rights under the law of your country of residence.