Privacy policy
Last updated: 30 October 2026
This policy explains what personal data HUXOS collects, why, where it is kept, who else handles it, and the choices you have. It covers huxos.io, the HUXOS ID sign-in, and the HUXOS services HUXOS Ask, HUXOS Agent, HUXOS Insights and HUXOS FSS. HUXOS is operated by Optimum Horizons ("we", "us").
Two roles
For your HUXOS account and your organization's account, we decide how the data is used.
For the content a business puts into the HUXOS services (documents, data, files, and the conversations HUXOS Agent has with that business's customers), we process it on the business's behalf and on its instructions. That business is responsible for it towards its own customers.
If you chatted with a business through HUXOS Agent on its website, WhatsApp or Telegram, your conversation belongs to that business. See the data deletion page for how to have it removed.
What we collect
- HUXOS ID account: your name, email address, language, and your password, which we keep only as a secure hash. If you turn on two-step sign-in, its setup is stored too.
- Sign-in records: the time, the service, whether it succeeded, and your IP address. Kept for 90 days.
- Organization: its name, commercial registration and tax numbers, country, city, address, industry and size, billing email, its members and their roles, subscriptions, invoices and usage counts.
- HUXOS Ask: the documents your organization uploads, and the questions asked and answers given.
- HUXOS Insights: the data sources and files your organization connects or uploads, and its dashboards.
- HUXOS FSS: the files sent and their share links, and a record of each access (time, IP address and browser).
- HUXOS Agent: the business's knowledge, and its conversations with customers, which can include a customer's name, phone number, email address, messages and what they asked for.
- Website visits: we count visits from our own server logs. We keep no IP addresses and no full web addresses; a visitor is counted with a code that changes every day, together with the country. We use no advertising or third-party analytics trackers.
- Emails we send you and messages you send us.
How we use it
- To provide the services and sign you in.
- To bill your organization and issue invoices.
- To keep the platform secure, prevent misuse and fix problems.
- To send service emails: account, invoices, alerts and replies to you.
- To improve the platform, using counts and totals.
We do not sell personal data. We do not use your organization's content to train AI models. We send marketing emails only if you agree to them.
AI processing
Answers in HUXOS Ask, HUXOS Insights and HUXOS Agent are written by AI models. The search index of your content is built on our own servers. To write each answer, the text it needs (the question, the relevant excerpts and the recent conversation) is sent to Ollama's cloud model service, which returns the answer.
Where your data is kept
Our servers are in Jakarta, Indonesia. Data leaves them only through the service providers listed below, for what each one does.
Service providers
- Hostinger: server hosting in Jakarta, Indonesia.
- Ollama: runs the AI models that write answers.
- Brevo: sends our emails.
- Meta Platforms (WhatsApp): carries WhatsApp messages when a business connects its WhatsApp number to HUXOS Agent.
- Telegram: carries Telegram messages when a business connects a Telegram bot to HUXOS Agent.
We disclose data to authorities only when the law requires it.
Cookies and browser storage
We use only what the site needs to work: cookies that keep you signed in to huxos.io and the HUXOS services, and cookies that remember your language. The HUXOS Agent chat window keeps an anonymous code in your browser so an open chat can continue. We use no advertising cookies.
How long we keep it
- Account and organization data: while the account is open. After it is closed, deleted within 30 days, except invoices and the records tax law requires us to keep.
- Sign-in records: 90 days.
- HUXOS Agent conversations: deleted after the business's retention period (365 days unless the business sets another).
- HUXOS FSS files: deleted on the expiry date the sender chose.
- Audit records of changes in an account: up to 2 years.
- Backups: kept for a short time, then deleted automatically.
Security
Connections are encrypted (HTTPS). Passwords are stored only as hashes. Each organization's data is kept separate, administrator areas are restricted and need two-step sign-in, and access is logged. No system is perfectly secure; if a breach affects your data, we will tell you and the authorities as the law requires.
Your rights
You can ask to see, correct, export or delete your personal data, and to withdraw a consent you gave, under the Saudi Personal Data Protection Law, Indonesia's Personal Data Protection Law (UU PDP) and the other laws that apply to you.
Email support@huxos.io. We may need to confirm it is you, and we answer within 30 days. You can also complain to the data protection authority in your country.
Children
HUXOS is a service for businesses and is not meant for anyone under 18.
Changes
When this policy changes, we update this page and its date. We tell account holders about important changes by email.
Contact
Optimum Horizons (HUXOS), support@huxos.io