Legal
Privacy policy
How Liberrex handles personal data in Liberrex AI & Agents: what we process, why, for how long, who helps us, and how to exercise your rights.
Who we are
This policy explains how Liberrex Tunisia S.A (“Liberrex”, “we”) handles personal data in Liberrex AI & Agents, the platform available at ai.liberrex.com, and on this website.
For any question about this policy or your data, write to privacy@liberrex.com.
What the platform does
Liberrex AI & Agents lets businesses (our “customers”) build AI agents that answer and place phone calls, reply on website chat, messaging channels and e-mail, and run tasks; a copilot that helps their team members work in the platform; and tools to review and score conversations.
Messaging channels include WhatsApp, connected through the official Meta WhatsApp Business Platform (WhatsApp Cloud API), as well as Messenger, Instagram, SMS and Telegram. E-mail channels connect a mailbox of the customer. Voice channels connect phone lines through telephony providers.
Our role: controller or processor
Controller. Liberrex is the controller of the data needed to run our relationship with customers: account and team member data, billing data, support requests, and website and security data.
Processor. When the end users of a customer call, write, or send voice notes and files to that customer through channels connected to Liberrex, the customer decides why and how that data is processed. Liberrex processes it on behalf of the customer and following its instructions. The customer is the controller and its own privacy notice applies: questions about that data should first go to the business you contacted.
Data we process
- Account data. Name, e-mail address, phone number when given, company name, role, password (stored hashed), two-factor authentication settings, language and preferences.
- Workspace content. What customers create and upload: agents and their instructions, knowledge base documents, data sources, contacts, campaigns, workflows, copilot conversations and the files sent to the copilot.
- End-customer communications. Messages, call audio and recordings, transcripts, voice notes, images and documents that end users exchange with a customer through its channels, with the phone number, account name or e-mail address used, and the analyses made from them (summaries, scores, extracted information).
- Customer memory. When a customer turns it on, facts its agents learn about a contact during conversations, so that a later conversation can continue where the last one stopped. Card numbers, security codes, one-time codes, PINs and passwords are filtered out and never kept as memory, and a contact who opted out is never remembered.
- Voice profiles. If a customer uses speaker identification in a workflow, a voice profile used to recognise a returning caller.
- Usage and billing data. Credits used, agent activity, plan and subscription, invoices and payment status. Card payments are made on the page of the payment provider; when a card is saved, Liberrex keeps only its brand, last four digits and expiry date, never the full number or the security code.
- Logs and security data. IP address, browser and device information, sign-in events, API requests and errors, used to secure and operate the service.
- Cookies and local storage. See Cookies and local storage below.
Why we use data, and on which legal basis
- Providing the platform, the agents and the channels a customer connects: performance of our contract with the customer and, for end-customer communications, the instructions of the customer.
- Creating and securing accounts, two-factor authentication, and preventing fraud and abuse: our contract and our legitimate interest in a secure service.
- Billing, credits, invoicing and accounting: our contract and our legal obligations.
- Support and service messages (security alerts, billing notices, changes to the service): our contract and our legitimate interest.
- Improving reliability and performance with aggregated usage and error data: our legitimate interest.
- Complying with the law and answering lawful requests from authorities: our legal obligations.
We do not sell personal data, and the content of one workspace is used only to provide the service to that customer.
AI processing and service providers
To produce replies, transcripts, speech and analyses, the platform sends the necessary content (for example a message, the audio of a call or an excerpt of a document) to AI models. Depending on the configuration of the workspace, these are models run by Liberrex or by cloud AI model providers. A customer can also connect its own model provider, in which case the terms of that provider apply between them.
We use service providers (sub-processors) that process data for us and under our instructions: cloud hosting and storage, cloud AI model providers, e-mail delivery, telephony and SMS carriers, payment processing, and Meta Platforms for WhatsApp, Messenger and Instagram messages. Messages sent through WhatsApp are also subject to the terms and privacy policy of Meta.
AI output can be wrong. Customers decide where agents may act alone and where a person reviews: see the Terms of service.
International transfers
Some providers process data outside Tunisia, for example in the European Union or the United States. When personal data is transferred abroad, we take the measures required by applicable law: Tunisian law n° 2004-63 and, where it applies, the GDPR (for example standard contractual clauses).
How long we keep data
- Account, workspace and billing data: for as long as the account is active, then deleted or anonymised, except what the law requires us to keep (for example invoices and accounting records), for the period it requires.
- Conversations, recordings and transcripts of the channels of a customer: for as long as the account is active, unless the customer deletes them earlier.
- Files received on messaging channels (images, voice notes, documents): deleted automatically after 90 days.
- Files sent to the copilot: deleted 90 days after they are sent; files uploaded but never sent are deleted after 24 hours.
- Customer memory: 180 days by default; each customer can choose between 30 and 1095 days.
- Embedded copilot conversations: 90 days after the last message by default; each customer can choose between 7 and 730 days.
- Voice profiles (speaker identification): a retention period of 365 days after the last voice sample is set by default.
- Security and audit logs: for the period needed to secure the service and investigate incidents.
Security
- Data is sent over encrypted HTTPS connections.
- Secrets kept by the platform, such as provider API keys, mailbox passwords and tokens, and webhook secrets, are encrypted at rest.
- Passwords are stored hashed. Two-factor authentication, by e-mail code or authenticator app, is available and a workspace can make it mandatory.
- Access inside a workspace is limited by roles and permissions, and the data of one workspace is never returned to another.
- Sign-ins, sensitive actions and access by Liberrex staff are logged.
No system is perfectly secure. If a security incident affects your data, we will inform you and the competent authorities as required by law.
Your rights
Under Tunisian law n° 2004-63 of 27 July 2004 on the protection of personal data and, where it applies, the EU General Data Protection Regulation (GDPR), you can ask to:
- Access: know whether we process your data and receive a copy of it;
- Rectification: have inaccurate or incomplete data corrected;
- Deletion: have your data erased when it is no longer needed or was processed unlawfully;
- Objection: object to processing based on our legitimate interest, and to direct marketing at any time;
- Portability: receive the data you gave us in a structured, machine-readable format.
Where processing is based on your consent, you can withdraw it at any time. You can also lodge a complaint with the Instance Nationale de Protection des Données Personnelles (INPDP) in Tunisia or, where the GDPR applies, with the data protection authority of your country.
How to exercise your rights
Account holders can correct most account data in their settings, and export or delete a contact in Dashboard › Contacts. For anything else, write to privacy@liberrex.com from the e-mail address of your account.
If you are an end user of one of our customers, contact that business first: it controls your data. You can also write to us; we will forward your request to the business and help it answer. See the Data deletion instructions.
We answer within 30 days. We may ask for information to confirm your identity before acting.
Children
The platform is a service for businesses and is not directed at children. We do not knowingly collect data about children as a controller. Customers who serve minors through their channels are responsible for following the rules that apply to them.
Changes to this policy
We may update this policy as the platform changes. The date at the top shows the current version. For significant changes we will inform account owners by e-mail or in the platform before they take effect.
Contact
Liberrex Tunisia S.A, privacy and data protection requests: privacy@liberrex.com.