Nyxify
Privacy Policy
Last updated: 14 October 2026
In short: Nyxify runs Telegram, Bale and Rubika bots for WooCommerce shops. We keep only what the bots need to work, we never sell data or show ads, we set no cookies and use no analytics, and payments happen on the shop's own website, never with us.
1. Who we are
Nyxify is a service of Nyxon (“we”). It connects a WooCommerce shop, through the Nyxify plugin, to bots on Telegram, Bale and Rubika that show the shop's products, take orders and let the shop's staff manage products. Questions about this policy: nyxify@nyxon.tech.
For the people who buy from a shop through its bot, the shop decides why and how their data is used; we process it on the shop's behalf to run its bot. A shop that uses Nyxify should mention it in its own privacy policy.
2. Data we receive from a shop
Nothing is sent from a shop before its owner enters a license key in the plugin. After that:
- Connection: the shop's address and REST API address, its WordPress and WooCommerce versions and currency, and a WooCommerce REST API key created for the service. The license key is checked and kept only as a one-way hash.
- Catalog: products, their variations and product categories: names, descriptions, prices, stock, SKUs, attributes, categories, dates and links to their images. Custom fields (meta data) are never sent.
- Orders placed through a bot: each order's number, status, currency, total, dates and items. Orders placed on the shop's own website are never sent.
- Bots: the bot token the owner enters, and the admin PIN the service issues (kept only as a one-way hash).
3. Data about people who use a shop's bot
- Messenger profile: the user id and chat id the messenger gives, and the first name, last name and username shown in the messenger, refreshed when the person starts the bot.
- Phone number: only if the person shares their own contact in the bot, which is needed to place an order.
- Checkout details: the e-mail address and order note the person types at checkout. They are passed to the shop to create the order and are not kept by us after the checkout (an unfinished checkout is forgotten after 24 hours).
- Carts and orders: the products in the cart, and for each order placed through the bot its number, status, total, items and dates. The order itself, with the name, phone number, e-mail address and note, is created in the shop's WooCommerce. No postal address is collected by the bot.
- Language: the language the person chooses in the bot.
- Payments: the person pays on the shop's own website. We never see card or bank details.
4. Data about a shop's bot admins
People who log in to a shop's bot with its admin PIN become bot admins. We keep the same messenger profile as above, the changes they make to products, and the product photos they upload. Uploaded photos are re-encoded, which removes location and camera details, and are deleted from our server once the shop has received them, and in any case within 7 days. The shop's owner sees each admin's messenger, name and username on the plugin's settings page.
5. Data about shop owners
When we issue a license we record the owner's name, business name, e-mail address or mobile number, and Iranian national code, together with the plan and its dates.
6. How we use it
Only to run the service: to show a shop's catalog in its bots, keep carts, create orders in the shop and show their status, let bot admins manage products, keep the bots connected, enforce plan limits, prevent abuse and keep the service secure. We do not sell or rent data, use it for advertising, or build profiles across shops.
7. Who receives it
- The shop the person is buying from: the orders created in its WooCommerce.
- The messenger (Telegram, Bale or Rubika) that carries the bot's messages, under its own privacy policy. Rubika's traffic passes through a relay server of ours in Iran that keeps no access log.
- Our hosting provider, whose servers store the data for us.
We share data with no one else, unless the law requires it.
8. How long we keep it
| Data | Kept |
|---|---|
| Unfinished checkout (e-mail, note) | 24 hours |
| Cart items | 30 days after their last change |
| Bot admins' uploaded photos | until the shop receives them, at most 7 days |
| Product changes made in the bot | 30 days after they are applied |
| Chosen language | 180 days after the last use |
| Server logs (requests and errors, without message contents) | at most 14 days |
| Messenger profiles, phone numbers, order summaries, the shop's connection and catalog | while the shop uses Nyxify; deleted within 30 days of a request by the shop or the person |
Unpaid orders placed through a bot are cancelled in the shop after 24 hours.
9. Security
All connections use HTTPS. Requests between a shop and the service are signed with a secret only the two share. The shop's REST API key, the shared secret, bot tokens and payment links are stored encrypted; license keys and admin PINs only as one-way hashes. Logs never contain tokens, keys or message contents.
10. Cookies
The service, its bots and these pages set no cookies and use no analytics or tracking.
11. Your choices
A person who used a shop's bot can ask the shop, or us at nyxify@nyxon.tech, for a copy of their data or for its deletion; deleted data can't be restored, and orders already created in the shop stay with the shop. A shop owner can disconnect the shop at any time by deactivating the plugin, and can ask us to delete the shop's data.
12. Changes
We will publish any change to this policy on this page with a new date.