Privacy Policy

Not legal advice. A lawyer will review this text before it is considered final.

Last updated: Thu 29 Oct 2026

Collecxo ("we") sends payment reminders on behalf of businesses ("clients") to the people who owe them money ("investors"), and reads the replies. This page explains what data we handle and why.

1. Who is responsible

For investor data a client uploads, the client decides what is collected and why; Collecxo processes it on the client's instructions. For client account data (your sign-in email, company name, settings), Collecxo is responsible.

Our Privacy Officer is responsible for how we protect personal information and can be reached at privacy@collecxo.com.

2. Data we handle

• Client account data: sign-in email, company name, settings, and who approved what and when.
• Investor data uploaded by the client: name, email, phone, language, invoice and installment details, amounts, due dates, project and unit.
• Email data from the client's connected mailbox (Gmail or Microsoft 365), described in section 4.
• Records of what we did: reminders sent, replies received, status changes.
• Files: attachments to investors' replies, and proofs of payment that investors upload on the payment page (PDF, JPG or PNG, up to 10 MB each). We store them encrypted.
• Where an action came from: when an investor uses the payment page (confirms a payment, gives payment details or promises a date) or someone answers a direct interview, we record the IP address and the browser and device type. The client company's admins can see them. We delete the IP address after 12 months; the browser and device type stay with the record. Survey answers are not included.
• People who answer a survey link: the name and company they type (both optional if they answer anonymously) and their answers. The answers are processed by our AI provider (Anthropic) to choose the next question and to write a short summary for the team that sent the link; they are not used to train AI models. When someone presses Start, we keep a one-way, keyed code made from the survey and their network (IP) address for 10 minutes, only to recognise a second Start and continue the existing answers instead of creating a duplicate; we never store the IP address itself, and the code is deleted after 10 minutes. The team that created the survey decides what it asks and what it does with the answers; Collecxo stores them for that team. To have your answers deleted, write to privacy@collecxo.com; if you answered anonymously, tell us which survey and roughly when you answered so we can find your answers.

3. How we use it

Only to run the service for that client: send the client's reminders from the client's own mailbox, read and sort the investors' replies, link them to the right installment, suggest answers for the client to approve, and show the client the history. We do not sell data. We do not use it for advertising. We do not use it to assess anyone's creditworthiness or for lending decisions.

Proofs of payment: our AI provider reads each proof to find the amount, currency, date, bank reference, payer and beneficiary, and shows the client where they differ from the client's records. Collecxo never marks a payment as received by itself; a person at the client decides.

4. Google and Microsoft mailbox data

When a client connects a Gmail or Microsoft 365 mailbox, we ask for permission to:

• send email from that mailbox (to send the client's reminders and approved replies);
• read email in that mailbox, so we can find replies to our reminders and new emails from the investor addresses the client imported;
• see the mailbox's email address (to show which mailbox is connected).

What we read and keep: only replies to reminders we sent, and emails from investor addresses the client imported. We store the sender, date, subject and text of those emails, and the link to the installment. Other emails in the mailbox are not stored. We stop reading new emails from an investor 12 months after their last open installment is paid or closed.

For those same emails we also store their attachments (PDF, JPG or PNG), encrypted, so the client can see a proof of payment next to the reply.

What we do with it: sort the reply (for example "says already paid", "asks for more time"), link it to the installment, and draft a suggested answer that a person at the client approves before anything is sent.

Collecxo's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google or Microsoft user data to train AI models, ours or anyone else's.

People at Collecxo do not read this data, except when the client asks us to (for support), for security, or when the law requires it.

5. Service providers

We use these companies to run the service, under contracts that limit them to that purpose:

• DigitalOcean: hosting and database.
• DigitalOcean Spaces: storage of the encrypted files, in Toronto, Canada.
• Anthropic: AI that sorts replies, matches them to installments, drafts suggested answers, translates, reads proofs of payment and runs survey interviews. Anthropic does not use this data to train its models.

Our servers are in the United States (DigitalOcean) and our file storage is in Toronto, Canada; Anthropic processes data in the United States. Your data may therefore be stored and processed outside your country, under the protections described in this policy.

We share data with no one else, except when the law requires it, or in a merger or sale of the business after telling clients first.

6. How long we keep data

• Mailbox access tokens: deleted as soon as the client disconnects the mailbox.
• Everything else — investor data, installments, replies and message history: deleted within 30 days after the client closes their account or asks us to. In practice this is immediate: closing your account (Settings > Company) deletes your mailbox access and this data right away.
• We keep a short record after closure — the company name, the reason given, and the date — for billing and audit records. This record does not include investor data or message content.

7. Your choices

• Clients can disconnect a mailbox at any time in Settings > Mailbox. You can also remove Collecxo's access from your Google account (myaccount.google.com/permissions) or your Microsoft account.
• Clients can close their account themselves, in Settings, or ask us to export or delete their data: privacy@collecxo.com.
• Investors: your data was given to us by the business you owe money to. Contact that business first; you can also write to privacy@collecxo.com.

8. Security

Data is encrypted in transit (HTTPS). Mailbox access tokens, the email and WhatsApp content we store, and stored files are encrypted at rest. Files are only downloaded, never opened inside our pages. Access to servers is limited to the people who run the service.

9. Changes

We will post changes here and update the date at the top. Clients are told by email about important changes.

Questions about this policy: privacy@collecxo.com