Privacy Policy

Last updated: January 15, 2026

Controller / commercial entity: Heureka Estudio S.A.S. (“Heureka,” “Tivox,” “we,” “us,” or “our”).

Website: tivox.net

Application: app.tivox.net

Privacy contact: privacy@heurekaestudio.co

1. Purpose and Scope

This Privacy Policy explains how Heureka Estudio S.A.S., the commercial entity for Tivox, collects, uses, stores, discloses, and protects personal information in connection with the tivox.net website, the app.tivox.net application, and Tivox services.

Tivox is an AI-Native SaaS platform designed for autonomous automation of business operations under an Autonomous BPO model. The platform enables users to configure AI Agents, information inputs, connections, campaigns, channels, conversations, analytics, operations, and integrations.

This Policy applies to information we process directly as a service provider and to information we may process on behalf of our customers when they use Tivox to conduct their own activities. When a customer determines the purposes and means of processing information concerning its own users, contacts, or other individuals, the customer is responsible for determining the lawfulness of that processing and implementing the appropriate safeguards.

2. Roles of Heureka and Tivox Customers

Depending on the context, Heureka may act as the controller of information relating to management of the commercial relationship, user accounts, service security, the website, and other purposes of its own; or as a processor/service provider with respect to information a customer enters into or processes through Tivox. The specific role may depend on the contract, the configured operation, and applicable law.

Tivox customers are responsible for determining the purposes and lawfulness of processing carried out through the platform, providing any required notices and obtaining applicable authorizations, respecting data subjects’ rights, and configuring their operations in accordance with laws applicable to their activities.

3. Information We May Collect or Process

3.1. Account, Organization, and Authorized Users

We may process information necessary to create, administer, and protect a Tivox Account and its authorized users, such as the organization’s name, username, email address, credentials or authentication mechanisms, roles, permissions, Account status, and records relating to access to and use of the platform.

Tivox is not designed to store customer billing information such as tax identification numbers, banking information, or complete payment-method details within the operational Account. Commercial and billing information handled outside Tivox will be governed by the applicable processes and contractual documents.

3.2. Agent Configuration

Customers may configure AI Agents with information such as name, role, functions, personality, default language, and base objective. This information is used to configure the Agents’ operational behavior. Internal instruction-compilation and technical configuration mechanisms are not a field that users are required to enter as a “system prompt.”

3.3. Inputs

Inputs may include Knowledge Bases, documents, Internal Information Sources, and External Information Sources. The content may contain business, operational, or personal information that the customer chooses to add to or connect to Tivox.

Documents for a Knowledge Base are added after the Base has been created, through the applicable management functions. External Sources may provide information through connections to external systems or services.

3.4. Campaigns, Connections, and Operations

A Campaign may link Agents, Inputs, and Connections to execute a particular operation. Tivox may process information relating to the configuration of those campaigns, channels, contact points, connections, integrations, and operations.

3.5. Conversations, Audio, Transcripts, and Contact Data

Depending on the service modality and configuration, Tivox may process voice or text calls and conversations, including audio, transcripts, messages, telephone numbers, contact identifiers, and other information participants provide during an interaction.

The specific content of these interactions depends on the operation configured by the customer. Tivox does not determine in advance what personal information each conversation will contain.

3.6. Technical and Usage Data

We may process technical information necessary to operate, secure, and improve the service, such as access logs, events, technical identifiers, browser or device information, error logs, and usage and performance metrics.

3.7. Analytics and Derived Data

Tivox may generate metrics and data derived from operations, including interaction volume, response times, service indicators, resolution, satisfaction, efficiency, and other operational metrics. These metrics may be linked to an Account, campaign, channel, agent, or conversation

4. Information Obtained from Third Parties and Integrations

When a customer connects Tivox with business systems or external providers, the platform may receive or access information from those sources in accordance with the authorizations, credentials, APIs, webhooks, or other mechanisms configured by the customer.

The categories of information will depend on each integration. Tivox does not control the privacy practices of external systems that the customer chooses to connect and recommends reviewing their respective policies.

5. Purposes of Processing

• provide, maintain, and operate Tivox services;
• create and administer Accounts and authorized users;
• authenticate users and apply access controls;
• configure and execute Agents, Campaigns, Connections, Inputs, and operations;
• process conversations, audio, transcripts, and messages when necessary for operations;
• provide analytics, metrics, traceability, and monitoring functionality;
• integrate Tivox with systems and services configured by the customer;
• detect, prevent, and respond to security incidents, fraud, abuse, or unauthorized use;
• diagnose errors and maintain the operation, stability, and performance of the platform;
• comply with legal obligations and respond to requests from competent authorities;
• manage contractual, commercial, and administrative relationships with customers and providers;
•  respond to privacy requests, inquiries, and complaints;
• administer and improve the public website and its functionality, including analytics and campaign measurement where applicable.

6. Artificial Intelligence and Automated Processing

Tivox uses artificial intelligence components to process information and perform automated functions according to the configuration of each operation. Processing may include language understanding, response generation, transcription, and other tasks necessary to provide the service.

Data processed through Tivox is used to provide the contracted services and operate the platform. We will not sell customer data or use the content of customer operations to train external models, unless a specific contractual or legal authorization permits it.

When use of a third-party artificial intelligence service is necessary for a particular functionality, processing will be carried out in accordance with the configuration, contract, and documentation applicable to the relevant provider.

7. Providers and Third-Party Processing

To provide Tivox, we may use specialized providers of infrastructure, communications, voice processing, artificial intelligence, storage, security, analytics, and other technology services.

The current architecture includes, among others, Oracle infrastructure for storing Tivox information, RunPod for processing AI workloads, ElevenLabs for certain voice functions, and Twilio for certain communications functions. The specific involvement of each provider depends on the modality, configuration, and services contracted.

Providers may process information in countries where they maintain infrastructure or provide their services. We do not assume that all data will be stored permanently in a single region. The United States is currently a contemplated infrastructure region, but other regions, including Europe, may be used when Tivox’s operational or expansion needs require it.

8. International Transfers

Due to the global nature of the technology infrastructure used by Tivox, information may be processed, stored, or accessed from countries other than the data subject’s country of residence or the country where the customer is located.

Where applicable law requires specific mechanisms for international transfers, Heureka will adopt the contractual, organizational, or legal measures appropriate to the processing and applicable jurisdiction.

9. Sensitive Data

Tivox may be used in operations that, depending on the customer’s configuration, could involve information that applicable law considers sensitive or specially protected. Heureka does not determine what categories of data each customer enters.

The customer must determine whether it is authorized to collect and process such data, obtain the required authorizations or legal bases, and establish the appropriate safeguards. Customers must not use Tivox for processing prohibited by applicable law.

When a law requires explicit consent, additional measures, or specific limitations for particular sensitive information, the customer will be responsible for complying with those requirements with respect to data it enters into or processes through Tivox, without prejudice to Heureka’s own legal obligations.

10. Children

Tivox is intended for authorized users aged 18 or older. We do not knowingly request personal information from individuals under 18 to create Tivox user accounts.

However, in an operation managed by a customer, a minor may attempt to interact with an Agent or appear in information supplied by the customer. Tivox is not designed to independently determine the age of each individual interacting with an Agent. The customer is responsible for determining the lawfulness of processing such data in its operation and implementing the appropriate safeguards.

11. Retention and Deletion

Information necessary to operate an Account and provide the services will be retained for the period during which a contractual relationship exists or for as long as necessary for the purposes described in this Policy, unless a legal obligation requires a different period.

For customer operational data, including data, audio, transcripts, contacts, and telephone numbers processed through Tivox, the intended operational rule is to retain them during the contractual term and delete them after termination of the contract within a maximum period of two (2) months, or earlier if the customer requests deletion at the time the contract ends, subject to legal obligations, security, dispute resolution, or other legitimate exceptions.

We may retain limited information when necessary to demonstrate compliance, meet legal obligations, prevent fraud or abuse, resolve disputes, or enforce rights, for the period permitted by applicable law.

12. Information Security

We apply reasonable and appropriate technical, administrative, and organizational measures to protect information against unauthorized access, loss, alteration, disclosure, or destruction, taking into account the nature of the information and the risks of processing.

This Policy does not describe specific technical controls that may change with the infrastructure architecture or that do not constitute permanent legal commitments. Specific controls applicable to a customer may be defined in its contractual agreements, technical documentation, or security addenda.

13. Cookies, Analytics, and Tracking Technologies

The public tivox.net website uses cookies and similar technologies. Some are necessary for the website to function; others may be used to understand website usage and measure campaigns or advertising.

The public website currently uses Google Analytics and Meta Pixel. These tools may collect technical and browsing information in accordance with their own policies and configurations.

Users can manage cookies through their browser settings. Where applicable law requires consent or specific choices for certain cookies or tracking technologies, Heureka will implement the corresponding mechanisms.

The public website does not currently use a newsletter as part of the Tivox service. The contact form allows users to voluntarily submit information so that we can respond to their request.

14. No Sale of Personal Information

Heureka does not sell personal information of Tivox customers or users to third parties as a commercial activity of the service. However, certain technology providers may process information to provide services on behalf of Heureka or the customer, and certain website analytics or advertising tools may involve processing or disclosures that are specifically regulated under certain state privacy laws.

15. Data Subject Rights and Privacy Requests

Depending on applicable law and the context of the processing, individuals may have rights to access, inquire about, know, correct, update, rectify, delete or erase, object, restrict, withdraw consent, port, or exercise other rights.

In Colombia, data subjects may exercise the rights recognized by Law 1581 of 2012 and its implementing regulations, including the right to know, update, and rectify their data, request information about its use, and exercise other rights provided by applicable law.

In the United States, available rights may vary by state, category of information, type of relationship with Heureka, and whether the organization is subject to the applicable state regime. Where applicable law grants additional rights, Heureka will handle requests in accordance with the requirements and exceptions established by that law.

Requests may be sent to privacy@heurekaestudio.co. We may request information reasonably necessary to verify the requester’s identity and protect information against fraudulent requests.

16. Processing on Behalf of Customers

When Tivox processes information on behalf of a customer, the customer may be the controller of processing with respect to its end users, contacts, or other individuals. In those cases, requests relating to content provided by the customer or to a particular operation may first be directed to the customer.

Where appropriate, Heureka will cooperate with the customer in responding to data subject requests, security incidents, or other obligations relating to processing carried out on the customer’s behalf.

17. Regulatory Compliance in Colombia and the United States

This Policy is formulated taking into account the general framework applicable to Heureka’s and Tivox’s activities, including Colombian personal data protection law and, where applicable, federal and state privacy laws in the United States.

In Colombia, the processing of personal data is subject, among other provisions, to Law 1581 of 2012 and its implementing regulations. In the United States, there is no single comprehensive federal law that uniformly regulates all personal data processing by businesses such as Tivox; federal and state laws may apply depending on the activity, location, volume, nature of the data, and applicable legal thresholds.

For example, certain state laws may impose additional rights only when their thresholds and conditions are met. This Policy does not represent that Heureka is subject to all state privacy laws or that all rights provided by those laws apply to every individual.

18. Changes to this Policy

We may update this Policy to reflect changes in Tivox, our providers, our operations, applicable law, or our processing practices. We will publish the updated version on tivox.net and indicate the date of the latest update.

When a change requires specific notice or consent under applicable law, we will use the corresponding mechanism.

19. Contact

For questions, requests, or complaints relating to this Policy or the processing of personal information:

• Heureka Estudio S.A.S.
• Tivox – Privacy
• Correo: privacy@heurekaestudio.co
• Sitio web: tivox.net

20. Regulatory References and Scope Note

This Policy should be published and maintained consistently with Tivox contracts, data processing agreements, security addenda, cookie/consent mechanisms, and internal procedures for handling data subject rights. Where a customer contract imposes additional obligations that are compatible with applicable law, those obligations may supplement this Policy.

This Policy is an operational privacy document and does not replace contracts, data processing agreements, jurisdiction-specific notices, or local legal advice. Before final commercial publication, it should be reviewed by qualified legal counsel in Colombia and, for U.S. operations, by counsel experienced in U.S. federal and state privacy law.