Privacy Policy

Last updated: September 21, 2026

1. Who we are

Xsta360 is a multi-tenant sales management application operated by Kreatix Technologies ("we", "us"). It helps teams capture leads, log activity, manage pipelines, and send follow-up reminders. This policy explains what we collect, why, and the choices you have. Questions: admin@kreatixtech.com.

2. What we collect

  • Account data — name, email address, and a hashed password for each user.
  • Workspace data — your organization name, team members, roles, pipeline stages, and settings.
  • Lead data — names, phone numbers, email addresses, companies, notes, remarks, and activity history that you enter or import. You are the controller of this data; we process it on your behalf.
  • Billing data — subscription status and payment references. Card details are handled by Paystack and never touch our servers.
  • Voice input — audio you record with the dictate feature is sent to our server, transcribed to text, and not retained after transcription.
  • Usage data — audit events inside your workspace (logins, record changes) and standard server logs (IP address, browser, timestamps).
  • Integration credentials — if you connect WhatsApp Business, we store the phone number ID and access token needed to send messages on your behalf.

3. How we use it

  • Provide the service: store and display your leads, tasks, reminders, and pipeline.
  • Send transactional messages you configure — reminder emails, sequence emails, and WhatsApp messages to your leads.
  • Process subscription payments through Paystack.
  • Keep the service secure: authentication, rate limiting, abuse prevention.
  • We do not sell your data and we do not use your lead data to advertise.

4. Third-party processors

  • Meta / WhatsApp Business Platform — sends WhatsApp messages you configure; subject to Meta's terms and the 24-hour messaging window rules.
  • Paystack — payment processing for subscriptions.
  • Brevo — transactional email delivery and engagement tracking (open/click pixels on sequence emails).
  • Cloudflare R2 — document storage for files you upload.

Each processor receives only the data needed to perform its function and is bound by its own privacy and security terms.

5. Cookies

We use a single httpOnly session cookie (xsta_session) to keep you signed in. It contains a signed token — not your password — and expires when you log out or after the session lifetime. We do not use advertising or cross-site tracking cookies.

6. Data retention and deletion

Workspace and lead data is retained while your account is active. Organization admins can delete leads, documents, and members at any time. To delete an entire workspace and all associated data, contact us at admin@kreatixtech.com — we will erase it within 30 days, except where retention is required by law (e.g. payment records).

7. Your rights

  • Access, correct, or export your data from within the app.
  • Request deletion of your account or workspace.
  • Withdraw a WhatsApp connection at any time from Settings.
  • Leads you email through sequences can unsubscribe via the link in every message.

8. Security

Passwords are hashed with bcrypt, sessions use signed JWTs in httpOnly cookies, traffic is served over HTTPS, and every workspace's data is scoped by organization so tenants cannot see each other's records.

9. Changes

If we make material changes to this policy we will update the date above and, where appropriate, notify workspace admins by email.