Deep Axiom Messages AI privacy notice
Last updated: October 21, 2026.
This notice explains which personal data the Deep Axiom Messages AI platform processes, for what purpose, with whom it is shared, how long it is kept and how to exercise your rights.
Identity and address of the controller
Deep Axiom, domiciled in Puebla, Puebla, Mexico, operates the Deep Axiom Messages AI platform, available at dianne.deepaxiom.com (the platform). For anything related to this notice or to your personal data, the contact is privacidad@deepaxiom.com.
Two roles: controller and processor
The platform lets a business (the tenant) connect its WhatsApp Business number and serve its customers with an assistant. That creates two distinct relationships.
Deep Axiom is the controller of the data of the people who open an account in the panel and of the data of the business that configures it. This notice applies to them directly.
Deep Axiom is the processor of the data of the people who write on WhatsApp to a business's assistant. That business is the controller: it decides what the data is processed for, publishes its own privacy notice and handles rights requests. Deep Axiom processes that data only on the business's behalf and under its instructions, and never uses it for purposes of its own.
Personal data we process
From whoever opens an account in the panel: name, email address, password (stored only as a hash), language and interface preferences, and the access log with date, IP address and the actions they approve or sign.
From the business that configures an assistant: trade name, WhatsApp Business number and its Meta account, integration credentials (always encrypted), the contacts and groups it registers, the campaigns and reminders it schedules, and the privacy notice it publishes for its customers.
From the people who write to the assistant, on the business's behalf: phone number, WhatsApp profile name, the content of messages and voice notes, their transcription, the assistant's replies, their consents and objections, and the rights requests they submit.
Sensitive data and minors
The platform does not ask for sensitive personal data (health, ethnic origin, beliefs, sexual preference, biometric data or political opinions) and is not designed to process it. A business that needs it must not use the platform for that purpose.
The platform is not aimed at minors either. If a person writes sensitive data, or a minor writes to the assistant, without being asked, the controlling business must handle it under its own notice, and the platform deletes it when the retention period ends.
Purposes of processing
Primary purposes, necessary for the service: creating and authenticating your account; operating the business's assistant, that is receiving messages, generating replies, transcribing voice notes, reading and booking in the connected calendar and sending the campaigns and reminders the business approves; recording who approved each send and which model produced each reply; protecting the platform against unauthorised access; and meeting legal obligations.
Secondary purposes: telling you about changes to the service or to this notice. We do not use the data for advertising and we do not sell it. You can object to the secondary purposes through the contact email without affecting the service.
Data we receive through Meta and WhatsApp
To connect a number, the business authorises Deep Axiom's app over its WhatsApp Business account in Meta's window (Embedded Signup). With that authorisation we receive the account and phone number identifiers and an access token limited to that account. We use it exclusively to receive and send that number's messages and manage its templates, under the policies of Meta's WhatsApp Business Platform.
The token is stored encrypted and is never shown in the clear without the password of the business's owner or an administrator. The business can revoke the authorisation at any time from its Meta portfolio settings, under Integrations, Connected apps, and from that moment the platform stops receiving its messages.
Transfers and providers
We do not sell or hand over personal data. These providers take part in delivering the service and process data on behalf of Deep Axiom or of the business:
Meta Platforms, Inc. (WhatsApp Business Platform): the channel every message comes in and goes out through.
MongoDB, Inc. (MongoDB Atlas): hosts the database where accounts, configuration and conversations are stored.
Google LLC: provides the artificial intelligence model that generates the assistant's replies and transcribes voice notes. The text of each conversation, and the audio when there is a voice note, is sent to that service to produce the reply. If the business connects Google Calendar, appointment data is processed in that service.
These providers may operate outside Mexico, so the processing involves international transfers. Each business must declare these transfers in the privacy notice it publishes for its customers.
Security measures
All communication is encrypted in transit. Passwords and API keys are stored only as hashes. WhatsApp tokens, model keys and calendar credentials are stored encrypted and released only to a send an authorised person approved. Every action that writes to the world (a send, a campaign, an appointment) is sealed in an evidence ledger with who approved it, which model produced it and when, without copying the message content. Each business's data is isolated from every other's. The measures follow the framework of ISO/IEC 27001 Annex A.
Retention and deletion
Account data is kept while the account exists. Conversations and message records are kept for the period each business sets in its privacy configuration, and are then deleted automatically. When a person exercises their right to cancellation or a business removes its assistant, the data is deleted from the database, from the logs and from backups in the next backup cycle, and a record is kept that it was deleted.
ARCO rights and withdrawal of consent
If you have an account in the panel or configured a business, you can exercise your rights of access, rectification, cancellation and objection, and withdraw your consent, by writing to privacidad@deepaxiom.com with your name, the account email and the right you are exercising. We answer within the periods set by Mexico's Federal Law on the Protection of Personal Data Held by Private Parties.
If you wrote on WhatsApp to a business's assistant, the controller is that business and it is the one that handles your request; its privacy notice says how, and you can also ask in the same chat. Deep Axiom gives the business the tool to record, handle and execute each request on time, and if we receive one directly we pass it on to the controlling business.
How to limit the use of your data
If you do not want messages from a business's assistant, write BAJA to it or ask to be removed: your number goes on that business's exclusion list and the platform does not let it send you campaigns or reminders. A business can revoke the WhatsApp authorisation and delete its assistant from the panel. A panel account is closed through the contact email.
Cookies and tracking technologies
The panel uses one session cookie, strictly necessary to keep you signed in, and stores interface preferences such as language and theme in your browser. We use no advertising or third-party tracking cookies. The Facebook SDK is loaded only in the step of connecting a number with Facebook, when the business asks for it.
Authority
If you believe your right to the protection of personal data has been violated, you can turn to the authority competent in Mexico for the protection of personal data held by private parties.
Changes to this notice
This notice may change to reflect changes in the service or in the law. The current version is always published at this address with its update date, and a change affecting purposes or transfers is announced in the panel to everyone with an account.