Policies and Procedures
We want your data to remain yours, and we're committed to being transparent about our practices as a business.
Privacy Policy
Last Updated: September 1, 2025
- Scope & Roles
This Policy applies to: (a) visitors to our websites, (b) prospective customers, (c) customer personnel who use the Services, and (d) End-Users who interact with our customers via the Services. Where we process personal information on behalf of a customer, we act as a processor/service provider and our Data Processing Addendum (DPA) governs that processing.
- Information We Collect
- Account & Billing: name, business email, phone, company, role, address; payment method tokens (processed by our payment processor), and transaction history.
- Service Data (Customer Data): chat/tickets, messages, attachments, automation/AI prompts/outputs, metadata, participants, tags, and integration identifiers submitted to the Services by you or your Users.
- Technical & Usage: device/OS/browser, IP address, timestamps, activity logs, diagnostics, performance metrics, referral URLs, clickstream, session analytics (if enabled).
- Cookies & Identifiers: please see our Cookie Policy for details and controls.
- Support/Feedback: communications with us, survey responses, and feature requests.
- Sensitive Categories: We do not seek special-category/sensitive data. Customers must not submit PHI, full payment card data, biometric templates, precise geolocation of minors, or government ID numbers unless expressly agreed in writing (see Terms, Annex E).
- How We Use Information
- Provide, operate, secure, and troubleshoot the Services;
- Authenticate users; prevent fraud, abuse, and spam;
- Communicate about features, security, and transactions; provide support and training;
- Analyze usage and improve the Services (including quality of AI features, if enabled);
- Personalize content and measure marketing to business contacts (you may opt out);
- Comply with law, enforce Terms, protect rights, safety, and property.
- Legal Bases (EEA/UK)
Performance of contract; legitimate interests (product improvement, security, B2B marketing); consent (where required, e.g., certain cookies); and legal obligations.
- Sharing & Disclosures
- Service providers & subprocessors (hosting, storage, email/SMS, identity, analytics, AI/LLM, CRM, support tools);
- Third-Party Services you enable (at your direction);
- Affiliates for operations; professional advisors/insurers;
- Legal/compliance (to comply with law or protect rights);
- Business transfers (merger, financing, acquisition, dissolution).
We do not sell personal information for money. Where certain analytics/ads uses are deemed a “sale” or “share” under some state laws, we honor required opt-outs.
- International Transfers
We are U.S.-based and may transfer information globally using appropriate safeguards (e.g., EU Standard Contractual Clauses and UK Addendum) as set out in the DPA.
- Security & Florida Breach Support
We maintain reasonable technical and organizational security (see Terms, Annex C). If we discover a breach, we will notify our customer without undue delay and support Florida FIPA obligations, including 30-day individual notice timelines (with permitted extensions), notice to the Florida Attorney General if ≥500 residents affected, and notice to nationwide CRAs if >1,000 individuals are notified at once. Third-party agents must notify covered entities within 10 days. Customers are generally responsible for statutory notices where we act as processor.
- Your Choices & Rights
- Access/correct/delete certain info via your account;
- Unsubscribe from marketing via in-message links or email info@byrachat.com
- Manage cookie preferences via our banner or your browser;
- We honor legally required Global Privacy Control signals where applicable;
- State/International Rights: Depending on your location, you may request access, correction, deletion, portability, restriction/objection.
- Florida Digital Bill of Rights: Primarily applies to very large enterprises (generally >$1B revenue plus additional criteria). If we ever qualify, we will update this Policy and provide required mechanisms.
- Messaging, Email & Do-Not-Call
If you receive texts through our tools, you can reply STOP to opt out and we/our customer will cease within 15 days (FTSA safe harbor). We maintain internal DNC lists and honor revocations. For email, we comply with CAN-SPAM and Florida email rules.
- Children
Not directed to children under 13; we do not knowingly collect children’s personal information. If you believe a child provided information, contact us for deletion.
- Third-Party Links/Integrations
Third-Party Services and websites are governed by their own terms and policies.
- Data Retention
We retain information as needed to provide the Services, for legitimate business/defense purposes, and as required by law. Customer Data retention/deletion follows the Terms and Annex F – Records Schedule.
- Changes
We may update this Policy; material changes will be communicated via the Service or email.
- Contact
ByrachatVentures LLC (Byra)
Address: 1020 west heritage club circle Delray Beach, Florida 33483 USA
Email: info@byrachat.com
Terms & Conditions
Last Updated: September 1, 2025
These Terms are between ByrachatVentures LLC d/b/a “Byra” (“Byra,” “we,” “us”) and the entity/person agreeing to them (“Customer,” “you”). By creating an account, clicking “I agree,” or using the Services, you accept these Terms.
- Definitions
- Account: your registered account; User: individual you authorize;
- Customer Data: data/content you or your Users submit;
- Documentation: user guides/policies; Order: checkout/order form/invoice;
- Services: Byra’s hosted software for support, messaging, chatbots, help desk, automations, APIs, and related apps/sites;
- Third-Party Services: non-Byra tools/integrations.
- Access; Changes; Support
- License: non-exclusive, non-transferable right to use the Services during a paid term for internal business purposes;
- Accounts: you’re responsible for Users and credentials;
- Changes/Beta: we may modify features; Beta is AS IS;
- Support/Availability: standard web/email support; maintenance/emergencies may affect availability.
- Subscriptions, Fees, Auto-Renewal & ROSCA
- Fees: billed in advance per Order; non-refundable except as required by law or expressly stated;
- Auto-Renewal: renews unless canceled; for contracts ≥12 months that auto-renew >1 month, we send a clear renewal notice 30–60 days before the cancellation deadline (Fla. Stat. §501.165);
- Express Consent & Easy Cancellation: material terms disclosed immediately adjacent to consent; we obtain express informed consent and offer a simple online cancellation path (ROSCA best practices);
- Taxes: you pay applicable taxes (excluding our net-income taxes);
- Overages/Add-Ons: prorated charges may apply; Late: 1.5%/mo (or legal max) + collection costs; possible suspension after notice.
- Acceptable Use (AUP) — Florida-Aware
No unlawful use; no Prohibited Data (PHI without BAA, full payment card data, biometric templates, precise geolocation of minors, or government ID numbers) without our prior written approval; no probing/attacking; no reverse engineering; no resale to unaffiliated third parties; no IP/privacy violations; no High-Risk activities; and no misuse of telecom/messaging features.
- Customer Data; Privacy; Security
- Ownership: you own Customer Data; you grant Byra a license to host/process and to create Aggregated/De-identified Data (owned by Byra) to operate, secure, and improve the Services;
- Your Responsibilities: obtain/record required consents; provide End-User notices; comply with data, telecom, and consent laws;
- Security: reasonable measures (see Annex C);
- DPA: Annex A applies where we process personal data for you; includes SCCs/UK Addendum;
- Retention/Deletion: retain through term + [60] days for export; then delete/de-identify and cycle out of backups (Annex F);
- Integrations: enabling Third-Party Services instructs us to share data as needed; third parties’ terms apply.
- Generative AI & Automation
Outputs may be inaccurate or biased and are provided AS IS. You must review outputs and set guardrails; do not use outputs as professional advice.
- IP; Feedback
We and our licensors own the Services and Documentation. You grant us a perpetual, irrevocable, royalty-free license to use feedback.
- Telecom, Messaging & Marketing Compliance
- Obtain/document prior express written consent for automated marketing texts/calls to Florida residents; keep consent logs;
- Honor Florida quiet hours (no calls/texts before 8:00 a.m. or after 8:00 p.m. local time) and “3 calls on the same subject per 24 hours” rule;
- Implement STOP/HELP keywords; cease marketing texts within 15 days of a STOP and send one confirmation;
- Register A2P 10DLC brand/campaigns; carriers may block/fine unregistered traffic;
- Follow CTIA Messaging Principles; comply with CAN-SPAM and Florida email rules; maintain internal Do-Not-Call list and accurate caller ID.
We may suspend messaging features for high complaint rates or material non-compliance; you are responsible for carrier fines or penalties arising from your campaigns.
- Warranties; Disclaimers
We warrant material conformance to Documentation. OTHERWISE, THE SERVICES/BETA/MATERIALS ARE PROVIDED “AS IS/AS AVAILABLE,” WITHOUT IMPLIED WARRANTIES.
- Indemnities
- Byra (IP): we defend against claims that the Services (as authorized) directly infringe U.S. IP; we may modify, procure rights, or refund the unused portion and terminate the affected feature;
- You: you defend/indemnify Byra for claims arising from Customer Data, unlawful use/consent failures/marketing, or combinations with non-Byra items.
- Liability Limits
NO PARTY IS LIABLE FOR INDIRECT/CONSEQUENTIAL/LOST PROFITS/LOSS OF DATA. TOTAL LIABILITY IS CAPPED AT THE FEES YOU PAID FOR THE AFFECTED SERVICE IN THE PRIOR 12 MONTHS OR USD $100, WHICHEVER IS GREATER. Exclusions: your payment obligations; your indemnity (§8/§10); willful misconduct/fraud.
- Term; Suspension; Termination
Terms run until subscriptions end. We may suspend for non-payment, security risk, or illegal/harmful use. Either party may terminate for uncured material breach (30 days’ notice). No refunds for convenience termination. Certain sections and annexes survive.
- Disputes; Governing Law; Venue
- Informal Resolution: 30 days after written notice;
- Arbitration & Class Waiver: JAMS, binding, single arbitrator in Palm Beach County, Florida, English; no class actions. Opt out within 30 days by writing to info@byrachat.com;
- Law/Venue: Florida and U.S. law (conflicts excluded). Subject to arbitration, exclusive venue is state/federal courts in Palm Beach County, Florida; jury trial waived.
- Export/Sanctions; Anti-Corruption
You will comply with U.S. export/sanctions and anti-bribery laws.
- Publicity
Unless you opt out via info@byrachat.com, we may use your name/logo as a customer.
- E-Sign Consent (Florida & Federal)
You consent to transact electronically. Electronic records/signatures have legal effect under Florida UETA (Fla. Stat. §668.50) and the federal E-SIGN Act.
- Notices
Legal notices to: info@byrachat.com. We may notify you via Account email or in-product messages.
- Assignment; Force Majeure; Independent Contractors
You need our consent to assign (not unreasonably withheld). We may assign to an Affiliate or in a corporate transaction. Neither party is liable for events beyond reasonable control. The parties are independent contractors.
- Entire Agreement; Order; Updates
These Terms + Orders + Annexes/Documentation (including DPA, SLA, Security/IR, Telecom Add-On, HIPAA/PCI Statement, Records Schedule) are the entire agreement. Order → Terms → Annexes (SCCs/IDTA control for transfers) → Documentation. We may update; material changes take effect on renewal or as required by law (with notice).
Annex A — Data Processing Addendum (DPA)
- Roles: Customer = controller/business; Byra = processor/service provider.
- Scope: provide, secure, support Services; create Aggregated/De-identified data.
- Subprocessors: authorized per live list; 30 days’ advance notice for material changes; good-faith objections; if unresolved, terminate affected Services pro-rata.
- Security: measures in Annex C.
- International Transfers: EU SCCs (2021/914) Modules 2/3; UK Addendum/IDTA; appropriate safeguards and supplementary measures.
- Assistance: DSRs, DPIAs, consultations; Audits: SOC2/pen-test summaries; targeted audits on 30 days’ notice.
- Breach: notify without undue delay and cooperate; Florida timelines summarized in Annex C §4.
- Deletion/Return: delete or return on termination/request; backups cycle out per retention.
- Order of Precedence: SCCs/IDTA → this Annex → Terms.
Annex A-1 (Description): Subjects—your agents, end-customers, visitors. Data—identifiers, contact info, chat/tickets, files, device/IP, usage, consent logs. Purpose—hosting, storage, routing, search, analytics, deliverability, logging, support, AI (if enabled). Retention—see Annex F.
Annex B — Service Level Addendum (SLA)
- Uptime: 99.9% monthly (excludes maintenance, force majeure, your networks/integrations, carrier/Third-Party outages, DDoS beyond reasonable mitigation, Beta).
- Credits: <99.9% ≥99.0% → 10%; <99.0% ≥97.0% → 25%; <97.0% → 50% of monthly fees for the affected Service. Credits are your sole downtime remedy.
- Maintenance: up to 2 hrs/week during Sundays 02:00–04:00 ET. Measured by Byra multi-region monitoring.
Annex C — Security & Incident Response (Florida-Aware)
- Program: least-privilege/SSO/MFA; TLS1.2+/AES-256; key mgmt; WAF; EDR; secure SDLC; vuln mgmt with SLAs; logging/SIEM; backups; DR; vendor risk; employee training/background checks; incident playbooks.
- FIPA Overview: individual notice no later than 30 days after determination (law-enforcement delay and limited extensions permitted); AG notice if ≥500 residents; CRA notice if >1,000 individuals are notified; third-party agents notify covered entity within 10 days; secure disposal required when PI is no longer retained.
Annex D — Telecom/Messaging Add-On
Integrated into §8 (consent, quiet hours/3-in-24, STOP-within-15-days, A2P 10DLC, CTIA, CAN-SPAM, Florida email law).
Annex E — HIPAA/PCI/Sensitive Data Statement
- PHI: not permitted unless a Business Associate Addendum (BAA) is executed.
- Payment Cards: don’t store full PANs/CVV/sensitive auth data; use PCI-validated processors; Byra uses tokens.
- Other Sensitive: government IDs, biometric templates, precise geolocation of minors, etc., require prior written approval.
Annex F — Records Retention & Destruction (Baseline)
| Record Type | Default Retention | Notes |
|---|---|---|
| Chat/ticket content | 24 months | Configurable (shorter = safer) |
| System/auth/admin logs | 12 months | Extendable for forensics |
| Billing/invoices | 7 years | Tax/finance obligations |
| Consent & opt-out logs (SMS/Email) | 4 years | Defend FTSA/TCPA claims |
| Support attachments | 12 months | Auto-purge where feasible |
| Backups | 30–45 days rolling | Encrypted; cycle out |
Destruction: shred/erase/make unreadable per Florida law.