Privacy Policy

1. Who we are

istGalaxy (operated by BEDDRAMA LLC; 2803 Philadelphia Pike STE B296, Claymont, DE 19703, USA) is a platform providing businesses with omnichannel customer messaging management, a cited AI assistant, and invoicing. Questions: info@istgalaxy.com.

2. Information we collect

Account & business data: name, email, password (hashed), business profile, and operator users you create.

Messaging data (processed on behalf of our customers): messages, attachments, sender identity/number, profile name and conversation metadata from WhatsApp, Instagram, Messenger, web, email, Telegram and SMS.

Payment data: billing is handled by Stripe; we do not store full card numbers.

Usage & technical data: log data, device/browser information, and feature usage for security and performance.

3. How we use information

To provide the Service: routing and storing messages, generating cited AI replies, enabling human operator handover, creating invoices and payment links, billing, support, security, and product improvement. We do not sell personal data.

4. Service providers

We share data only with providers that help us run the Service: Meta Platforms (WhatsApp/Instagram/Messenger), Stripe (payments), AI model providers, Cloudflare and hosting providers. Each processes data under its own terms and our instructions.

5. Calendar data (Google and Microsoft)

If you connect the optional calendar sync, istGalaxy's access to your Google Calendar or Microsoft 365 calendar is used for exactly two purposes: (1) availability checks — busy time blocks on your calendar are read so those hours are never offered as appointment slots; and (2) appointment write-back — appointments booked on the platform are added to your calendar as events and removed on cancellation.

We do not store the content of your events (titles, descriptions, attendees); only busy time ranges are processed transiently (cached for at most 2 minutes). Access tokens are stored encrypted. Your calendar data is never used for advertising, never sold, never transferred to third parties, and never used to train AI models. You can disconnect at any time from the panel; stored tokens are deleted on disconnect.

For Google data: istGalaxy's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Regarding AI features: no raw, aggregated, or derived user data received from Google APIs is used to create, train, or improve foundational or generalized AI/ML models, nor is it transferred to any third party for such purposes; our AI providers process data solely for real-time inference.

6. Retention

We retain account and conversation data for as long as the business account is active, and as required for legal, tax, or security purposes. Customers control their own data and may request deletion.

7. Your rights & data deletion

Subject to applicable law (including GDPR/KVKK), you may request access, correction, or deletion of your data. See our Data Deletion page to request removal.

8. Security

We use encryption in transit, encryption at rest for sensitive credentials, tenant isolation, and access controls. No method is 100% secure, but we work to protect your data.

9. International transfers

Data may be processed by us and our providers in countries other than your own (e.g., EU/US) with appropriate safeguards.

10. Children

The Service is for businesses and is not directed to children under 16.

11. Changes & contact

We may update this policy; material changes will be posted here with a new “Last updated” date. BEDDRAMA LLC — info@istgalaxy.com.