Privacy policy

Who we are

Tixora is an online platform for digital marketing agencies, operated by Caticx Technology LLC, Office 39, 12th Floor, One Tower, Sheikh Zayed Road, Dubai, United Arab Emirates ("we", "us"). This policy explains what information Tixora handles, why, and the choices people have. Questions can be sent to info@caticx.com.

Whose information we handle

• Agency team members who have an account on Tixora.
• Agencies' clients, whose business information the agency keeps in Tixora to do its work.
• Visitors to websites built with Tixora who send an enquiry through a contact form on such a website.

For information about an agency's clients and their website visitors, the agency decides what is collected and why, and we process it on the agency's behalf.

What we collect

• Account details: name, work email address, role, a protected (hashed) password or the identifier from Microsoft sign-in, two-step login settings, and the time of the last sign-in.
• Work content: client names and websites, brand notes, tasks, website drafts and uploaded files, audit results, keywords, reports, and conversations with the built-in AI assistant.
• Stored logins: website and hosting logins an agency chooses to save. These are encrypted, and only the agency's administrators can view them.
• Website enquiries: the details a visitor types into a contact form on a website built with Tixora, kept for the agency that owns that website.
• Activity records: a log of important actions (for example sign-ins and changes), with the time and network address, kept for security.
• Google data, described in the next section.

Tixora uses one essential cookie to keep a person signed in. It does not use advertising or tracking cookies.

Google user data

What we access. When an agency connects a Google account for one of its clients, Tixora requests read-only access to Google Search Console and Google Analytics. From Search Console it reads the list of websites the account can see and search performance figures: clicks, impressions, click-through rate, average position, and the top searches and pages. From Google Analytics it reads the list of properties the account can view and summary figures: visitors, visits, engagement rate, key events, traffic channels and most visited pages. Tixora does not read emails, files, contacts or any other Google data, and it cannot change anything in the Google account.

How we use it. Only to show these figures to the agency's team inside Tixora and to include them in the reports the agency prepares for that client, including a written summary of the figures.

How we store it. The access key Google issues (a refresh token) is stored encrypted on our server. The figures last retrieved are stored in our database so the page and reports can display them.

Who we share it with. We do not sell Google user data, and we do not use it for advertising. It is visible to the agency that made the connection and to anyone that agency gives a report link to. To write the report summary, the summary figures are sent to our AI processing provider, which acts on our instructions and under terms that do not allow it to use the data to train its models. We do not use Google user data to develop, improve or train generalised artificial intelligence or machine learning models. Our hosting provider stores the data as part of running the server.

Limited use. Tixora's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Removing access. An agency can disconnect Google on the client's SEO page at any time. This deletes the stored access key and the stored figures for that client. Access can also be removed from the Google account itself at myaccount.google.com/permissions. Reports already created keep the figures they showed until the agency deletes them or asks us to.

Facebook, Instagram and LinkedIn data

Where an agency connects a Facebook Page, an Instagram professional account, a Meta ad account or a LinkedIn Page that it manages for a client, Tixora accesses only what is needed for the agency's work on that account: the list of Pages and accounts the person connecting chooses to share, the content and comments on those Pages, and their performance figures (such as reach, engagement and advertising results). Tixora uses this to prepare and publish posts the agency has approved, and to show results to the agency's team and in the reports it prepares for that client.

Tixora does not access personal profiles, private messages between individuals, or friends and connection lists, and it does not sell this data or use it for advertising of its own. Access keys are stored encrypted. An agency can disconnect an account in Tixora at any time, which deletes the stored access key and figures, and access can also be removed in the Facebook, Instagram or LinkedIn account's own settings. How to ask for deletion is explained on the data deletion page.

How we use information

• To provide the platform: signing people in, showing each agency its own clients and work, and producing websites, audits and reports.
• To operate the AI assistant: the text of a request and the relevant client notes are sent to our AI processing provider to produce the answer, under terms that do not allow it to train its models on that content.
• To keep the platform secure, prevent misuse and fix problems.
• To meet legal obligations.

We do not sell personal information.

Service providers

We use a small number of providers to run Tixora: a hosting provider for the server; an AI processing provider for the assistant and written summaries; Microsoft, when an agency chooses Microsoft sign-in; Google, for the connections described above and for website speed checks; and a search data provider for keyword positions, which receives only the keywords and website address being checked. Each receives only what it needs for its task.

Keeping information safe

Connections to Tixora are encrypted. Each agency's information is kept separate from every other agency's. Passwords are stored in protected form, saved logins and Google access keys are encrypted, sign-ins are limited after repeated failures, and two-step login is available. No system is perfectly secure, and we will tell affected agencies without undue delay if we learn of a breach affecting their information.

How long we keep it

We keep an agency's information while it uses Tixora. When an agency closes its account or asks us to delete information, we delete it from the live system within 30 days, except where the law requires us to keep it. Backups are overwritten on a rolling basis.

Your choices and rights

You can ask to see, correct or delete the personal information we hold about you, or object to how it is used, by writing to info@caticx.com. If your information was put into Tixora by an agency (for example you are that agency's client, or you sent an enquiry through a website), we will pass your request to that agency or help it respond. Depending on where you live, you may also have the right to complain to your data protection authority.

Children

Tixora is a business tool. It is not directed at children, and we do not knowingly collect information from them.

Changes to this policy

If we change this policy we will update the date at the top, and we will tell agencies about significant changes before they take effect.