Corelux · Luxware
Privacy policy
This policy describes how Luxware handles personal data when you use the Corelux app (ERP) and connected channels, including sign-in, support and, if your organization enables them, Meta platform and Google Calendar integrations.
1. Controller
The controller is Luxware Technologies, S.A. de C.V., San Salvador, El Salvador, operator of Corelux. To exercise your rights or ask about this policy, write to [email protected].
2. Data we may process
Depending on how you use Corelux, we may process:
- Account and profile: name, email, username, password (stored hashed or equivalent), role and company (tenant).
- Business data: catalog, orders, customers, electronic invoicing (DTE) and organization settings.
- Payments: payment-link identifiers, collection status and the minimum data the payment processor returns. We do not store full card numbers.
- Support: the content of requests you send to the contact email.
- Technical use: access logs, IP address, browser type and security events, to operate and protect the service.
- Meta integrations (if you connect them): page or business-account identifiers, access tokens you authorize, and the content needed to provide the feature you enabled (for example messaging or connected ads). We do not request or store Meta’s App Secret on this public site.
- Google Calendar integration (if you connect it): the email, name and identifier of the connected Google account, the OAuth tokens you authorize, and the secondary calendars and events Corelux creates for Corelux Agenda appointments.
3. Why we use the data
- Provide and maintain Corelux (authentication, ERP, storefront and invoicing).
- Handle support and requests to delete or correct data.
- Meet legal, tax and security duties.
- If your organization connects a Meta integration, operate only the features authorized in that connection.
- If your organization connects Google Calendar, sync Corelux Agenda appointments only with the calendar Corelux creates.
We process data to perform the service contract, with consent when you give it expressly (for example when connecting an integration), and to meet legal duties.
4. Who we share with
We do not sell personal data. We may share it only with: (a) vendors that host, send email or process payments, under Luxware’s instructions; (b) Meta Platforms, only if your organization connects an integration and within that connection’s scope; (c) Google, only if your organization connects Google Calendar, to create and update appointments in the calendar Corelux creates; (d) authorities when the law requires it.
5. Retention
We keep data while the account or tenant is active and for the extra time needed to handle inquiries, incidents or legal deadlines (for example tax documents). Then we delete or anonymize it. The deletion process is described in User data deletion.
6. Your rights
You may request access, correction, update, objection, restriction or deletion of your personal data, and withdraw consent when processing is based on it. Send your request to [email protected]. We will verify your identity before making changes.
7. Security and children
We apply reasonable technical and organizational measures (access control, encryption in transit and tenant isolation). Corelux is not directed at anyone under 18.
8. Google Calendar (Corelux Agenda)
If your organization connects Google Calendar to Corelux Agenda, Corelux requests the following permissions (scopes) from Google:
- https://www.googleapis.com/auth/calendar.app.created: create and manage only the secondary calendars Corelux creates and their events.
- openid, email and profile: identify the connected Google account.
- https://www.googleapis.com/auth/calendar.acls: only if you choose to share the Corelux calendar with other people, to apply that sharing permission.
We use this data only to create, update and delete Agenda appointments in the Corelux-created calendar and to show you which Google account is connected. We do not read or modify your other calendars.
We do not use Google data for advertising, we do not sell it, and humans do not read it except with your permission, for security purposes, or when required by law.
OAuth tokens are stored encrypted at rest and used only on our servers; they are never exposed in the browser. You can stop access at any time by disconnecting Google Calendar in Corelux or revoking access at https://myaccount.google.com/permissions. To delete the associated data, follow the data deletion instructions or write to [email protected].
Corelux's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.
9. Changes
If we update this policy, we will publish the new date on this page. Continued use of the service after a material change means you should review the current text.
10. Related documents
See also the Terms of service and the user data deletion instructions.