Corelux · Luxware
Privacy policy
This policy describes how Luxware handles personal data when you use the Corelux app (ERP) and connected channels, including sign-in, support and, if your organization enables them, Meta platform and Google Calendar integrations.
1. Controller
The controller is Luxware Technologies, S.A. de C.V., San Salvador, El Salvador, operator of Corelux. To exercise your rights or ask about this policy, write to cristianpalma1703@gmail.com.
2. Data we may process
Depending on how you use Corelux, we may process:
- Account and profile: name, email, username, password (stored hashed or equivalent), role and company (tenant).
- Business data: catalog, orders, customers, electronic invoicing (DTE) and organization settings.
- Payments: payment-link identifiers, collection status and the minimum data the payment processor returns. We do not store full card numbers.
- Support: the content of requests you send to the contact email.
- Technical use: access logs, IP address, browser type and security events, to operate and protect the service.
- Meta integrations (if you connect them): page or business-account identifiers, access tokens you authorize, and the content needed to provide the feature you enabled (for example messaging or connected ads). We do not request or store Meta’s App Secret on this public site.
- Google Calendar integration (if you connect it): the email, name and identifier of the connected Google account, the OAuth tokens you authorize, and the secondary calendars and events Corelux creates for Corelux Agenda appointments.
3. Why we use the data
- Provide and maintain Corelux (authentication, ERP, storefront and invoicing).
- Handle support and requests to delete or correct data.
- Meet legal, tax and security duties.
- If your organization connects a Meta integration, operate only the features authorized in that connection.
- If your organization connects Google Calendar, sync Corelux Agenda appointments only with the calendar Corelux creates.
We process data to perform the service contract, with consent when you give it expressly (for example when connecting an integration), and to meet legal duties.
4. Who we share with
We do not sell personal data. We may share it only with: (a) vendors that host, send email or process payments, under Luxware’s instructions; (b) Meta Platforms, only if your organization connects an integration and within that connection’s scope; (c) Google, only if your organization connects Google Calendar, to create and update appointments in the calendar Corelux creates; (d) authorities when the law requires it.
5. Retention
We keep data while the account or tenant is active and for the extra time needed to handle inquiries, incidents or legal deadlines (for example tax documents). Then we delete or anonymize it. The deletion process is described in User data deletion.
6. Your rights
You may request access, correction, update, objection, restriction or deletion of your personal data, and withdraw consent when processing is based on it. Send your request to cristianpalma1703@gmail.com. We will verify your identity before making changes.
7. Security and children
We apply reasonable technical and organizational measures (access control, encryption in transit and tenant isolation). Corelux is not directed at anyone under 18.
8. Google Calendar (Corelux Agenda)
If your organization connects Google Calendar to Corelux Agenda, Corelux requests the following permissions (scopes) from Google:
- https://www.googleapis.com/auth/calendar.app.created: create and manage only the secondary calendars Corelux creates and their events.
- openid, email and profile: identify the connected Google account.
- https://www.googleapis.com/auth/calendar.acls: only if you choose to share the Corelux calendar with other people, to apply that sharing permission.
We use this data only to create, update and delete Agenda appointments in the Corelux-created calendar and to show you which Google account is connected. We do not read or modify your other calendars.
We do not use Google data for advertising, we do not sell it, and humans do not read it except with your permission, for security purposes, or when required by law.
OAuth tokens are stored encrypted at rest and used only on our servers; they are never exposed in the browser. You can stop access at any time by disconnecting Google Calendar in Corelux or revoking access at https://myaccount.google.com/permissions. To delete the associated data, follow the data deletion instructions or write to cristianpalma1703@gmail.com.
How we protect Google data: all communication between your browser, Corelux and Google is encrypted with HTTPS (TLS). Google OAuth tokens are stored encrypted with AES-GCM in our database and are decrypted only by our servers to call Google. Google data is separated by organization (tenant): only users in your organization with Agenda permissions can view or manage the connection, and Luxware staff access it only to provide support you request, for security, or when required by law.
When you disconnect Google Calendar in Corelux, we attempt to revoke access at Google and immediately delete the stored OAuth tokens.
How long we keep it: we keep Google data only while the Google Calendar connection is active. When you disconnect, we immediately delete the tokens; with “Delete my Google data” we immediately delete all the data described below; and if you request it through the data deletion instructions, we do so within up to 30 days.
To delete your Google data, use the “Delete my Google data” button in Corelux Agenda > Google. We immediately delete from Corelux the records of all of the organization's Google connections, including their email, identifier and tokens, the records of the professionals' calendars, pending syncs to Google, OAuth authorization states, the links between appointments and Google events, and the busy blocks that come from Google. Agenda appointments are kept. Calendars in Google are not deleted: they remain in the Google account. We also attempt to revoke access at Google and attempt to stop Google notifications. If you choose to and the connection is still active, we also delete in Google the future appointments created by Corelux, up to a maximum of 500.
You can also request deletion through the data deletion instructions. Luxware verifies the request and deletes the same data within up to 30 days. In both cases we keep the Agenda appointments, without the Google identifier, and an audit record with the date, the source of the request and the Corelux user who made it, with no Google email, identifiers or tokens.
Corelux's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.
The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.
Google API Services User Data Policy
9. Changes
If we update this policy, we will publish the new date on this page. Continued use of the service after a material change means you should review the current text.
10. Related documents
See also the Terms of service and the user data deletion instructions.