Privacy Policy
Who We Are & Scope of Policy
BolixAI ("BolixAI", "we", "us", or "our") provides an autonomous AI agent SaaS platform for WhatsApp sales automation, SDR outbound outreach, and conversational voice support. This Privacy Policy describes how we collect, process, store, and protect your personal data when you visit our website, register for an account, or utilize our agent services.
We comply with applicable data protection laws globally, specifically including the Digital Personal Data Protection Act, 2023 (DPDPA 2023 - India) and the General Data Protection Regulation (GDPR - EU/UK).
For data privacy questions or to contact our Data Protection Office / Grievance Redressal Officer, please reach out to privacy@bolixai.com.
Information We Collect
We collect data in the following distinct categories strictly to provide and maintain our services:
• Account & Identity Information: Name, work email address, company name, phone number, billing credentials, and tax identification provided during signup or checkout.
• Customer Workspace Data (Tenant Data): Knowledge base articles, FAQs, product catalogs, lead lists, and customer interaction histories that you upload or connect to your agent workspaces. You remain the Data Fiduciary / Controller for this data; BolixAI operates as a Data Processor.
• Communication & Agent Interaction Logs: Transcripts of WhatsApp conversations, inbound/outbound voice call recordings (with automatic PII redaction capabilities), and SDR outreach email records generated during active agent execution.
• Technical & Diagnostic Metadata: IP addresses, browser specifications, operating system telemetry, session timestamps, and diagnostic event logs collected to maintain system stability and security.
How We Use Your Information (Purpose Limitation)
In accordance with DPDPA 2023 (Section 4 & 7) and GDPR (Article 6), we process personal data strictly for specified, lawful, and consented purposes:
• Executing AI agent workflows, conversational queries, and automated lead routing on your behalf.
• Processing subscription transactions, issuing tax invoices, and preventing fraudulent payment attempts.
• Delivering critical service announcements, security alerts, and system status updates.
• Monitoring infrastructure performance, mitigating cyber attacks, and maintaining platform uptime.
• Providing technical customer support and resolving configuration queries.
We do NOT sell, rent, or trade personal data to advertisers, data brokers, or third parties under any circumstances.
AI Model Governance & Training Exclusions
Customer privacy and intellectual property are core to our architectural design:
• We do NOT use your private customer conversation logs, proprietary knowledge bases, or uploaded documents to train open public AI foundation models.
• AI agents process contextual data dynamically in memory using secure enterprise embeddings isolated by tenant Row-Level Security (RLS).
• Automated filters and PII scrubbing routines mask sensitive telephone numbers, payment card tokens, and government identifiers before long-term archiving.
Data Storage, Residency & Encryption
All Customer Data is stored in secure cloud regions with industry-standard cryptographic protection:
• Data in Transit: Enforced TLS 1.3 encryption across all API endpoints, webhooks, and dashboard sessions.
• Data at Rest: AES-256 database-level encryption across primary relational databases and vector storage engines.
• Tenant Isolation: PostgreSQL Row-Level Security (RLS) guarantees that workspace data is logically isolated and accessible only by authenticated members of your organization.
• Automated Backups: Daily encrypted backups retained in geo-redundant storage with 30-day retention cycles.
Third-Party Sub-Processors & Integrations
To provide real-time telephony, messaging, and cloud infrastructure, we partner with specialized, vetted sub-processors bound by strict Data Processing Addendums (DPAs):
• Meta WhatsApp Cloud API — direct message transmission, webhook delivery, and template management.
• Voice & Telephony Carriers (including licensed Indian telecom partners) — secure PSTN routing, SIP trunking, and high-fidelity bi-directional audio streaming.
• Speech Recognition & Synthesis Engines — ultra-low latency speech-to-text transcription and natural voice generation.
• Payment Gateways — PCI-DSS Level 1 compliant processors (Stripe, Razorpay) handling card authorization and subscriptions.
• Secure Cloud Hosting Providers — certified SOC 2 / ISO 27001 compliant cloud infrastructure and managed database clusters.
• CRM & MarTech Connectors — automated data syncing with your connected CRM (such as HubSpot, Salesforce, or Zoho) strictly upon your authorization.
Data Principal Rights under DPDPA 2023 & GDPR
Under the Digital Personal Data Protection Act, 2023 (DPDPA) and GDPR, Data Principals possess clear, enforceable statutory rights:
• Right to Access (DPDPA Section 11 / GDPR Article 15): Request a summary of personal data processed, underlying processing activities, and identities of third parties with whom data is shared.
• Right to Correction & Erasure (DPDPA Section 12 / GDPR Article 16 & 17): Correct inaccurate or misleading data, complete incomplete records, and request full erasure of data when the consented purpose is fulfilled.
• Right of Grievance Redressal (DPDPA Section 13): Readily accessible grievance redressal mechanism provided by BolixAI before escalating to the Data Protection Board of India.
• Right to Nominate (DPDPA Section 14): Right to nominate an individual who shall exercise data rights in event of death or incapacity.
• Right to Withdraw Consent (DPDPA Section 6(4)): You may withdraw your consent at any time as easily as giving consent, with processing halting immediately.
To exercise any of these statutory rights, email our Grievance Redressal Officer at privacy@bolixai.com. We acknowledge requests within 24 hours and resolve verified requests within thirty (30) days.
Protection of Children's Personal Data (DPDPA Section 9)
BolixAI services are strictly designed for businesses and individuals aged 18 and above. In accordance with Section 9 of the DPDPA 2023:
• We do not knowingly process personal data belonging to children (minors under 18 years of age) without verifiable parental consent.
• We do not engage in tracking, behavioral monitoring, or targeted advertising directed towards minors.
• If you believe a minor has provided personal data through our platform, contact privacy@bolixai.com immediately for prompt investigation and permanent erasure.
Data Retention & Erasure Schedule
We retain active workspace data for the duration of your active subscription. Following account cancellation, your data remains accessible for export for thirty (30) days.
After the 30-day post-cancellation grace period, all associated tenant database records, knowledge base embeddings, and voice transcripts are permanently purged from production databases and overwritten on backup rotations.
Security Safeguards & Breach Notification (DPDPA Section 8(6))
We enforce comprehensive organizational and technical security safeguards, including multi-factor authentication (MFA) for administrative staff, automated vulnerability scans, role-based access control (RBAC), and continuous monitoring.
In compliance with DPDPA 2023 and CERT-In guidelines, in the improbable event of a personal data breach affecting your data, BolixAI will notify the Data Protection Board of India (DPBI) and affected Data Principals promptly following verification.
Grievance Redressal Officer (DPDPA Section 13)
In accordance with the Digital Personal Data Protection Act, 2023, BolixAI has appointed a designated Grievance Redressal Officer:
Designation: Grievance Redressal Officer & Data Protection Officer
Entity: BolixAI Technologies Private Limited / BolixAI LLC
Email: grievance@bolixai.com / privacy@bolixai.com
Response Time: Acknowledgment within 24–48 hours; resolution within 30 days.
Statutory Escalation: If your grievance is not resolved satisfactorily, you hold the legal right to file a complaint before the Data Protection Board of India (DPBI).
Need a Data Processing Addendum (DPA)?
We provide standardized Data Processing Addendums (including Standard Contractual Clauses) for European and global enterprise customers.
Committed to Customer Trust
Have questions regarding data handling or security compliance? Our dedicated data protection team is here to assist.