Privacy Policy

1. What we collect

Account data

Your name, work email, username, organisation name, role and password hash. We never store your password in readable form.

Customer content

The call recordings, transcripts, quality parameters and SOPs you upload, and the audits generated from them — including transcripts, translations, scores, evidence quotations, sentiment analysis and coaching notes.

Usage and billing data

Credit balance and deductions, audit counts, processing times, AI token usage, payment records and invoices. We also keep standard server logs such as IP address, browser type and timestamps for security and debugging.

2. How we use it

• To run audits and deliver results to your workspace.
• To meter credits and process payments.
• To secure the service, investigate abuse and diagnose faults.
• To send transactional email — verification, password reset, receipts and low-balance alerts.

We do not sell your data, and we do not use your call content to train our own models.

3. Sub-processors and where your data is stored

Delivering the service requires sharing data with the following providers:

• Google Cloud Platform— our application servers, database and the recordings, transcripts and audits you upload are hosted in Google Cloud's Mumbai region (asia-south1), in India. Your workspace data is stored in India and is not moved out of the country in the ordinary course of running the service.
• Google (Gemini API)— call audio and transcripts are sent to Google's generative AI service to produce transcription, translation, scoring and analysis. This is the core of the product: audits cannot be produced without it. This processing is carried out by Google under its own terms, and depending on Google's routing the request may be handled outside your storage region.
• Razorpay — payment processing for credit purchases. Card details are handled by Razorpay and never reach our servers.
• Email delivery — a third-party SMTP provider sends transactional messages (verification, receipts, alerts).

We enter into data-processing terms with these providers and share only what each needs to perform its function. On request we can provide our sub-processor list for a Data Processing Agreement.

4. Personal information in transcripts

Calls frequently contain personal information. As each transcript is produced, the system is instructed to mask identifiers including phone numbers, postal addresses, email addresses, card numbers, CVV and expiry, bank account numbers, Aadhaar, PAN, UPI IDs, IFSC codes, dates of birth, OTPs and passwords. Speaker names are deliberately left readable so audits remain usable.

This masking is best-effort and is not a guarantee. It is performed by the AI model during transcription rather than by a deterministic redaction pass, so it can miss identifiers or mask imperfectly. If you operate under a strict regulatory regime, evaluate it against your own requirements before relying on it, and avoid uploading content you cannot risk being retained in readable form.

5. Retention

Customer content — recordings, transcripts and the audits derived from them — is retained for as long as your workspace is active, so that historical audits stay available for trend analysis and coaching. You can request deletion of specific audits, or of your whole workspace, at any time by contacting us, and we will action it.

Billing and tax records are kept for as long as Indian tax and accounting law requires.

6. Cookies and local storage

We use only what the application needs to function — we do not run third-party advertising or cross-site tracking cookies.

• Authentication— a session cookie and a token in your browser's local storage keep you signed in. Without these you cannot use the application.
• Preferences — your light/dark theme choice is stored locally in your browser.

Because these are strictly necessary for the service, they are not used for profiling. Blocking them will prevent sign-in from working.

7. Security

• Traffic is encrypted in transit over HTTPS.
• Each tenant's data is isolated, and access is enforced by role-based permissions on every request.
• Passwords are stored only as salted hashes.
• Payment card data is handled entirely by our payment provider.

No system is perfectly secure. If we become aware of a breach affecting your data, we will notify you and the relevant authority as required by law, without undue delay.

8. Your rights

Subject to applicable law, including India's Digital Personal Data Protection Act, 2023, you may request access to, correction of, or deletion of your personal data, and may withdraw consent where processing rests on it. Because we process call content on your instructions, requests from people recorded on your calls should be directed to you as the controller; we will assist you in responding.

To exercise a right, email support@qxai.in.

9. Children

QXAI is a business tool and is not directed at children. It is intended for use by people aged 18 or over acting for an organisation, and we do not knowingly collect personal data from children. Do not upload recordings of children without the consent their protection requires under applicable law.

10. Grievance Officer

In accordance with India's Information Technology Act and the Digital Personal Data Protection Act, 2023, you may raise any privacy concern or grievance with our Grievance Officer:

We acknowledge grievances within 24 hours and aim to resolve them within the period required by law.

11. Changes

We will post updates to this policy here and, where the change is material, notify you directly.

12. Contact