Privacy Policy

1. Who this policy covers

Customers — businesses that create an AI Employee workspace; Team members — users invited into a workspace; and End users— people who interact with a customer's AI assistant via website chat, WhatsApp, Telegram, Facebook Messenger, Instagram, email, SMS, or voice calls. For end-user data processed inside a customer's workspace, the customer is the data controller and JEMIXO acts as a data processor on their instructions.

2. Information we collect

• Account data: name, email address, phone number, password (stored as a salted hash), company details, and billing information.
• Conversation data: messages exchanged with the AI assistant or human agents across connected channels, including attachments, call recordings/transcripts (where enabled), and satisfaction ratings.
• CRM data our customers store: contact names, emails, phone numbers, deals, notes, appointments, and custom fields.
• Usage & device data: log data, IP address, browser type, pages visited (for the visitor-tracking feature a customer enables on their own site), and product usage metrics.
• Integration data: tokens and content from services you choose to connect (Gmail, Outlook, Google Calendar, WhatsApp Business, Shopify, Telegram, Stripe, Razorpay, etc.). Integration credentials are encrypted at rest using AES-256-GCM.

3. How we use information

To provide and operate the Service (including generating AI replies, routing conversations, and analytics); to process payments and manage subscriptions; to secure the platform (fraud prevention, audit logs, rate limiting); to provide support; to send service notifications; and to improve the product. We do not sell personal data.

4. AI processing & sub-processors

To generate AI responses, relevant conversation content and knowledge-base text is processed by large language model providers — OpenAI, Google (Gemini), and/or Anthropic (Claude) — strictly to produce the reply. Other sub-processors include payment gateways (Razorpay, Stripe), communication providers (Meta WhatsApp Cloud API, Telegram, Twilio), email providers (Resend/SMTP, Google, Microsoft), cloud hosting/storage, and error monitoring (Sentry). Each processes only what is necessary for its function.

5. Legal bases

We process data to perform our contract with you, to comply with legal obligations, for our legitimate interests (security, product improvement), and with consent where required (e.g. marketing communications, non-essential cookies). Indian users: we comply with the Digital Personal Data Protection Act, 2023 (DPDP); EEA/UK users: we comply with the GDPR.

6. Data retention & deletion

Data is retained while your account is active. When a workspace is deleted, its data is permanently purged within 30 days. Audit logs are kept for 90 days and read notifications for 30 days. Customers can raise data-subject requests (export, erasure, consent updates) through the in-product GDPR portal; export and erasure requests are fulfilled automatically.

7. Security

We use industry-standard safeguards: TLS encryption in transit, AES-256-GCM encryption for stored integration credentials, hashed passwords (bcrypt), tenant-level data isolation, role-based access control, two-factor authentication, webhook signature verification, rate limiting, and audit logging. No method of transmission or storage is 100% secure, but we work to protect your data using commercially reasonable measures.

8. Your rights

Subject to applicable law, you may access, correct, export, or delete your personal data, object to or restrict processing, and withdraw consent. Workspace admins can use the built-in tools (Profile, GDPR portal, account backup/export); anyone can contact us directly at the address below. You may also lodge a complaint with your local data-protection authority.

9. Cookies

We use essential cookies/local storage for authentication and preferences. Optional categories can be managed on our Cookie Preferencespage. The embeddable chat widget stores a session token in the end user's browser so their conversation can resume.

10. Children

The Service is not directed to children under 18, and we do not knowingly collect their data.

11. Changes & contact

We may update this policy and will post the revised version here with a new "Last updated" date. Questions or requests: JEMIXO TECHNOLOGIES PRIVATE LIMITED — see our Contact page, or email dpo@aiemployee.com.