This Privacy Policy explains how Vaixus Technologies collects, uses, shares, and protects personal data — both yours as a Client and that of your End Users processed through our AI Systems. We are committed to full compliance with India's Digital Personal Data Protection Act, 2023 (DPDP Act) and all applicable data protection laws.
Vaixus Technologies is a sole proprietorship owned and operated by Soorya S V, based in Tiruppur, Tamil Nadu, India. For the purposes of data protection law:
Contact: For all data protection matters, contact us at soorya@vaixus.in. See Section 17 for our designated Grievance Officer details.
When you sign up, onboard, or use Vaixus Services as a business client, we collect the following categories of personal and business data:
| Category | Data Collected | When Collected |
|---|---|---|
| Identity | Full name, business name, role/designation | Enquiry / onboarding |
| Contact | WhatsApp number, email address, business phone | Enquiry / onboarding |
| Location | Business address, city, state, PIN code | Onboarding / invoicing |
| Financial | GST number, payment transaction IDs (no card data stored) | Invoicing / payment |
| Business Data | Products, pricing, FAQs, policies, workflows you provide for AI training | Onboarding / ongoing updates |
| Communication | WhatsApp messages and emails exchanged with Vaixus support | Ongoing support |
| Usage / Technical | Dashboard login activity, feature usage, device/browser info | Service use |
We do not collect your Aadhaar number, PAN, or other government-issued identity documents unless specifically required for GST invoicing purposes, in which case only the minimum necessary information is collected.
When your customers interact with an AI System deployed by Vaixus on your behalf, the following End User data may be processed. We process this data as a Data Processor on your behalf — you as the Client are the Data Fiduciary responsible for obtaining lawful consent from your End Users.
| Data Type | Purpose | Stored? |
|---|---|---|
| Name | Lead capture / order processing | Yes — in your dashboard |
| WhatsApp number / phone | Customer identification / order follow-up | Yes — in your dashboard |
| Email address | Lead capture (Website AI, if collected) | Yes — in your dashboard |
| Delivery address | Order fulfilment (WhatsApp AI) | Yes — in order records |
| Conversation content | AI response generation, performance monitoring | Yes — 90-day rolling window |
| Interaction metadata | Timestamps, message counts, session data | Yes — for analytics reports |
| Language preference | Multilingual response selection | Session only |
| Uploaded files | Document-based queries (Professional+) | Temporary — deleted after processing |
When you visit our website at vaixus.in, we may collect:
We do not use persistent tracking technologies, behavioural advertising cookies, or cross-site tracking on vaixus.in.
Under India's Digital Personal Data Protection Act, 2023 (DPDP Act) and applicable law, we rely on the following lawful bases for processing personal data:
| Processing Activity | Legal Basis |
|---|---|
| Client account setup and service delivery | Performance of Contract (Terms of Service) |
| Payment processing and GST invoicing | Legal obligation / Performance of Contract |
| Sending service-related communications (reports, alerts) | Performance of Contract / Legitimate Interest |
| Processing End User data through AI Systems | Instructions from Client (Data Fiduciary) / Client's End User consent |
| Website analytics (aggregate, non-identifiable) | Legitimate Interest |
| Contact form enquiries | Pre-contractual steps / Consent |
| Responding to legal / regulatory requests | Legal Obligation |
| Service improvement using anonymised data | Legitimate Interest |
We do not sell personal data. We do not process personal data for advertising profiling. We process only what is necessary for the specified purpose (data minimisation principle).
Vaixus does not sell, rent, or trade personal data. We share data only in the following limited circumstances:
| Recipient | Data Shared | Purpose | Safeguards |
|---|---|---|---|
| Meta Platforms (WhatsApp) | Messages sent/received via WhatsApp AI | Message delivery infrastructure | Meta's Data Processing Terms; messages encrypted in transit |
| Razorpay | Transaction amount, Client name, invoice reference | Payment processing | RBI-compliant; PCI DSS certified; Razorpay Privacy Policy |
| Cloud Hosting Provider | All stored data (encrypted) | Infrastructure hosting & database | Encrypted at rest and in transit; access controls; DPA in place |
| Cloudflare (Professional+) | IP addresses, request metadata | Bot protection, DDoS mitigation | Cloudflare's Privacy Policy; data processed transiently |
| Legal / Government Authorities | As required by court order or law | Legal compliance | Only as required; Client notified where legally permissible |
We do not transfer your data to any country outside India except as technically necessary for the cloud infrastructure and WhatsApp/Meta's global operations. Where international transfers occur, appropriate contractual safeguards are in place. See Section 13 for more detail.
We retain data only for as long as necessary for the purposes described in this Policy:
| Data Type | Retention Period | Basis |
|---|---|---|
| Client account data (name, contact, business info) | Duration of subscription + 3 years post-termination | Legal obligation (GST records), legitimate interest |
| GST invoices and payment records | 7 years from invoice date | Income Tax Act / GST law requirement |
| End User conversation logs | 90 days rolling (active subscription) | Legitimate interest (contextual AI responses) |
| End User lead records (name, phone, email) | Duration of Client subscription + 30 days post-termination | Client's instruction (Data Fiduciary) |
| All Client Data post-termination | 30 days from termination, then permanently deleted | Client data export window |
| Website contact form submissions | 12 months from submission, or until actioned | Legitimate interest (sales / support) |
| Website analytics data (aggregate) | 24 months | Legitimate interest (site improvement) |
| Security logs | 12 months | Legitimate interest (security monitoring) |
Where data is retained for legal compliance purposes, it will be processed only for that compliance purpose and not for any other purpose. At the end of the retention period, data is permanently and securely deleted or anonymised.
Vaixus implements a comprehensive set of technical and organisational security measures to protect personal data from unauthorised access, disclosure, alteration, or destruction:
Despite our efforts, no transmission or storage system can be guaranteed 100% secure. We cannot guarantee absolute security of personal data. In the event of a data breach, we will follow the procedure in Section 15.
Under the DPDP Act, 2023, and applicable Indian data protection law, you have the following rights regarding your personal data processed by Vaixus as Data Fiduciary:
To exercise any of the above rights, email our Grievance Officer at soorya@vaixus.in with the subject line "Data Rights Request". Include: your full name, contact information, the right you wish to exercise, and sufficient detail to identify the data concerned. We will respond within 30 days of receiving a verified request. We may need to verify your identity before processing the request.
We may decline to act on a rights request where: the request is manifestly unfounded or excessive; fulfilling it would conflict with a legal obligation; or the data is required to defend or establish legal claims. We will explain the reason for any refusal.
Vaixus Services are intended for use by business owners and their customers who are at least 18 years of age. We do not knowingly collect personal data from individuals under the age of 18.
If you believe that a minor under 18 has provided personal data to us or through an AI System you operate, please notify us immediately at soorya@vaixus.in and we will take steps to delete such data promptly.
If you operate a business that serves customers who may be minors (e.g., coaching institutes, schools), you as the Client (Data Fiduciary) are responsible for obtaining appropriate parental consent before allowing minors to interact with your Vaixus-powered AI System and for complying with applicable laws protecting minors' personal data.
| Cookie Type | Purpose | Duration |
|---|---|---|
| Strictly Necessary | Session management, security (CSRF protection), form token | Session (deleted on browser close) |
| Functional | Remember your tab preferences (e.g., WhatsApp AI vs Website AI pricing tab) | 30 days |
| Analytics (anonymised) | Page view counting, aggregate traffic analysis (no personal identifier) | 90 days |
You can control and delete cookies through your browser settings. Disabling strictly necessary cookies may affect the functionality of vaixus.in. Our website is designed to function with minimal cookie dependency.
Vaixus is an Indian business and primarily processes data within India. However, due to the nature of our technology infrastructure, some data may be processed outside India in the following limited circumstances:
Any international transfer of personal data is conducted with appropriate contractual safeguards consistent with the DPDP Act, 2023 and applicable Indian law. We will update this section if the Indian government publishes specific cross-border transfer rules under the DPDP Act.
Every Vaixus AI System is trained and configured exclusively using the data provided by that specific Client. We do not use one Client's business data, products, pricing, or customer conversations to train or improve AI Systems for any other Client. Each Client's data is isolated and processed in a dedicated configuration.
Conversation logs between End Users and AI Systems may be reviewed by Vaixus personnel for the following limited purposes: debugging errors or incorrect AI responses; improving AI response quality for that specific Client; generating anonymised performance analytics; and responding to Client support requests. All access is logged and limited to authorised personnel.
We strongly advise Clients not to configure their AI Systems to collect or process sensitive personal data such as health diagnoses, financial account numbers, government identity numbers, passwords, biometric data, or information concerning a person's religious beliefs, political opinions, or sexual orientation. Vaixus AI Systems are not designed or secured for sensitive personal data processing, and Clients are solely responsible for compliance if they choose to process such data.
Vaixus AI Systems make automated responses to customer queries. These automated responses are not used to make significant decisions about individuals (such as credit scoring, employment, or healthcare diagnosis). AI Systems produce informational responses and sales assistance only. Significant decisions based on AI interaction outputs remain the sole responsibility of the Client.
Vaixus may use anonymised and aggregated performance data (e.g., average response accuracy rates, common question types across industries — with no personally identifiable information) to improve our overall AI platform and develop new features. No individual Client's identifiable business data or End User personal data is used for this purpose.
Despite robust security measures, in the event of a personal data breach, Vaixus will:
We may update this Privacy Policy from time to time to reflect changes in our data practices, services, or applicable law. For material changes affecting your rights, we will provide at least 14 days' prior notice via email or WhatsApp to active Clients. For minor clarifications or non-material changes, we will update this page with a revised "Last Updated" date.
We encourage you to review this Policy periodically. Your continued use of Vaixus Services following any update constitutes acceptance of the revised Policy.
In accordance with the Information Technology Act, 2000 and the DPDP Act, 2023, Vaixus has designated a Grievance Officer for data protection matters:
If you are not satisfied with our response, you have the right to escalate your complaint to the Data Protection Board of India (once constituted under the DPDP Act, 2023) or to seek redress through the Consumer Protection Act, 2019 mechanisms available to you.