Privacy Policy

Our role, in short

For information you give us directly — on this website, as a VixSync account holder, or as a client — we decide how it is used, so we are its data fiduciary under India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”). For the personal data a business stores in VixSync about its customers (their chats, WhatsApp messages, contact details), that business is the data fiduciary and we are its data processor: we handle that data only on the business’s instructions, under our Data Processing Agreement.

What we collect

• Enquiries and newsletter — when you contact us, book a demo, or subscribe, the details you provide: name, company, email, phone number, and your message.
• The chat assistant on this site — runs on VixSync. It receives the messages you type or say and any contact details you choose to share, so it can answer and, if you ask, pass you to our team. It stores a random conversation ID in your browser’s local storage so the chat continues across pages.
• VixSync accounts — your name, email, password (stored only as a salted hash), the workspace you belong to, and sign-in records (time, IP address, browser) used to keep your account secure.
• Billing — business name, GST number and billing address for invoices. Card and bank details are entered with our payment partner and never reach us.
• Technical data — our servers record the IP address, browser and page of each form submission and sign-in to stop spam and abuse. This website uses no advertising or analytics cookies and no third-party trackers.

Facebook, Instagram, Messenger, and WhatsApp

If you message us or connect with us through Meta products, we receive the information those platforms share with us: your name, profile or account identifier, phone number where applicable, and the messages you send. We use it only to reply to you and provide the service you asked for. We do not sell it or use it for advertising, and we handle it in line with Meta’s Platform Terms.

VixSync and Facebook Pages

VixSync is a product of VixScale Technologies. A business that uses VixSync can connect a Facebook Page it manages so its team can answer Messenger messages from the VixSync inbox. When a business does that, VixSync receives the following through Meta’s APIs:

• The Facebook account that connects — its name and Facebook ID, and the list of permissions it granted, so the business can see who connected its Pages.
• Pages and businesses — the name, ID, category, and profile picture of the Facebook Pages that person manages, and the name and ID of the Meta Business portfolio that owns each Page, so they can choose which Page to connect.
• Messenger conversations — for a connected Page only: the messages people send to that Page, the sender’s name and page-scoped ID, and the replies the business’s team sends from VixSync.
• Access tokens — issued by Facebook when the person signs in. They are stored encrypted and are never shown to anyone.

We use this data only to provide that service to the business: listing its Pages, delivering incoming messages to its inbox, and sending the replies its team writes. VixSync does not publish posts on a Page and does not message anyone who has not written to the Page first. We do not sell this data, do not use it for advertising or profiling, and do not share it with third parties other than the hosting and database providers that run VixSync on our behalf. We handle it in line with Meta’s Platform Terms and Developer Policies.

A business can disconnect a Page or its Facebook account inside VixSync at any time, or remove the app in Facebook under Settings & privacy → Settings → Apps and websites. In both cases VixSync stops receiving messages for those Pages and deletes its access tokens. Conversations already received stay in that business’s VixSync workspace until the business deletes them or asks us to. If you messaged a business’s Page and want your messages deleted, you can ask that business or write to us.

VixSync and Google Calendar

A business that uses VixSync can connect its Google Calendar so its customers can book meetings through the business’s assistant (on its website or WhatsApp), and VixScale uses its own Google Calendar for calls its clients book with us. When a Google account is connected, VixSync receives the following through Google’s APIs:

• The connected account’s email address — so the business can see which calendar is connected.
• Free and busy times — only the start and end of busy periods on the primary calendar, read when someone looks for a time, so meetings are never offered when the business is busy. VixSync does not read the title, description, guests or any other content of existing events, and does not store busy times.
• Meetings it books — when someone books, VixSync creates that one event on the connected calendar with a Google Meet link and invites the person who booked (Google emails the invite). It keeps the event’s ID and Meet link with the booking, and deletes the event if the booking is cancelled. It does not change or delete any other event.
• Access tokens — issued by Google when the account is connected. They are stored encrypted and are never shown to anyone.

We use this data only to schedule and manage the bookings made through VixSync for that business. We do not sell it, do not use it for advertising, profiling or to train AI models, do not let anyone read it except as needed for security, legal compliance or with the business’s permission, and do not share it with third parties other than the hosting and database providers that run VixSync on our behalf.

VixScale Technologies’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

A business can disconnect Google Calendar inside VixSync at any time (AI actions → Booking), or remove VixScale’s access in its Google Account under Security → Third-party apps & services. VixSync then revokes and deletes its access tokens and stops reading or creating events; meetings already booked stay in the calendar until the business deletes them.

WhatsApp, email and calls sent through VixSync

Businesses use VixSync to message their own customers on WhatsApp and by email, and to answer calls. A business may only send WhatsApp messages it starts to people who agreed to hear from it, using templates Meta has approved, and must stop when someone opts out — VixSync blocks sends to contacts who opted out. Every marketing email carries an unsubscribe link. Calls handled by the phone assistant may be recorded when the business turns recording on; recordings are deleted after 90 days.

AI processing

VixSync’s assistants use third-party AI services to write replies from the business’s own knowledge base. Only the text or audio needed for the reply in progress is sent. Under our agreements with these providers, data sent through their paid APIs is not used to train their models, and we do not use one business’s data to train or answer for another. A person can always ask to talk to a human, and the business’s team can take over any conversation.

How we use it

To respond to your enquiry, provide and secure the services you signed up for, bill for them, meet legal obligations, and — only if you subscribed — send occasional updates. We rely on your consent where we ask for it, and otherwise on the purposes the DPDP Act allows, such as information you give us voluntarily for a specific purpose. We do not sell personal data, do not use it for advertising, and do not build profiles of people.

Who we share it with

Only the service providers that run our services for us, under contracts that bind them to protect it, and authorities where the law requires it. VixScale staff can see the conversations, contacts and messages in a client’s VixSync workspace only when that client approves the request, except to stop a security incident or abuse, which the client is told about straight away.

Where it is stored

VixSync data is stored in India. Some providers, such as AI and messaging services, may process data outside India for the request in progress. We transfer data only to countries the Government of India has not restricted under the DPDP Act.

How long we keep it

How we protect it

Encryption in transit and at rest, separate encryption for connected-account credentials, strict separation between workspaces, two-step sign-in, rate limits, and a log of every sensitive action that each business can see. The details are on our Security page. If a breach affects your personal data, we will tell you and the Data Protection Board of India without delay, as the DPDP Act requires.

Your rights

• Get a summary of the personal data we hold about you and how we use it.
• Have it corrected, completed or updated.
• Have it deleted, unless the law requires us to keep it.
• Withdraw consent at any time, as easily as you gave it — for example with the unsubscribe link in any email or by replying STOP on WhatsApp. Withdrawal doesn’t affect what was done before it.
• Nominate someone to exercise these rights if you die or become unable to.
• Complain to our Grievance Officer, and then to the Data Protection Board of India.

VixSync account holders can export their workspace data and close their account themselves in Account settings. If your data is in a business’s VixSync workspace, ask that business first; we will help it respond. See Data Deletion for the steps.

Children

Our services are for businesses and are not meant for anyone under 18. We do not knowingly collect children’s data; if you believe a child has given us data, write to us and we will delete it.

Changes to this policy

When we change this policy we update the date above, and for significant changes we email VixSync account holders before they take effect.