Privacy Policy

1. Introduction

Xpecto® IT Solutions, operating the Xpecto® AI ChatBot platform at aichatbot.xpectoai.com ("Company", "we", "us", "our"), is committed to protecting the privacy of individuals and business customers ("Customer", "you", "your") who use our AI chatbot, automation, and related services (collectively, the "Services"). This Privacy Policy explains what information we collect, how we use, share, and protect it, and the choices and rights available to you, including with respect to marketing, product-update, one-time-password ("OTP") and partner communications.

This Policy applies to visitors of our website, prospects, registered account holders, authorized users within a Customer's organization, and, where applicable, the end users who interact with chatbots deployed by our Customers ("End Users"). It should be read together with our Terms of Service and Cookie Policy.

2. Information We Collect

2.1 Information You Provide

• Account & Contact Data: name, work email, phone number, job title, company name, and password/authentication credentials.
• Billing Data: billing address, tax/GST identifiers, and payment details (processed by our PCI-DSS compliant payment processor; we do not store full card numbers).
• Business/Training Content: documents, URLs, FAQs, product catalogs, CRM exports, and other content you upload to configure or train your chatbot.
• Communication Preferences & Consents: the choices you make regarding marketing, product-update, and partner-communication opt-ins, including checkbox selections captured at signup.
• Support Content: information you provide when contacting support, including call/chat transcripts.

2.2 Information Collected Automatically

• Usage Data: chatbot conversation logs, queries, click paths, feature usage, session duration, and configuration changes.
• Technical Data: IP address, device/browser type, operating system, referring URLs, and approximate location derived from IP.
• Cookies & Similar Technologies: as described in our Cookie Policy, used for authentication, preferences, analytics, and (where consented) marketing attribution.

2.3 Information From Third Parties

• Identity/SSO providers (e.g., Google, Microsoft) when you choose social or single sign-on login.
• Payment processors, confirming successful transactions and subscription status.
• Integration partners you connect (e.g., CRM, helpdesk, WhatsApp Business API, e-commerce platforms), limited to the data needed to operate the integration you authorize.

3. How We Use Your Information

We use personal information for the following purposes:

• Service Delivery: to create and administer your account, provision your chatbot, and provide technical support.
• AI Configuration & Improvement: to train, fine-tune, and improve the chatbot instance using the business content you supply, and, in de-identified/aggregated form, to improve our underlying models and product features.
• Transactional & Account Communications (Required): to send OTPs, login/security alerts, invoices, subscription and renewal notices, service outage notices, and responses to support requests. These are necessary for the Services and are not subject to marketing opt-out.
• Product Update Communications: to notify you of new features, changelog updates, maintenance windows, and policy changes relevant to your use of the Services.
• Marketing Communications (Opt-in): to send newsletters, case studies, webinar invitations, promotional offers, and re-engagement emails, only where you have given affirmative consent.
• Partner & Third-Party Offers (Separate Opt-in): to share limited contact information with select technology or business partners so they may market complementary products to you, only where you have given separate, specific consent for this category.
• Analytics & Product Development: to understand usage patterns, benchmark performance, and prioritize our roadmap, generally using aggregated or pseudonymized data.
• Legal & Security Compliance: to detect fraud, enforce our Terms of Service, and comply with applicable law, regulation, or lawful government request.

4. Legal Basis for Processing

Where the GDPR, UK GDPR, or India's Digital Personal Data Protection Act, 2023 ('DPDP Act') applies, we rely on the following legal bases:

• Contractual necessity — account provisioning, OTP/security messages, billing, and core Service delivery.
• Consent — marketing communications, partner communications, and non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of prior processing.
• Legitimate interests — product-update notices to active accounts, fraud prevention, and service analytics, balanced against your rights and expectations.
• Legal obligation — tax, accounting, and regulatory record-keeping.

5. Marketing, Product-Update, OTP & Partner Communications

5.1 Categories of Communications

5.2 Consent Capture at Signup

At account creation, we present two distinct, separately actionable checkboxes, in addition to the mandatory acceptance of our Terms of Service and this Privacy Policy:

• Checkbox 1 (Mandatory): "I agree to the Terms of Service and Privacy Policy" — required to create an account; not a marketing consent.
• Checkbox 2 (Optional, unchecked by default): "I would like to receive product updates, tips, and marketing communications from Xpecto AI."
• Checkbox 3 (Optional, unchecked by default): "I would like to receive relevant offers from Xpecto AI's trusted partners."

We do not bundle marketing or partner consent with the mandatory Terms/Privacy checkbox, and marketing checkboxes are never pre-ticked, consistent with GDPR, PECR, India's DPDP Act, and CAN-SPAM/CASL requirements for affirmative, freely-given, and granular consent.

5.3 Consent Records

For each consent given or withdrawn, we log: the account/email identifier, the exact checkbox text presented, a timestamp, the version of this Policy in effect, and the IP address of the request, to demonstrate compliance on request by a regulator or the individual.

5.4 Opting Out

You may withdraw marketing or partner consent at any time by: (i) clicking "unsubscribe" in any marketing email; (ii) updating your preferences in Account Settings → Communication Preferences; or (iii) emailing [email protected]. Opt-outs are processed within 10 business days. Transactional and OTP messages cannot be opted out of while your account remains active, as they are required to deliver the Service securely.

6. Cookies & Tracking Technologies

We use strictly necessary, functional, analytics, and (subject to consent) marketing/advertising cookies. You can manage preferences via our cookie banner or browser settings. See our separate Cookie Policy for details on providers, purposes, and retention periods.

7. How We Share Information

• Service Providers/Sub-processors: cloud hosting, email delivery, SMS/OTP gateways, payment processing, analytics, and customer support tooling, bound by written data-processing agreements.
• Integration Partners you connect (e.g., WhatsApp Business API, CRM), limited to data necessary for that integration.
• Marketing/Offer Partners, only for individuals who gave separate opt-in consent under Section 5, and never including your business's proprietary training content.
• Corporate Transactions: in connection with a merger, acquisition, or asset sale, subject to continued protection under an equivalent policy.
• Legal & Safety: where required to comply with law, enforce our agreements, or protect rights, property, or safety.

We do not sell personal information for monetary consideration. Where "sharing" for cross-context behavioral advertising is regulated (e.g., under the CCPA/CPRA), we only do so with your opt-in consent and you may opt out at any time.

8. International Data Transfers

Where we transfer personal data across borders (for example, from the EEA/UK to India or the United States), we rely on adequacy decisions, Standard Contractual Clauses, or other lawful transfer mechanisms, and apply comparable technical and organizational safeguards regardless of location.

9. Data Security

We use encryption in transit (TLS 1.2+) and at rest, role-based access controls, network segmentation, logging/monitoring, and periodic security assessments. Customer business/training data is logically isolated per account. No system is completely secure; we notify affected Customers and, where legally required, regulators and individuals, without undue delay following a confirmed personal-data breach.

10. Data Retention

• Account & billing data: retained for the life of the account plus the period required by tax/accounting law (typically up to 7 years).
• Conversation/usage logs: retained per your subscription plan's configured retention window, or 24 months by default.
• Marketing consent records: retained for as long as consent is active, plus a compliance record kept after withdrawal to evidence the opt-out.
• You may request earlier deletion, subject to legal retention obligations.

11. Your Rights

Depending on your location, you may have the right to: access a copy of your personal data; correct inaccurate data; request deletion ("right to be forgotten"); restrict or object to certain processing; receive your data in a portable format; withdraw consent at any time; and lodge a complaint with your local data protection authority.

11.1 EEA / UK (GDPR / UK GDPR)

Rights of access, rectification, erasure, restriction, portability, and objection under Articles 15–21 GDPR apply. You may contact our EU/UK representative or your supervisory authority.

11.2 California (CCPA/CPRA)

California residents may request to know, delete, or correct personal information, and to opt out of "sale" or "sharing." We do not discriminate against you for exercising these rights.

11.3 India (DPDP Act, 2023)

As Data Principals, Indian users may access, correct, update, and erase personal data, withdraw consent, and nominate another individual to exercise rights on their behalf in the event of death or incapacity. Our Grievance/Consent Manager contact is provided in Section 14.

To exercise any right, email [email protected]. We may need to verify your identity before actioning a request, and will respond within the timeframe required by applicable law.

12. Children's Privacy

Our Services are not directed to individuals under 18. We do not knowingly collect personal information from children. If we learn we have inadvertently done so, we will delete it promptly.

13. AI Model Training & Automated Decision-Making

Your business content is used to configure and operate your own chatbot instance. We do not use one Customer's proprietary business content to train another Customer's chatbot. Where aggregated or de-identified interaction data is used to improve our general-purpose models, it is stripped of direct identifiers first. Our Services do not make decisions producing legal or similarly significant effects about End Users without human oversight, unless expressly configured and disclosed by the Customer deploying the chatbot.

14. Grievance Officer / Data Protection Contact

In accordance with applicable law, including India's Information Technology Act, 2000 and the DPDP Act, 2023, we have designated a Grievance Officer / Consent Manager contact for privacy-related queries and complaints:
Email: [email protected]
Postal address: Xpecto® IT Solutions, [Insert Registered Office Address]

We aim to acknowledge grievances within 48 hours and resolve them within the timeframe prescribed by applicable law.

15. Changes to This Policy

We may update this Policy from time to time. Material changes will be notified via email or an in-product notice at least 15 days before taking effect, and the "Last updated" date above will be revised. Continued use of the Services after the effective date constitutes acceptance of the revised Policy.

16. Contact Us

Questions about this Privacy Policy or our data practices:
Email: [email protected]
Website: www.xpectoitsolutions.com
Product: Xpecto® AI ChatBot (aichatbot.xpectoai.com)