Privacy policy

1. Our two roles

• Processor for our clients' data. Businesses ("clients") use the platform to talk to their customers, leads, callers and prospects and to handle their documents. For that data the client is the data fiduciary / controller / business and we are its data processor / processor / service provider under the Data processing agreement. If you are a customer of one of our clients, contact that business first (its privacy page is linked from its chat, forms and messages); we help it answer you. This policy explains our part.
• Controller for our own data. For people who sign in to the platform, billing contacts, partners, people who contact us and visitors to originpixel.in and the public demo, Origin Pixel is the data fiduciary / controller.

2. What we collect as controller

We use only necessary cookies and similar storage (see the Cookie policy). We do not use advertising trackers or sell personal data, and we do not use client data to train AI models.

3. What the platform holds for clients (as processor)

Depending on the products a client switches on: contacts and leads; chat, WhatsApp, Instagram, Messenger, Telegram, SMS and email conversations; bookings; call records, transcripts, summaries and recordings where enabled; tickets, surveys and reviews; B2B prospect data with the lawful basis the client records; documents and fields read from them (invoices, bank statements, KYC files, with Aadhaar numbers masked); content and brand assets; knowledge base files; usage counters and audit logs. Details per product are in the DPA Annex I.

4. Purposes and legal grounds

In India we rely on consent or a legitimate use listed in section 7 of the DPDP Act, not on a general "legitimate interests" ground. Where we rely on consent you can withdraw it as easily as you gave it, in the app or by writing to us; withdrawal does not affect earlier processing.

5. Where data is stored and transfers

• The database and file storage are on Supabase in Mumbai, India (ap-south-1); the application runs on our server in India.
• Some sub-processors process data outside India, mainly in the United States and the EU (for example AI, speech, email and monitoring providers). The full list with locations and safeguards is on the Subprocessors page.
• Transfers from India follow section 16 of the DPDP Act (no transfers to countries the Government restricts). Transfers of EU / UK / Swiss data rely on the EU Standard Contractual Clauses, the UK International Data Transfer Addendum and the Swiss amendments, with transfer impact assessments; for the UAE free zones, Brazil and Saudi Arabia we use their standard clauses (see DPA Annex IV).
• Clients can choose an India-only processing option that limits AI and speech processing to providers in India where available.

6. Who receives data

Our sub-processors (listed with purpose, data, location and safeguards on the Subprocessors page, with 30 days' notice of changes); services a client connects itself (they act for the client); professional advisers; and authorities when the law requires it (we check each request and tell the client where allowed).

7. How long we keep data

• Account data: while the account is active, then up to [1 year] for security and disputes.
• Security and access logs: 365 days (DPDP Rules and CERT-In require at least 1 year and 180 days).
• Billing and tax records: 8 years. Records of privacy requests: 24 months.
• Client data: as the client sets it in its retention settings; after the account ends, [30] days for export, then deletion within [30] days. Encrypted backups roll over within about 8 weeks, and deletions are re-applied if a backup is ever restored.
• Marketing consent and opt-outs: kept as long as needed to honour them.

8. Security

Tenant isolation with row-level security, encryption in transit and at rest, field-level encryption for sensitive fields, access control and audit logs. Details are on the Security overview. If a breach affects your personal data we inform you and the authorities as the law requires (Data Protection Board of India, CERT-In within 6 hours, EU / UK supervisory authorities within 72 hours).

9. Your rights

India (DPDP Act 2023 and Rules 2025): a summary of your personal data and the processing; the identities of others we shared it with; correction, completion, updating and erasure; withdrawal of consent; nomination of a person to act for you if you die or are unable to; and grievance redressal. If you are not satisfied with our answer, you can complain to the Data Protection Board of India. Notices are available in English and, on request, in any language in the Eighth Schedule to the Constitution [counsel: confirm translation process].

EU / EEA and UK (GDPR, UK GDPR, Data (Use and Access) Act 2025): access, rectification, erasure, restriction, portability, objection (including to direct marketing at any time), and not to be subject to solely automated decisions with legal or similar effects. You can complain to your supervisory authority (UK: the ICO). EU representative: [to be appointed under Art. 27]. UK representative: [to be appointed].

United States (California CCPA / CPRA and the laws of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island, Nebraska and others): to know and access, correct, delete, and opt out of sale, sharing for cross-context behavioural advertising, targeted advertising and profiling. We do not sell or share personal information and we do not use it for targeted advertising. We honour Global Privacy Control signals as an opt-out. We use sensitive personal information only to provide the service. You may use an authorised agent. If we decline your request, you can appeal by replying to our decision; if the appeal is denied you may contact your state Attorney General. We will not discriminate against you for using your rights.

California notice at collection: the categories we collect are identifiers, customer records, commercial information (plan and payments), internet activity (security logs), and professional information, for the purposes in section 4, kept for the periods in section 7. In the last 12 months we did not sell or share personal information.

UAE (Federal Decree-Law 45/2021, DIFC Data Protection Law 2020, ADGM Regulations 2021), Saudi Arabia (PDPL), Brazil (LGPD), Singapore (PDPA), Australia (Privacy Act 1988), Canada (PIPEDA and Quebec Law 25): you have rights of access, correction, deletion and objection or withdrawal of consent as provided by your local law, and you may complain to your regulator. Brazil: our data protection contact (encarregado) is [name], grievance@originpixel.in. Where AI or automated systems process your data (DIFC Regulation 10, Australia from December 2026), we say so in the product and explain human review on request.

How to ask: write to grievance@originpixel.in or use the privacy page of the business that collected your data. We verify your identity in a way that fits the request and answer within the time your law sets (India: as set by the DPDP Rules, at most 90 days; EU / UK: one month; US: 45 days, extendable; Brazil: 15 days).

10. Google user data (Limited Use disclosure)

Origin Platform's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• What we access and why: Google Calendar events (to show availability and book appointments), Google Contacts and Sheets (to sync records you choose), files you pick from Google Drive (to add to your knowledge base), YouTube (to upload videos you approve and read their statistics), Business Profile (to read and reply to reviews), and RCS Business Messaging (to send messages for the business).
• Limited Use: we use this data only to provide the features you turned on. We do not transfer it except to provide those features, for security, or to comply with law; we do not use it for advertising; we do not let humans read it except with your consent, for security, or to comply with law; and we do not use it to train generalised AI or machine learning models.
• YouTube: by connecting YouTube you agree to the YouTube Terms of Service; Google's use of data is covered by the Google Privacy Policy. You can revoke access at Google security settings or by disconnecting in the app; we then delete stored tokens.

11. Meta, LinkedIn and other platforms

When a client connects WhatsApp, Facebook, Instagram, LinkedIn or X, we receive only the data the client authorises, use it only to provide the connected feature, and delete it when the client disconnects or when you ask through the platform's data deletion request. Meta users can request deletion of data we received through Meta at [/meta/data-deletion, delivered by WP-CONSENT].

12. Children

The platform is for businesses and is not directed at children. See the Children's data policy for how clients must handle data of people under 18 (India) or under 13 / 16 elsewhere.

13. Changes

We post changes here with a new version number. For material changes we email clients at least 30 days before they take effect.

14. Contact and grievance officer

Origin Pixel Solutions, Chennai, Tamil Nadu, India · hariprathish@originpixel.in. Grievance officer and privacy contact: Hari Prathish, grievance@originpixel.in (details and timelines on the Grievance officer page). We acknowledge within 24 hours [counsel: IT Rules 2021] and resolve within the time the law sets.