Privacy policy.

1. Who we are

This policy explains how Altrix.one ("Altrix.one", "we", "us"), handles personal data when you visit altrix.one, use the Altrix.one web app or Android app, or message a business that uses Altrix.one.

Under India's Digital Personal Data Protection Act, 2023 ("DPDP Act"), a data controller is called a "data fiduciary". Under the EU and UK General Data Protection Regulation ("GDPR"), it is called a "controller".

2. Our two roles

As controller. We decide how and why we use data about visitors to our website, people who contact us (for example to book a demo), and the account and billing details of businesses that subscribe to Altrix.one ("client businesses") and their users.

As processor, on behalf of client businesses. When a client business uses Altrix.one, the data it puts in or receives through Altrix.one belongs to that business. Examples are its customers' WhatsApp messages, leads, deals, quotes, call logs and staff attendance. The client business is the controller (data fiduciary) of that data, and we process it on the business's behalf and on its instructions.

If you are a customer of a business that uses Altrix.one, please contact that business first about your data. We will help the business respond to you.

3. Data we collect

When you visit our website

Our website does not use analytics, advertising trackers or tracking cookies. Our hosting provider receives the technical data that every website receives, such as your IP address, browser type and the pages you request, to deliver the site and protect it from abuse.

When you contact us

Your name, business name, phone or WhatsApp number, email address, and anything you include in your message.

When you use Altrix.one (account data)

• Name, mobile number, work email, company, office and role (for example staff, team leader, GM or owner).
• Sign-in records, such as one-time WhatsApp codes and session details.
• Device and app information, such as app version and device type.
• Activity records in the audit log, which shows who did what, and when.

Data we process on behalf of client businesses

• Customer contact details, such as name and phone number.
• WhatsApp messages, photos, files and voice notes.
• Lead and deal details, quotes, invoices, payment status, refunds, vendors and expenses.
• Call logs and, where the client business switches them on, call recordings.
• Staff attendance check-ins using office Wi-Fi and GPS location, where the client business switches this on.
• Targets, incentives, leave and working hours.

Client businesses decide what data they put into Altrix.one, and they are responsible for having a lawful basis for it. Payments are handled by payment gateways. We do not receive or store full card numbers.

4. WhatsApp Business data

Altrix.one gives each client business a shared team inbox for its own WhatsApp Business number.

• Each client business connects its own WhatsApp Business number to Altrix.one through Meta's Embedded Signup.
• We receive the messages that customers send to that number and show them in the business's shared team inbox.
• We send the replies written by the business's staff, plus approved template messages such as quote reminders and payment links.
• Messages go only to customers who contacted the business first or who opted in to hear from it.
• Every message is stored in that business's own isolated workspace. Other client businesses cannot see it.
• Where the business switches on AI & Automation, the assistant can send a welcome message with an "Allow" consent button.

The client business is responsible for its notices to its customers, for its lawful basis for messaging them, and for following WhatsApp's business and commerce policies.

5. Meta Platform data

When a client business connects Meta products to Altrix.one, we receive data from Meta's platform ("Platform Data"). We receive only what the business grants through Meta's permission screens.

• WhatsApp Business Platform (whatsapp_business_messaging and whatsapp_business_management): the business's WhatsApp Business Account details, phone numbers, message templates and their approval status, and messages and delivery updates sent to us by webhook.
• Facebook and Instagram lead ads, where connected: the answers people give in the business's lead forms (such as name, phone and email), and ad numbers such as spend, leads and cost per lead.

How we use Platform Data:

• We use it only to provide Altrix.one features to the business that connected it.
• We do not sell Platform Data, and we do not use it for advertising.
• We do not share it with data brokers, and we do not use it to build profiles of people for anyone else.
• We follow Meta's Platform Terms and Developer Policies.
• When a business disconnects Meta or closes its account, or when Meta or the person concerned asks, we delete the related Platform Data, except where the law requires us to keep it.

See Data deletion for how to remove Altrix.one from your Facebook account and ask us to delete data we received through Meta.

6. How we use data

• To provide and run Altrix.one, including the inbox, leads, quotes, payments, calls, HR and reports.
• To sign users in and keep accounts secure, and to prevent fraud and abuse.
• To set up, train and support client businesses.
• To bill client businesses.
• To improve Altrix.one, using aggregated or de-identified usage data where we can.
• To reply to enquiries and demo requests.
• To meet our legal obligations.

When a client business switches on AI & Automation, the text needed for that feature (for example, a chat to be summarised) is sent to an AI model provider to produce the result.

Legal bases

DPDP Act: we process personal data with consent, or for the legitimate uses the Act allows. Client businesses get any consent they need from their customers and staff.

GDPR: we rely on performing a contract, on our legitimate interests (such as security, improving the service and answering enquiries), on consent where we ask for it, and on legal obligations (such as tax and accounting rules).

7. Who we share data with

We do not sell personal data. We share it only with service providers that help us run Altrix.one, under contracts that limit how they can use it:

• Hostinger: the virtual private server that hosts the Altrix.one app, database and files, in India.
• Meta Platforms: the WhatsApp Business Platform and, where connected, lead ads.
• Cloudflare: delivery and security for the altrix.one website.
• AI model providers: only when a client business switches on AI & Automation.
• Razorpay (and Stripe, if used for payments outside India): subscription payments and wallet top-ups.
• Email, backup, push-notification and telephony providers (telephony for the Enterprise Call Centre only).
• Payment gateways chosen by the client business: to create payment links and confirm payments.
• Google Workspace: to create Google Meet links, when the client business uses that feature.

The full, current list is on our Sub-processors page. Inside Altrix.one, only the people who need the data to run or support Altrix.one can access it. We may also share data when the law requires it, to protect people's rights and safety, or as part of a transfer of the Altrix.one business, in which case we will give notice.

8. International transfers

We host Altrix.one on a server in India (Hostinger). Some service providers, such as Meta, may process data in other countries. Where the law requires it, we use appropriate safeguards, such as standard contractual clauses for personal data from the EU, EEA or UK. We do not transfer personal data to any country that the Government of India restricts under the DPDP Act.

9. How long we keep data

• Client business data: kept while the client business's account is active. It is deleted when the business deletes it, or after the account closes and the export period in our Terms ends, except records the law requires us to keep.
• Account and billing data: kept while the account is active, and afterwards for as long as tax and accounting laws require.
• Enquiries (demo requests): kept as long as we need them to respond and follow up, and deleted on request.
• Security logs and the audit trail: kept as long as needed to protect the service and investigate problems.
• Backups: deleted data may stay in backups for a limited time until those backups are overwritten.

10. How we protect data

• Altrix.one is hosted in India. Data is encrypted in transit (HTTPS), and secret keys are kept in an encrypted, write-only Keys vault.
• Role-based access: staff see only their own clients, team leaders see their team, and the owner sees everything.
• Staff sign in with a one-time code sent by WhatsApp or email, so there are no passwords to steal.
• A full audit trail shows who did what, and when.
• Each client business's data is kept in its own isolated workspace.

No system is completely secure. If a personal data breach happens, we will tell the affected client businesses without undue delay, and we will tell the Data Protection Board of India, other authorities and the people affected as the law requires. More detail is on our Security page.

11. Your rights

Under India's DPDP Act 2023

• Get a summary of your personal data and how it is processed.
• Have your data corrected, completed, updated or erased.
• Have your grievances addressed.
• Nominate someone to use your rights if you die or cannot act.
• Withdraw your consent at any time. This does not affect processing that happened before.

If you are not satisfied with our response, you can complain to the Data Protection Board of India.

Under the GDPR (EU, EEA and UK)

You have the right to access, correct and erase your data, to restrict processing, to data portability, to object to processing based on legitimate interests, and to withdraw consent. You can also complain to your local data protection authority.

How to use your rights

Email corp@altrix.one. We may ask you to confirm your identity, and we will reply within one month (30 days). If a client business controls your data, we may pass your request to that business and help it respond.

12. Deleting your data

To ask us to delete your data, email corp@altrix.one with the subject "Data deletion request". Step-by-step instructions, including for data we received through Meta, are on our Data deletion page.

13. Cookies and local storage

Website: altrix.one does not use tracking, advertising or analytics cookies.

App: the Altrix.one app uses essential cookies and local storage to keep you signed in (for up to 60 days) and to remember settings such as night mode. The app needs these to work.

14. Children

Altrix.one is a tool for businesses and is not meant for children. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, contact us and we will delete it.

15. Changes to this policy

We may update this policy. We will change the date at the top of this page, and we will tell client businesses about significant changes by email or in the app.

16. Contact us

Altrix.one (legal entity: [LEGAL ENTITY NAME]) (brand: Altrix.one), [ADDRESS], India.
Email: corp@altrix.one