1Who we are, and our two roles
BodhX AI provides AI agents, customer conversations, knowledge bases, WhatsApp, Instagram, email, web-chat and voice channels, CRM, analytics and automation for businesses. This policy covers our website, dashboard, APIs and support.
We act in two different roles, and the difference matters for your rights. For the personal data of the business owner and team members who sign up ("you"), BodhX is the Data Fiduciary — we decide why and how it is processed. For the personal data of a business's own customers, leads and contacts that flows through an agent ("end customers"), the business that set up the agent is the Data Fiduciary and BodhX is its Data Processor: we process that data only to run the service the business asked for.
2What personal data we collect
- Your account: name, email address, password (stored only as a one-way hash), optional phone number and company details, your team members' details, workspace preferences and the record of your consent (which text you accepted, when, and from what device).
- Billing: plan, credits, invoices and billing details. Card or bank details are entered with our payment providers and are not stored by us.
- Your workspace content: instructions and prompts, documents and website pages you add to a knowledge base, contacts, leads, campaigns, templates and settings.
- End-customer conversations: messages, attachments, names, phone numbers, WhatsApp / Instagram / email identifiers and timestamps that arrive on the channels you connect, and the replies sent back.
- Voice: for calls on the voice channel, the caller and called phone numbers, call audio and its transcript, and a recording if recording is enabled.
- Information our AI derives for you: conversation summaries, agent memory, lead details and scores, and reports.
- Technical and security data: IP address, browser and device details, sign-in events, session and error logs.
We do not knowingly collect Aadhaar, PAN, health or financial-account numbers. If a customer types such details into a chat, they are stored as part of that conversation like any other message; businesses should not ask for them through an agent.
3Why we use it, and on what basis
- To create and secure your account and run the service you asked for — on the basis of your consent given when you signed up, and to perform that service.
- To run your AI agents: read incoming messages, produce and send replies, capture leads, book appointments, make calls and produce analytics — on your instructions.
- To send service messages (verification codes, security alerts, billing and low-credit notices). These are necessary for the service and are not marketing.
- To send product updates and offers by email — ONLY if you ticked the separate, optional marketing box. You can withdraw it at any time.
- To prevent abuse and fraud, keep the service secure, and meet legal obligations.
You are not required to accept marketing to use BodhX. Consent to the Terms and this policy is required to create an account, because we cannot provide the service without processing the data described here.
4How your data is used through our platform (AI processing)
- When a customer messages one of your agents, the message, the relevant part of your knowledge base and recent conversation context are sent to an AI model provider so it can write the reply. The same happens for voice (speech-to-text and text-to-speech providers) and for image understanding.
- We use those providers as processors, to generate the output you asked for. We do not sell personal data, and we do not use your or your customers' messages to train our own models.
- AI outputs are generated automatically and can be wrong. You control what each agent may say and do, and you can review every conversation.
- Some features store derived data to work well — conversation summaries, agent memory, lead scoring. You can view and delete conversations and contacts from the dashboard; leads and CRM records are managed on their own pages.
- BodhX Brain, the assistant inside your dashboard, reads your workspace to answer your questions and can change settings only when you confirm each action.
5Who receives your data
We share personal data only with service providers that help us run the product, and only what each needs. Providers named below receive data only for the features you turn on.
- AI models and speech: OpenAI; Deepgram and ElevenLabs for voice.
- Messaging and social channels: Meta (WhatsApp, Instagram, Facebook), Telegram, and Google (Gmail) where you connect them; Twilio for telephony and SMS; Resend for email delivery.
- Integrations you connect: Google (Sheets, Drive, Calendar), Shopify, and connector services such as Composio.
- Infrastructure: Amazon Web Services (hosting, Mumbai) and Supabase (database and file storage).
- Payments: Razorpay and Stripe.
- Web content: Firecrawl, Jina and Tavily fetch web pages and search results you ask us to read for a knowledge base or research; they see the web addresses and queries, not your customers' messages.
- Authorities, when the law requires it, and professional advisers under confidentiality.
We do not sell personal data. On our public website pages we use OpenAI's advertising pixel to measure whether our ads led to a visit or a sign-up (see Cookies and local storage).
6Where it is processed (transfers outside India)
Our servers and database are in India (AWS Mumbai region). Several providers above — notably the AI, voice, Meta, Google and Twilio services — process data on infrastructure outside India, including in the United States. We transfer personal data abroad only as permitted by the Digital Personal Data Protection Act, 2023 and any restrictions the Government notifies, and we rely on the providers' contractual and security commitments.
7How long we keep it
- Chats, contacts, leads and knowledge you add: until you delete them or close your account. A business decides how long its own customers' conversations are kept and can delete them at any time.
- Voice call transcripts and recordings: automatically removed after 30 days (the call record itself remains).
- AI conversation summaries: about 180 days after the customer's last message. AI call metadata and tool logs: about 30 days. Research items and agent memory not accepted by you: 30 to 90 days.
- Sign-in events (with IP address) and administrative audit records: about 365 days. A minimal security record of a closed account may be kept longer where needed to protect the service.
- Billing and tax records: for as long as tax and accounting law requires.
- Closing your account: it is disabled immediately and can be restored for 30 days. After that we permanently delete the workspace data linked to it; we keep only a scrubbed account stub, billing and tax records, and security logs for their periods above.
- Backups: deleted data can remain in backups for a limited further period until they are overwritten.
8How we protect it
- Data is encrypted in transit (HTTPS) and stored on encrypted infrastructure. Connection tokens for your integrations are additionally encrypted with AES-256-GCM.
- Passwords are hashed with bcrypt; sign-in codes and session tokens are stored hashed. Sessions can be reviewed and revoked from your settings, and new-device sign-ins trigger an alert.
- Each workspace is isolated: our database tables use row-level security, and the application scopes data access to the signed-in workspace.
- Access to production systems is restricted, and administrative changes to accounts are logged.
No system is perfectly secure. If a personal data breach occurs, we will notify the Data Protection Board of India and the affected people as the law requires, and we will tell the business owners whose data is affected without undue delay.
9Your rights, and how to use them
Under the Digital Personal Data Protection Act, 2023 you have the right to:
- Get a summary of the personal data we process about you and who we have shared it with.
- Correct inaccurate or incomplete data and update data that is out of date. Most account details can be edited under Settings.
- Have your data erased when it is no longer needed for the purpose or you withdraw consent, unless the law requires us to keep it. You can close your account under Settings → Security.
- Withdraw consent at any time — for marketing, by writing to the Grievance Officer below. Withdrawing marketing consent has no effect on the service. Withdrawing consent to the Terms and this policy means closing the account, because the service cannot run without the processing.
- Have your grievance redressed, and nominate another person to exercise these rights on your behalf if you die or become incapacitated.
To use any of these, write to our Grievance Officer (below). We acknowledge every request within 7 days and aim to resolve it within 30 days. If you are not satisfied you may complain to the Data Protection Board of India.
10If you are a business's customer
If you message a business that uses BodhX, that business decides why your data is used and is responsible to you for it; BodhX processes it on the business's behalf. Please send access, correction and erasure requests to that business first. You may also write to our Grievance Officer and we will pass the request to the business or act on it where we are able to.
- Reply STOP (or a similar word) to a WhatsApp message and we record your opt-out and stop marketing messages to you. Every marketing email carries an unsubscribe link that takes effect for that business immediately.
- You are talking to an AI assistant when you chat with a BodhX agent; the business may review the conversation.
11What business owners must do
If you use BodhX to message or call people, you are responsible for having a lawful basis and, where required, the person's consent; for honouring opt-outs and do-not-disturb registers; for telling your customers how you use an AI assistant; and for not uploading data you are not entitled to use. Our Terms set out the data-processing terms that apply between you and us.
12Children
BodhX is a business service for adults. You must be at least 18 to create an account, and we do not knowingly collect personal data of children. If you believe a child's data has reached us, write to the Grievance Officer and we will delete it. Businesses must not use an agent to collect children's data without the verifiable parental consent the law requires.
14Changes to this policy
This is version 2026-09-26. When we change it materially we will update the date and version and tell account owners by email or in the dashboard. We record which version each person accepted when they signed up.
15Contact and Grievance Officer
For privacy questions, requests or complaints:
hello@bodhx.ai