Privacy Policy

• For people who deal with us directly (account holders, website visitors, early-access and newsletter subscribers), we are the data fiduciary: we decide why and how that data is used.
• For data a business keeps in its ERIX workspace (its contacts, leads, conversations and files), that business is the data fiduciary and we are its data processor. We use that data only to run the service for that business, under our Terms of Service and Data Processing Agreement.

If you are a customer of a business that uses ERIX, ask that business about your data. If you write to us instead, we pass your request to the business.

Your account

• Your name, email address and workspace name when you sign up.
• Your password, stored only as a scrypt hash, never in readable form. If you sign in with Google, GitHub or LinkedIn instead, that service gives us your name, email address and profile picture.
• Your phone number, only if you add it.
• Business details you choose to add during setup, such as industry and country.

Payments

• Your plan, the amount, the payment status and Razorpay's payment references. Razorpay collects your card, UPI or bank details; we never see or store them.

Workspace data

• Contacts, leads, conversations, messages, files, automations, invoices and anything else a team puts into ERIX or receives through the channels it connects. We hold this for the business that owns the workspace (see “Who Is Responsible for Your Data”).

Collected automatically

• Signed-in devices: IP address, browser, device and approximate country, so you can see your devices and sign them out.
• Server logs, used to keep the service secure and to fix faults.
• On ecodrix.com, only if you allow analytics: pages viewed, the site that sent you, campaign tags, screen size, browser, approximate country and a one-way hash of your IP address (not the address itself). See our Cookie Policy.

Forms and messages to us

• Early access: name, email address, business name, what you are interested in and, if you add it, your WhatsApp number. Newsletter: your email address.
• Support: whatever you send us by email, phone or WhatsApp.

LAIE (invite-only)

• LAIE finds businesses from public sources: search engines, business directories and Google Places. What it collects are public business listings, such as business name, category, address, phone number and website.

• Create and run your account and workspace, and keep you signed in.
• Do what you set up: send and receive messages on your connected channels, run your automations and run your AI agents.
• Bill you, issue GST invoices and keep tax records.
• Send service emails: sign-in and verification codes, security alerts, billing notices and replies to your requests.
• Keep the service secure: detect abuse, investigate incidents and fix faults.
• With your consent only: website analytics and our newsletter.

We do not sell personal data.

ERIX AI agents and other AI features send the text they need, such as a customer's message, the recent conversation and the business's own information and instructions, to one of our AI providers: Anthropic, OpenAI or Google (the paid Gemini API). These providers process it in the United States. None of them trains its models on the data we send.

Each AI agent answers only for the business that set it up, from that business's own information. It is not a general-purpose assistant. The business's team can read every AI conversation in the ERIX inbox and reply themselves.

• Consent: when you sign up, request early access, or join the newsletter, or allow analytics. You can withdraw it at any time (see “Your Rights and How to Use Them”).
• Legitimate uses the DPDP Act allows without separate consent: data you give us yourself for a stated purpose (for example, your email address to run your account) and data the law requires us to keep, such as tax records.

• Service providers that run parts of ERIX for us: hosting, file storage, email, payments, AI and sign-in. Each gets only what its job needs. Our Sub-processors page lists every one, with what it handles and where.
• Channels and apps a workspace connects, such as WhatsApp, Instagram or Google Calendar. Data goes to them because the workspace asked for it.
• Authorities, when Indian law or a court order requires it.
• A new owner, if the business is ever transferred, who must keep the promises in this Policy.

• Database, API servers and background jobs: Google Cloud in Mumbai, India.
• ecodrix.com and the ERIX console: Vercel, in the United States.
• Files: Cloudflare R2.
• Email sending: Amazon SES in Mumbai, India.
• AI processing: Anthropic, OpenAI and Google, in the United States.
• Payments: Razorpay, in India.

So some personal data is processed outside India.

When you write to us, send it from the email address on your account, or tell us that address and your workspace name, so we can find your data and confirm the request is yours.

If your data sits in a business's ERIX workspace because you are that business's customer, the business handles your request. If you write to us, we forward it to them.

Our staff can open a workspace to help you, for example when you contact support. Staff accounts are on an approved list, each with a role, and read-only staff cannot change anything. Signing in as a workspace is limited to our most senior admin role, lasts at most one hour, and every use is logged.

When a workspace connects Google Calendar, ECODrIx creates and updates calendar events (with Google Meet links) for the appointments booked through ERIX, and deletes an appointment's event when that appointment is cancelled. On the Google page in the ERIX console, the workspace can see the connected calendar's events from the last 30 days to the next 6 months, and create or edit events there. For the booking page, ERIX reads only free/busy times, never event titles or details, to avoid double bookings. When a workspace connects Google Sheets, ECODrIx reads and adds rows in the spreadsheets its automations name. When you sign in with Google, we receive your name, email address and profile picture. We ask only for the access these features need.

ECODrIx's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Google Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

• We do not use Google Workspace data, raw, aggregated or derived, to develop, train or improve foundational or generalised AI/ML models.
• We do not transfer or sell Google user data, except as needed to provide the connected feature, to comply with law, or as part of a merger or acquisition with notice to users.
• People do not read your Google data except with your explicit consent, for security or abuse investigations, to comply with law, or where the data has been aggregated and anonymised.

Data travels encrypted (TLS), our cloud providers encrypt it at rest, and the credentials a workspace uses to connect its channels are encrypted with AES-256-GCM before we store them. Our Security page has the details.

If a breach affects data we hold for you or your business, we tell you without undue delay and within 48 hours of confirming it. We report incidents to CERT-In within 6 hours of noticing them, as Indian law requires.

For data we are responsible for ourselves (see “Who Is Responsible for Your Data”), we follow the DPDP Rules: we tell the Data Protection Board without delay and send it a full report within 72 hours, and we tell each person affected without delay, through their account or the email address or phone number they gave us, what happened, how it may affect them, what we are doing about it, what they can do to protect themselves, and whom to contact.

ERIX is for businesses. You must be 18 or older to create an account. If you think someone under 18 has given us their own data, email privacy@ecodrix.com and we will delete it.

A business that keeps children's data in its workspace, such as a clinic or a school, must get verifiable consent from a parent or guardian where the DPDP Act requires it.

You are the data fiduciary for your own customers' data. Under the DPDP Act it is your job to give them your own privacy notice, get their consent where needed, answer their requests (ERIX lets you export data and erase a contact) and tell them about breaches. Our Data Processing Agreement sets out what we do for you.

When what we do changes, we update this page and the date at the top. For important changes, we email account holders or show a notice in the console before the change applies.

Privacy questions and requests: privacy@ecodrix.com.

Grievance Officer (under the IT Act, 2000 and the DPDP Act, 2023): Mekalthuru Dhanesh, proprietor. Email grievance@ecodrix.com or call +91 81439 63821. We acknowledge a grievance within 48 hours and resolve it within one month.

Mekalthuru Dhanesh, sole proprietor, trading as ECODrIx, Yerpadu, Tirupati district, Andhra Pradesh 517619, India.