Privacy Policy

Automix AI is operated by Dr. Vivek Trivedi from Gujarat, India. We build a platform of specialist AI workspaces; Wavy, our WhatsApp customer-engagement workspace, is the product most customers use, and the other specialists are at varying stages of availability marked on each product page.

Most privacy policies are written from a template and then loosely fitted to the product. This one was written the other way round: from the database schema and the code that reads it. That means it is specific, and it also means it admits things a template would have smoothed over — that we do not yet delete old messages on a schedule, that we have no two-factor authentication, and that deleting your account is something a person does rather than a button you press. We would rather you knew that before you trusted us with anything.

About you, the account holder. Email address, full name, phone number, and either a password (stored only as a bcrypt hash, never in readable form) or a reference to the Google account you signed in with. We also record whether your email is verified, your role in the workspace, and the time of your last sign-in.

Security and audit records. IP address and browser user-agent string against significant account and workspace events, so that we and you can reconstruct who changed what. Ordinary web-server request logs exist as well. Where a shared dashboard link is opened, we store a salted hash of the viewer's address rather than the address itself.

What you put in the workspace. Your business details, brand and offer settings, operating rules, and any connected-account credentials you authorise. Contacts you add or import — name, phone number, whatever custom attributes you choose to store, lead stage, and consent state. The content of conversations: message text, media files, and interactive message payloads.

Media, kept on our own storage. When a customer sends your WhatsApp number a photo, document, or voice note, we copy it out of Meta's servers onto ours, because Meta deletes it. That copy lives in our object storage until deleted.

Sensitive categories, if you use the agents that handle them. Two products deliberately touch data that deserves naming:

• Health information. The Doctor workspace stores medical documents, clinician names, issuing facilities and dates of birth for the people whose records you manage. Where a record belongs to someone under 18, the system requires you to record a guardian's consent before the profile can be created.
• Identity and financial documents. The document-AI features can read Aadhaar numbers, PAN, GST registration numbers and bank statements. Identifiers of this kind are stored only as the last four digits — the system refuses to put a full identifier in any other field — and long digit sequences in extracted document text are masked. No part of Automix stores a complete card number, bank account number, IFSC code, UPI ID or IBAN in any field.

Anonymous website measurement. We run self-hosted Umami on our own servers to count page views and understand which Automix pages are useful. It is cookieless and first-party: it does not create an advertising profile, follow you across sites, or send analytics data to a third-party analytics company. We do not use session replay or heatmaps. Ordinary web-server request logs and this measurement can include technical request data such as IP address, browser, device, referrer, and the page requested.

What we never collect. No biometric data of any kind. No advertising profile: there is no Google Analytics, no Tag Manager, and no Meta pixel anywhere in this site. See the Cookie Policy for the two specific places where another company's cookies do appear.

This is the complete list of third parties that personal data can reach when the corresponding feature is in use. Where a feature is not configured in your workspace, no data flows to the company named.

• Meta Platforms — recipient phone numbers and the full content of every WhatsApp message, because that is what sending a WhatsApp message means. Governed by Meta's own terms as well as ours.
• OpenRouter — where an AI feature is used, the text it needs to do its job: the relevant conversation excerpts, the customer text being replied to, or the document being analysed.
• Zoho (ZeptoMail) — recipient address, subject and body of email we send on your behalf and of our own service email.
• Our object storage provider — every uploaded or received media file and document, held in our own bucket.
• Google — if you sign in with Google, your identity token; if you connect Google Drive, the files you export to it. Google Fonts also serves the typefaces on our pages, which discloses your IP address to Google on every page view. We are moving those files onto our own servers.
• Airtable — only if you connect it: contact name, phone number and opt-in status, synchronised to your own base.
• Payment providers — where a payment is taken through a gateway, that gateway handles the payment itself. Card and bank details go to them and never to us; no complete card or account number is stored anywhere in Automix.

We will also disclose data where the law compels it, and to professional advisers under confidentiality. If Automix is ever sold or merged, data may transfer with the business, and you will be told before that changes who controls it.

Where data is held. Automix runs on servers we control. The providers above operate internationally, so data reaching them may be processed outside India under their own arrangements.

Under India's Digital Personal Data Protection Act 2023, and equivalent rights elsewhere, you can ask for access to your personal data, correction of it, deletion of it, and information about who it has been shared with. Automix honours all four. The mechanics differ, so here they are honestly:

• Access and correction. Most of your data is visible and editable in the product. For anything that is not, email us and we will compile it. There is no one-click export bundle yet; we assemble it by hand, which is why we ask for up to 30 days.
• Deletion of specific records. Immediate and self-service. Contacts, conversations, documents, media and health records each have a delete control in the product.
• Deletion of your whole account. There is no self-service button. Write to us and a person carries it out in two parts — the workspace and its contents, then the sign-in identity — because they live in two separate systems. We complete this within 30 days and confirm in writing when it is done. We will say what, if anything, we must keep and why: normally only billing records we are required to retain, and append-only security logs recording that the deletion happened.
• Withdrawing consent. Where we rely on your consent, you can withdraw it at any time. This does not undo processing already carried out.
• Nominating someone. The DPDP Act lets you nominate a person to exercise your rights if you die or become incapacitated. Tell us in writing and we will record it.

How to ask. Email vivek@automixai.in with “Data request” in the subject line. We acknowledge within 7 days and complete within 30. If we need to verify who you are first, we will ask for the minimum that establishes it.

Support access to your workspace. Worth knowing because it is unusual: our staff cannot browse into your workspace at will. If we need to look at it to help you, the product asks you for permission, the request expires unanswered after 72 hours, an approval lasts 24 hours, and you can revoke it at any moment from your settings.

In place. Passwords are hashed with bcrypt and never stored readably. All traffic is served over HTTPS, with plain HTTP redirected. Session cookies are HttpOnly, Secure and SameSite=Lax. Sign-in sessions expire and refresh tokens rotate on every use. Credentials for connected accounts are held in an AES-256-GCM encrypted vault that refuses to operate if its key is missing rather than falling back to storing them in the clear. The two credentials that would let someone act as you — the WhatsApp access token that sends from your number, and the signing secret your own server uses to trust our webhooks — are encrypted in the database with the same cipher, so a database backup or a stray read replica does not carry them in the clear. Every database query is scoped to a single workspace, taken from your verified session — no part of the API accepts a workspace identifier from the request, so one customer cannot ask for another's data by changing a number in a URL. Rate limits apply to reads, writes and message sending. Significant account and security events are written to an append-only audit log.

Not in place, stated plainly. There is no two-factor authentication yet. There is no account lockout after repeated failed sign-ins. There is no IP allowlisting. We hold no security certification, have not completed an external audit, and make no compliance-framework claim. Our audit logging covers account and workspace events but does not yet extend to every billing action.

What we are not claiming. That our security is complete, or that every stored value is encrypted at rest. No system is without weaknesses and ours is young. Use a strong, unique password, give team members the least access they need, and revoke support access when you no longer need it.

If you find a security problem, email vivek@automixai.in with “Security” in the subject. We will acknowledge within 2 working days, will not pursue anyone who reports a genuine issue in good faith without exploiting it, and will tell affected customers about a breach that puts their data at risk without waiting to be asked.

Dr. Vivek Trivedi is responsible for data protection at Automix AI. Reach him at vivek@automixai.in, or on +91 79841 00350.

If you are unhappy with how we handled a request or your data, say so to that address, marked “Complaint”. We will respond within 30 days with what we found and what we did. If you remain unsatisfied, you may complain to the Data Protection Board of India, and you do not need our permission to do so.

When we change this policy we update the effective date at the top. For a change that materially affects your rights or widens what we do with your data — a new category of data, a new third party receiving it, a new purpose — we will email account holders before it takes effect, not after.

This policy is kept in the same repository as the software it describes, and a change to the code that makes a statement here untrue is meant to change this page in the same commit. That is how we intend to keep it accurate rather than merely current.