Privacy policy

Skode Technologies ("SkedX," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website at https://skode.ai, use our CRM platform, Flow messaging platform, or any related services (collectively, the "Services").

By accessing or using our Services, you agree to the terms of this Privacy Policy. If you do not agree, please discontinue use of the Services immediately.

1Information we collect

1.1Information you provide directly

• Account Information: Name, email address, phone number, company name, job title, and billing information when you register for an account.
• CRM Data: Leads, contacts, deals, notes, tasks, invoices, and any other data you enter into the SkedX CRM platform.
• Communications: Messages you send through our support channels, feedback forms, or live chat.
• Payment Information: Credit card numbers, billing addresses, and transaction details processed through our payment provider (Razorpay).

1.2Information collected automatically

• Usage Data: Pages visited, features used, clicks, session duration, and interaction patterns within our platform.
• Device Information: Browser type, operating system, device identifiers, IP address, and screen resolution.
• Cookies and Tracking Technologies: We use cookies, web beacons, and similar technologies as described in our Cookie Policy.
• Log Data: Server logs including access times, referring URLs, and error logs for debugging and security purposes.

1.3Information from third parties

• OAuth Providers: If you sign in via Google or other OAuth providers, we receive your name, email, and profile picture.
• Integration Partners: Data synced from third-party services you connect to SkedX (e.g., email providers, calendar services).
• Online stores: If you connect a Shopify or WooCommerce store, we receive your store’s orders, customers, deliveries, abandoned checkouts and products. See § 4A.10.

1AOur products and the data each one handles

SkedX is a multi-product platform. The categories above apply across all of our Services, but each product processes data for a distinct purpose. This section explains, product by product, what personal data is involved so you can see exactly how your information is used in the part of SkedX you rely on.

• SkedX CRM (/crm/): Stores the customer records you create — leads, contacts, companies, deals, notes, tasks, and invoices, together with any custom fields you add. This data is controlled by you (or your organisation) and processed by SkedX to provide the CRM. See § 6 for retention.
• SkedX Call: Our calling add-on. Where an organisation enables it, we process on that organisation's behalf: call metadata (numbers, timestamps, duration, outcome), call recordings and voicemail (only where the organisation has enabled recording, and has told the people it calls in the way it chose — an announcement on the call, or its own agreement with them), transcripts, and AI-generated notes and suggested field values. The organisation is the data controller (in India, the Data Fiduciary) of this data and of its call recipients' personal data; SkedX is its processor. Two narrow exceptions where SkedX acts as fiduciary in its own right: the verification (KYC) documents an organisation submits to activate calling — collected only as the carrier compliance process requires and retained per § 6 — and call metadata processed for billing, fraud prevention, security and fair-use administration, strictly limited to those purposes (call content is never processed for them). If you received a call from an organisation using SkedX Call and wish to exercise rights over that call's data, contact that organisation; we assist organisations in fulfilling such requests. Recordings for Indian organisations are stored in the AWS Hyderabad region (ap-south-2).
• SkedX Flow (/flow/): Our omnichannel messaging platform. Flow processes the content and metadata of conversations you exchange with your own customers across connected channels (WhatsApp, Meta Messenger, Instagram, Telegram, SMS, email and others), plus the contact identifiers needed to route those messages. Channel-specific disclosures are in § 4A.
• SkedX Forms (/forms/): Processes the responses your respondents submit through forms you build, including any personal data your form fields collect. You are the controller of form-response data; SkedX processes it on your behalf and passes it into your CRM or workflows as you configure.
• SkedX Automate (/automate/): Executes the workflows and automations you define. To do so it reads and writes the CRM, Flow, and Forms data those workflows act on, and records execution logs (see § 6 for log retention). It does not collect new categories of personal data on its own.
• SkedX Studio: Our AI/content surface. Inputs you provide to AI features are processed as described in § 3 (AI and Automated Data Processing) and our AI Transparency Policy.
• SkedX Platform (/platform/): The shared account, billing, team-management, and integrations layer underneath the products above. It processes your account information, billing data (via Razorpay), team-member records, and the OAuth tokens for third-party services you connect.
• SkedX Flow Browser Extension (/extension/): A client surface for Flow. It reads only the phone numbers and email addresses you explicitly click on a web page, and stores a small amount of data locally in your browser. Full detail is in § 4A.8 and our Extension Privacy Notice.
• SkedX Chat Widget: The embeddable widget you place on your own website so visitors can message you. It processes the messages and contact details visitors choose to provide. Full detail is in our Widget Privacy Notice.
• SkedX for Shopify and WooCommerce: Connects an organisation’s online store to SkedX so it can send order and delivery messages, answer its customers and keep its products in SkedX. The organisation is the controller for its shoppers’ data; SkedX is its processor. Full detail is in § 4A.10 and our SkedX for Shopify Privacy Policy.

2How we use your information

We use the information we collect to:

• Provide, maintain, and improve our Services.
• Process transactions, send invoices, and manage billing.
• Send you service-related communications, updates, and security alerts.
• Provide customer support and respond to your inquiries.
• Personalize your experience and deliver relevant content and recommendations.
• Analyze usage trends and platform performance to improve our products.
• Detect, prevent, and address fraud, abuse, and security issues.
• Comply with legal obligations and enforce our Terms of Service.
• Send marketing communications (only with your consent, and you may opt out at any time).

2.1Our lawful bases for processing

Where the UK GDPR, EU GDPR, the UAE PDPL, or India’s Digital Personal Data Protection Act applies, we rely on the following legal bases for each purpose. Where we rely on consent, you may withdraw it at any time (as easily as you gave it) without affecting processing that already took place.

For special-category or sensitive data, we additionally rely on an applicable condition (for example, your explicit consent) before processing. Under the UAE PDPL and India’s DPDP Act, our default basis is your consent unless a statutory exception (such as performance of a contract or a legal obligation) applies.

3AI and automated data processing

SkedX uses artificial intelligence features to enhance your CRM experience, including voice input transcription, lead scoring, deal predictions, and analytical tools. Here is how we handle data in these contexts:

• Voice Input: Audio recordings submitted via the CRM's voice-note input feature are transcribed using third-party AI providers (OpenAI Whisper). That voice-note audio is processed in real-time and is not stored after transcription is complete. (This is distinct from SkedX Call recordings, which — where an organisation enables recording — are stored per § 6.)
• AI Analysis: Your CRM data may be processed by AI models to generate insights, predictions, and recommendations. This processing occurs within our secure infrastructure.
• Call Recording & AI Notes (SkedX Call): Where an organisation enables them, call recordings are transcribed and summarised by AI to produce call notes and suggested CRM field values. Automatic application of suggested values is controlled by the organisation's own configuration, and every applied change is logged in the record's history. The No Model Training commitment below applies fully to call audio, recordings and transcripts.
• No Model Training: We do not use your data to train AI models. Your data is used solely to provide you with AI-powered features within the Services.
• Third-Party AI Providers: When data is sent to third-party AI providers for processing (e.g., OpenAI for transcription), it is governed by our data processing agreements with those providers, which prohibit them from using your data for training.

AI connector data sharing

When you activate an AI connector (ChatGPT, Claude, or Gemini), selected CRM data is transmitted to the AI provider for processing. Data shared may include: contact names and details, deal values and stages, task descriptions, invoice amounts, e-commerce order data, and Flow message content — limited to modules you explicitly select.

Data NOT shared: passwords, payment card numbers, data from other tenants, internal system logs.

Each AI provider operates under a zero-data-retention API agreement. Your CRM data is not used for model training.

You can enable/disable each connector independently, select which modules are accessible, and request deletion of transmitted data at any time.

Automated decision-making and profiling

Some SkedX features — such as lead scoring, deal-win predictions, and lead assignment — use automated processing (including profiling) to rank or prioritise records. The logic in these features weighs signals you and your team provide (for example, engagement history, deal stage, and field values) to produce a score or suggestion. The significance of this processing is that it surfaces recommendations to help your team prioritise work.

These outputs are decision-support tools, not solely automated decisions that produce legal or similarly significant effects on you within the meaning of Article 22 of the UK/EU GDPR — a human in your organisation remains responsible for acting on them. If you believe a decision affecting you was made by solely automated means, you have the right to request human intervention, to express your point of view, and to contest the decision; contact us at [email protected]. In line with the Australian Privacy Act (APP 1.7, taking effect in 2026) and comparable transparency rules, we will update this section to describe any further automated decision-making as those features evolve.

4How we share your information

We do not sell your personal information. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

We may share your information with:

• Service Providers: Third-party vendors who assist us in operating the Services (hosting, payment processing, email delivery, analytics). See our Sub-Processors page for a complete list.
• Advertising partners: Limited information to measure our own ads — never your phone number. See § 5.2 Analytics and advertising.
• Within the SkedX product family: Data is processed across the SkedX products you use — for example, call records appearing on CRM timelines, or calling infrastructure operated by a dedicated SkedX calling platform — by SkedX and its affiliates operating those products, under your same agreement and with identical protections. This is processing within the SkedX product family, not sharing with third parties.
• Legal Requirements: When required by law, regulation, legal process, or governmental request.
• Business Transfers: In connection with a merger, acquisition, or sale of all or a portion of our assets.
• With Your Consent: When you explicitly authorize us to share your information with a third party.

4APlatform-specific data disclosures

When you connect third-party platforms to SkedX Flow, we access and process data from those platforms as described below. Data from each platform is processed solely to provide the Services you have requested and is subject to our security measures described in Section 8.

4A.1Meta (Facebook Messenger & Instagram)

When you connect your Facebook Page or Instagram Professional account to SkedX Flow, we access the following data through the Meta Platform API:

• Page and profile metadata: Page name, profile picture, page category, and business information associated with your Page or Instagram account.
• Messaging data: Messages sent and received through Facebook Messenger and Instagram Direct Messages, including text content, attachments, timestamps, and sender/recipient identifiers.
• User profile information: Name, profile picture, and locale of users who message your Page (as permitted by Meta).
• Engagement data: Comments, reactions, and post interactions on your Page.
• Catalog data: If you connect a Meta product catalog to SkedX Flow (or ask SkedX to create one), we read and update that catalog on your behalf — product names, prices, images, descriptions and availability — so the products you choose in SkedX can be shown and sold in WhatsApp chats. We only manage catalogs you connect, and we never use your catalog for anything except providing this feature to you.
• Ad reporting data: If you connect a Facebook ad account, we read campaign, ad set and ad names and their spend and results for that account, and use them only to show your ad results next to your sales inside SkedX Flow. We never create, change or publish ads, budgets or audiences on your behalf.

Data collected from Meta platforms is encrypted at rest (AES-256) and in transit (TLS 1.2+). Messaging data is retained for the duration of your subscription. We do not sell or share Meta platform data with third parties except as necessary to provide the Services. Our use of Meta platform data complies with the Meta Platform Terms and Developer Policies. You may disconnect your Meta account — including a connected catalog or ad account — at any time from inside SkedX Flow, which removes our access immediately, and request deletion of associated data via Data Deletion.

4A.2WhatsApp Business

When you connect your WhatsApp Business account to SkedX Flow via the WhatsApp Cloud API, we access:

• Business profile information: Business name, description, address, email, website, and profile picture.
• Message data: Messages sent and received (text, media, documents, location, contacts), delivery/read receipts, and timestamps.
• Phone numbers: Customer phone numbers who message or are messaged by your business.
• Template data: Message templates you create and their approval status.

WhatsApp messages are encrypted in transit (TLS 1.2+) and at rest (AES-256). We do not access end-to-end encrypted personal WhatsApp messages — only WhatsApp Business API messages. Our use complies with the WhatsApp Business Terms and Commerce Policy. See our WhatsApp Compliance page for additional opt-in and messaging requirements.

4A.3TikTok

When you connect TikTok for Business to SkedX Flow, you authorize SkedX via TikTok's OAuth 2.0 flow, which grants limited access to your TikTok Business account without exposing your TikTok password. We may access:

• Business account information: Account name, profile data, and business verification status.
• Messaging data: Direct messages sent and received via TikTok Business messaging features.
• Lead data: Information submitted through TikTok Lead Generation forms, imported into your CRM for sales follow-up and lead management.
• Conversion event data: Where TikTok Events API (Conversions API) is enabled, we may share hashed event data (hashed email, hashed phone number, event type, timestamp) with TikTok for ad optimization, measurement, and attribution purposes.

Device Data Collection Tools (DDCTs): Where TikTok Pixel is deployed on your website through SkedX, your website uses device data collection tools operated by third parties including TikTok. These tools collect data about user interactions for the purpose of ad measurement, conversion tracking, and audience targeting. Users may opt out of TikTok ad tracking through TikTok's privacy settings or through our Cookie Policy consent controls.

TikTok data is processed in accordance with the TikTok Terms of Service, TikTok for Business Privacy Policy, and the TikTok Business Products (Data) Terms. We do not sell, share, or disclose TikTok data to third parties except as necessary to provide the Services to you or as required by law. TikTok data is not used to create user profiles, audience segments, or lookalike audiences beyond what is authorized by TikTok's Business Products Data Terms. Upon disconnection of TikTok integration or termination of our developer access, TikTok data is deleted from active systems immediately. Backup purge completes within 90 days. TikTok cookies (where TikTok Pixel is deployed) have a maximum duration of 13 months. See our Cookie Policy for details. You may disconnect your TikTok account and request deletion of associated data at any time via Data Deletion.

4A.4LinkedIn

When you connect LinkedIn to SkedX, you authorize access via LinkedIn's OAuth 2.0 flow. We collect LinkedIn data when you first connect your account and periodically refresh profile data to keep your CRM records current. We may access:

• Profile data (authenticated members): Name, headline, profile picture, and company information of members who have authenticated with SkedX.
• Lead Gen Form response data: Information submitted through LinkedIn Lead Gen Forms, stored per-client in your CRM. Lead Gen Form data is not aggregated across unaffiliated LinkedIn advertising accounts.
• Page messaging data: LinkedIn Page messages managed through LinkedIn's authorized Page Messaging API. This does not include access to members' private LinkedIn messages.

Data Retention Limits: We comply with LinkedIn's Data Storage Requirements. Profile data for LinkedIn members who have not directly authenticated with SkedX is cached for no more than 24 hours and is not permanently stored. LinkedIn member social activity data (likes, comments, shares) is retained for no more than 48 hours. Lead Gen Form response data is stored in your CRM for as long as your account is active or until you request deletion.

Data Use Restrictions: We do not scrape LinkedIn profiles or access data beyond what is authorized through LinkedIn's official APIs. We do not automate LinkedIn messaging, posting, or connection requests. LinkedIn member data obtained through Community Management APIs is displayed within SkedX only and cannot be exported or transferred to third-party systems. We use LinkedIn data only for the specific use cases approved in our LinkedIn Developer Platform application. When processing LinkedIn Lead Gen Form submissions, we capture and respect all consent preferences and custom consent texts configured by the advertiser.

Consent and Deletion: When your LinkedIn OAuth Access Token expires, you will be prompted to re-authenticate and re-consent before data collection resumes. You may withdraw your LinkedIn authorization at any time by visiting LinkedIn Settings > Data Privacy > Permitted Services and removing SkedX, or by contacting us. Upon request, we will delete all LinkedIn-sourced data within 10 days. We will comply with any data deletion requests from LinkedIn within the timeframes specified in their API Terms and are prepared to certify compliance upon request.

LinkedIn data is processed in accordance with the LinkedIn API Terms of Use and LinkedIn Marketing Developer Terms. LinkedIn may audit our use of their APIs and data at any time. We maintain records and processes to demonstrate compliance with LinkedIn's API Terms of Use. All LinkedIn-sourced data is subject to the same GDPR and privacy rights described in Section 7 of this Privacy Policy.

4A.5Google (OAuth, calendar, email, Google Ads, Gemini)

When you sign in with Google or connect a Google service to SkedX, we may access:

• OAuth profile: Name, email address, and profile picture.
• Calendar data: Calendar events for CRM activity sync (only if you explicitly enable Google Calendar sync).
• Email data: Email headers and content for email tracking and logging (only if you explicitly enable Gmail sync).
• Google Ads data: If you connect a Google Ads account to SkedX Flow, we read campaign, ad group, keyword, click and cost reports for that account and upload lead and purchase conversions you choose to send. We use this data only to show your ad results in SkedX Flow and to report conversions back to your own Google Ads account. We never change campaigns, budgets or bids. Disconnecting removes our access; you can also revoke it at any time at myaccount.google.com/permissions.
• Gemini / Agentspace connector: If and when a customer connects SkedX as a Gemini Extension or Google Agentspace connector, SkedX transmits only the CRM records that the signed-in user selects (contacts, deals, tasks, invoices, activities) to the Google model of the user's choice, over TLS, for the sole purpose of generating the user-requested response. No Google user data or Workspace content is stored by SkedX beyond the minimum needed to return the response.

Google API Services User Data Policy — Limited Use disclosure. SkedX's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, SkedX affirms that we:

• Use data received from Google APIs only to provide or improve user-facing features that are prominent in the SkedX user experience;
• Do not transfer data received from Google APIs to third parties except as necessary to provide or improve those features, to comply with applicable law, or as part of a merger, acquisition or sale of assets with notice to users;
• Do not use data received from Google APIs for serving advertisements, including retargeting, personalised, or interest-based advertising; and
• Do not allow humans to read data received from Google APIs unless we have obtained your affirmative consent to view specific messages, doing so is necessary for security purposes (such as investigating abuse), to comply with applicable law, or for SkedX's internal operations, and then only when the data have been aggregated and anonymised.

The same Limited Use restrictions apply to any data SkedX receives from Google's Workspace APIs through Gemini, Google Agentspace, or a Workspace Add-on. Sensitive or Restricted scopes, if we ever request them, will be subjected to annual CASA Tier 2 or Tier 3 assessment as required by Google's OAuth verification process.

4A.6Snapchat (Snap Kit & marketing API)

When you connect Snapchat to SkedX via Snap Kit (Login Kit), you authorize access through Snap's OAuth flow. We may access:

• Profile data: Display name, Bitmoji avatar, and external ID for authentication and personalization.
• Conversions API (CAPI) data: Where Snap Conversions API is enabled, we share hashed event data (hashed email, hashed phone number, event type, timestamp) with Snapchat for ad optimization, measurement, and attribution. Users may opt out of Snap ad tracking through their Snapchat privacy settings.
• Marketing API data: Ad campaign performance data and audience insights for connected Snapchat advertising accounts.

Snap user data may be shared with sub-processors listed in Section 4 solely as necessary to provide the Services. We do not sell, share, or disclose Snap user data to third parties for their marketing purposes. Snap profile data is retained for a maximum of 36 months; accounts inactive for 90 days are automatically disconnected and associated data deleted. User-level Snap ad attribution data is removed after 2 months in compliance with Snap's data retention requirements. Where Snap Pixel is deployed, consent is obtained before Pixel activation in compliance with GDPR and ePrivacy requirements. See our Cookie Policy for Snap Pixel cookie details.

Our use of Snap data complies with the Snap Developer Terms, Snap Business Services Terms, Snap Conversion Terms, and the Snap Privacy Policy (incorporated by reference). US state privacy laws (including CCPA) apply to Snap user data. You may revoke Snap Kit access through Snapchat Settings and request deletion of Snap-sourced data via Data Deletion. SkedX will certify deletion of Snap data upon Snap's request.

4A.7Telegram (Bot API)

When you connect a Telegram Bot to SkedX Flow, we access data through the Telegram Bot API when users interact with your connected Telegram bot. We may access:

• User identifiers: Telegram user ID, username, first name, last name, and language code of users who message your bot.
• Message data: Text content, media files (photos, documents, voice messages), and chat IDs for conversations with your bot.
• Interaction metadata: Timestamps, message delivery status, and callback query data.

Telegram data is used for delivering and receiving messages on your behalf, managing conversations, routing messages to the appropriate team member, providing AI-powered response suggestions (real-time processing only), and analytics. Telegram message content may be processed by AI systems (e.g., OpenAI) for real-time features such as suggested replies and conversation summaries. Telegram data is not used for training, fine-tuning, or developing machine learning or AI models. We only store Telegram data necessary for the messaging service functionality (data minimization).

We do not share Telegram user data with third parties without explicit user authorization or as required by law. Telegram data shared with sub-processors (listed in Section 4) is limited to what is necessary to provide the Services. Telegram data is retained for the duration of your subscription. Upon disconnection of the Telegram integration or account termination, Telegram data is deleted from active systems within 30 days. Backup purge completes within 90 days.

Our use of the Telegram Bot API complies with the Telegram Bot Developer Terms of Service and Telegram Privacy Policy. Users may request deletion of Telegram-sourced data by contacting us at [email protected]. Deletion requests are processed within 30 days. Users can also block the bot at any time through Telegram to immediately stop data collection. In the event of a data breach affecting Telegram data, we will notify affected users in accordance with applicable laws.

4A.8SkedX Flow browser extension

The SkedX Flow Chrome browser extension is an additional client surface for the SkedX Flow platform. When you install the extension and sign in, it overlays your existing Flow inbox on top of web pages you visit (your CRM, Google My Business, LinkedIn, and any other site you grant per-domain permission to) so you can message customers without leaving the page you are working on.

• What the extension reads from web pages: only phone numbers and email addresses that you explicitly click on. The extension does not scrape page content, log browsing history, observe keystrokes, or collect any data passively.
• What the extension transmits: only the value you clicked (plus your session token) to your own SkedX Flow backend. The extension does not send data to Skode-operated infrastructure outside the Flow backend you are signed into.
• What the extension stores locally: your session token, your Flow backend URL, your list of per-site permissions, and your telemetry-opt-in preference. Stored inside the extension’s private chrome.storage.local area, not accessible to any website.
• Chrome permissions used: storage, narrow host_permissions for Zoho and Salesforce, runtime-granted optional_host_permissions for any other site you enable, and contextMenus for the right-click “Open in SkedX Flow” action. The extension does not request history, cookies, webRequest, tabs, downloads, or any other broad permission.

For full detail — including per-permission justifications, opt-out paths, retention, and data-subject rights specific to the extension — see our Extension Privacy Notice.

4A.9Connected calling platforms

When an organisation connects a third-party calling platform to the SkedX CRM (for example a telephony provider delivering call logs by webhook), we receive and process the call data that platform delivers — call logs and, where the organisation configures it, recordings and transcripts — on the organisation's behalf, on the same terms as SkedX Call data, regardless of which platform carried the call. The organisation's relationship with those platforms — including any verification they require and the lawfulness of the calls they carried — remains its own; our role for that data is processor only.

4A.10Online stores (Shopify and WooCommerce)

When an organisation connects its Shopify store (through the SkedX for Shopify app) or its WooCommerce store (through the SkedX plugin), SkedX processes its shoppers’ data on the organisation’s behalf, as its processor. The organisation is the controller, and shoppers should send privacy requests to the store they bought from.

• What we receive: customers’ names, phone numbers, email addresses and marketing consent; orders (number, status, items, totals, payment method type, contact details and shipping address); deliveries and their status; abandoned checkouts; and products with their variants, prices and stock. We never receive card or other payment details.
• Why: to send the order, delivery and abandoned-cart messages the organisation switches on, to show orders in the organisation’s inbox, to offer “Track my order” on its store, and to let its AI assistant answer product and stock questions. Marketing messages go only to shoppers who have consented to them, and opt-outs are written back to Shopify.
• Protection: in SkedX’s store records, shoppers’ names, phone numbers, email addresses and shipping addresses are encrypted by the application before they are saved, and reads of them are logged.
• Deletion: a Shopify customer deletion request deletes that shopper’s data across SkedX for the organisation: the store records, inbox contacts and conversations, automation history and store analytics. Opt-out records are kept so the shopper is never messaged again. A shop deletion request deletes the store’s records, the products copied from it, its reviews, its automation history and the analytics recorded on its web addresses. Data from a disconnected WooCommerce store is kept until the organisation asks us to delete it or closes its SkedX account.

The SkedX for Shopify Privacy Policy describes these data flows in full.

4A.11Zoom

When a SkedX CRM user connects their own Zoom account (Settings → Integrations → Zoom), they authorize SkedX through Zoom's OAuth 2.0 flow. Each person connects their own Zoom; a connection only ever creates meetings for the person who connected it. SkedX uses this access only to:

• Create, update and cancel meetings: when the user books, moves, cancels or deletes a meeting in SkedX CRM, SkedX creates, reschedules or deletes the matching Zoom meeting. SkedX sends Zoom only the meeting's title, start time, duration and time zone — never attendees, notes, agendas or CRM records.
• Show which account is connected: the connected Zoom user's name, email address and Zoom user ID.

What we store: the Zoom meeting ID and its join link on the CRM meeting record, and the connected user's Zoom name, email and user ID. OAuth access and refresh tokens are stored encrypted at rest. We do not store the meeting host's start link, and we do not access recordings, chats, transcripts, audio, video or any other meeting content.

Removal and deletion: disconnecting Zoom in SkedX (Settings → Integrations → Zoom → Disconnect) revokes SkedX's access at Zoom and deletes the stored tokens immediately. If you remove the SkedX CRM app inside Zoom, Zoom notifies SkedX and we disconnect the account and delete its tokens immediately. Meetings already booked keep their meeting ID and join link in the CRM as part of the meeting record, which the organisation controls and can delete at any time. Zoom data is not sold, not shared with third parties, and not used for advertising or profiling. Questions or deletion requests: [email protected].

5Cookies and tracking

We use cookies and similar tracking technologies to enhance your experience. For detailed information about the types of cookies we use, how to manage them, and your choices, please refer to our Cookie Policy.

5.1Email open and click tracking

When an email is sent through the Services — including lead and contact correspondence, invoices, payment reminders, and other CRM and Flow communications — we may embed a small, invisible image (a “tracking pixel” or web beacon) and rewrite the links in the message so that we can record whether the email was opened and which links were clicked. This is standard email-engagement tracking and helps senders understand whether their messages are reaching and being read by their recipients.

For tracked emails we may record:

• Open events: the date and time an email was opened, and how many times, inferred from the loading of the tracking pixel.
• Click events: the date, time, and destination of links clicked within the email.
• Technical data: limited information sent automatically by the recipient’s email client when the pixel or link loads, such as IP address and user-agent. We do not use this data to build advertising profiles of recipients.
• Delivery outcomes: delivery, bounce, and spam-complaint notifications received from email providers (for example, via Amazon SES and SNS).

Suppression list and opt-out. If an address hard-bounces, files a spam complaint, or unsubscribes, we add it to a per-organisation do-not-email (suppression) list and stop sending to it. Every applicable email includes a one-click unsubscribe mechanism (the List-Unsubscribe and List-Unsubscribe-Post headers per RFC 8058), and recipients can unsubscribe at any time using the link in any email — without needing to log in, pay a fee, or provide any information beyond their email address. Unsubscribing is honoured promptly and permanently for that organisation’s sending.

Where a customer sends email to their own recipients through the Services, that customer is the sender and controller of those communications under applicable law. SkedX acts as a processor providing the sending and tracking infrastructure. For the rules that govern this sending, see our Email Sending & Deliverability Policy and Anti-Spam Policy. To exercise your rights or ask a question about email tracking, contact [email protected].

5.2Analytics and advertising

We use analytics and advertising tools — our own SkedX Signal, Google Tag Manager and the Meta Pixel — to understand how people use skode.ai, to improve it, and to measure which of our ads bring visitors and customers.

• What they receive: the pages you view and the buttons you use, your device and browser type, your IP address, and whether you arrived from one of our ads.
• When you book a demo, sign up, start a trial or pay: we tell our advertising partners that it happened, with a scrambled (hashed) copy of your email address and the identifier of the ad you clicked, so they can tell us which ad brought you. We never share your phone number for this.
• Where they load: on most of skode.ai only after you accept analytics and advertising cookies; on the pages you reach from one of our ads, and the thank-you page after a booking, when the page opens. If your browser sends Global Privacy Control or Do-Not-Track, they do not load anywhere on skode.ai.
• How long: your browser details are kept for at most 7 days for this purpose. Our partners keep what they receive under their own policies — Meta and Google.
• Our basis: your consent where we ask for it; elsewhere our legitimate interest in knowing which of our ads work.
• Turning it off: reject on our cookie banner, or change your choice any time in our Cookie Policy. We remember your choice for 12 months if you accept and 6 months if you reject, then ask once more.

6Data retention

We retain your personal information only for as long as we need it to provide the Services, to comply with our legal obligations, or to resolve disputes. Specifically:

• Account Data: Retained for the duration of your account plus 30 days after a deletion request.
• CRM Data (leads, contacts, notes, tasks, messages): Retained for the duration of your subscription. Upon termination, data is available for export for 30 days, then permanently deleted within 90 days.
• Call recordings and transcripts (SkedX Call): Retained per the organisation's plan (90 days or 1 year, or per an archive add-on), or until the organisation deletes them; deleted on plan expiry. Call metadata follows the CRM Data retention above.
• Calling verification (KYC) documents: Business registration documents are retained for the life of the account plus 3 years. Personal identity documents of authorised signatories are deleted or minimised within 90 days of account termination, save where law requires longer retention.
• Billing and invoice records: Retained for 7 years from the end of the relevant financial year, as required by the Indian Income-tax Act, 1961 and the Central Goods and Services Tax Act, 2017 (Section 36, which mandates a 72-month retention of records by every registered person). Equivalent tax-retention obligations in other jurisdictions may extend this period where applicable.
• AI Connector audit logs: Successful events are automatically purged after 30 days; failed events are kept longer for investigation.
• Lead-assignment logs: Automatically purged after 90 days.
• Password-reset tokens: Expire within 30–60 minutes. Workspace-invite tokens: Expire after 7 days. User sessions: Maximum 7-day lifetime.
• Server and application logs: Retained for 90 days for security, debugging, and abuse-investigation purposes.
• Marketing data (if you opted in): Retained until you unsubscribe or request deletion.

We are actively working to shorten the indefinite retention on CRM records through workspace-level retention controls. If you require a specific retention cap, contact us at [email protected].

7Your privacy rights

7.1Rights under GDPR (European Economic Area)

If you are located in the EEA, you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erase your personal data ("right to be forgotten").
• Restrict processing of your personal data.
• Data portability (receive your data in a structured, machine-readable format).
• Object to processing based on legitimate interests or direct marketing.
• Withdraw consent at any time where processing is based on consent.
• Lodge a complaint with your local data protection authority.

7.2Rights under CCPA (California)

If you are a California resident, you have the right to:

• Know what personal information we collect about you.
• Request deletion of your personal information.
• Opt out of the sale of your personal information (we do not sell personal information).
• Non-discrimination for exercising your privacy rights.

7.3Rights under Indian data protection laws

If you are located in India, you have rights under the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology Act, 2000. As a Data Principal you have the right to:

• Access a summary of the personal data we process and the processing activities (§ 11).
• Correction, completion, updating, and erasure of your personal data (§ 12).
• Withdraw your consent at any time, as easily as you gave it (§ 6).
• Grievance redressal through our Grievance Officer (§ 13).
• Nominate another individual to exercise your rights in the event of death or incapacity (§ 14) — write to our Grievance Officer to record a nominee.

To exercise these rights or raise a concern, contact our Grievance Officer. If your grievance is not resolved, you may complain to the Data Protection Board of India. Our Services are only for people aged 18 or over. We do not knowingly process a child’s personal data, and we do not track, behaviourally monitor, or serve targeted advertising to children (§ 9 of the DPDP Act; see § 10 below).

7.4Rights under UK GDPR (United Kingdom)

If you are located in the United Kingdom, you have rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, including the right to access, rectify, erase, restrict processing, data portability, and object to processing. You may also lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk. Our EU/UK representative can be contacted via our EU/UK Representative page.

7.5Rights under New Zealand Privacy Act 2020

If you are located in New Zealand, you have rights under the Privacy Act 2020, including the right to access your personal information, request correction of inaccurate information, and complain to the Office of the Privacy Commissioner. Under Information Privacy Principles (IPPs) 6 and 7, you may request access to and correction of any personal information we hold about you. We will respond to requests within 20 working days. To make a request, contact us at [email protected]. You may also lodge a complaint with the Office of the Privacy Commissioner.

7.6Rights under UAE Personal Data Protection Law (PDPL)

If you are located in the United Arab Emirates, you have rights under Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) and its Executive Regulations. Your rights include the right to access your personal data, request correction or deletion, restrict or object to processing, request data portability, and withdraw consent. We will process requests within 14 days. Personal data of UAE residents is processed in accordance with the requirements of the UAE Data Office. For requests, contact us at [email protected].

7.7Rights under the Australian Privacy Act 1988

If you are located in Australia, your personal information is handled in accordance with the Privacy Act 1988 (Cth) and the thirteen Australian Privacy Principles (APPs). You have the right to request access to the personal information we hold about you, request correction of information that is inaccurate or out of date, and ask how your information is collected, used, and disclosed (including any disclosure to overseas recipients under APP 8). We will respond to access and correction requests within a reasonable period (generally 30 days). If you believe we have breached the APPs, you may complain to us at [email protected]; if you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

8Data security

We implement industry-standard security measures to protect your data, including:

• Encryption in transit (TLS 1.2 or higher). At rest, customer files and backups are stored on AWS S3 (Mumbai region) with AWS-managed server-side encryption; payment-gateway credentials are Fernet-encrypted inside our database; user passwords are stored as PBKDF2-SHA256 hashes.
• Role-based access controls with strict workspace (org_id) isolation and fail-closed query filters. SAML 2.0 and OIDC single sign-on for enterprise customers.
• API keys used by the AI Connector are stored as SHA-256 hashes with 90-day automatic expiry and 256-bit generation entropy. Mutual TLS (mTLS) is enforced on the OpenAI Connectors endpoint.
• Session cookies are HTTP-only, Secure (in production), and SameSite=Lax with a 7-day maximum lifetime.
• Regular, encrypted backups retained per our disaster-recovery plan.
• Hosting on AWS Mumbai (ap-south-1), which operates within an AWS SOC 2 Type II-attested environment. Skode Technologies Private Limited does not itself hold a SOC 2 attestation today; SOC 2 readiness is on our security roadmap. Two-factor authentication for user accounts is also on our roadmap but not yet available; we recommend a strong, unique password until it ships.

While we strive to protect your information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

9International data transfers

Your information may be transferred to and processed in countries other than your own. We and our sub-processors are likely to process personal data in India (where SkedX is established and where our primary data centre is located, AWS Mumbai), the United States (certain cloud, AI, payment, and analytics providers), and the European Union / EEA and the United Kingdom. The current list of sub-processors and the countries in which they operate is maintained on our Sub-Processors page. This disclosure is provided to meet, among others, Australian Privacy Principle 8 and 1.4(g) and New Zealand Information Privacy Principle 12. When we transfer data outside your jurisdiction, we ensure appropriate safeguards are in place:

9.1EU/EEA transfers

For transfers of personal data outside the EU/EEA, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission (adopted June 2021), the EU-US Data Privacy Framework where applicable, or adequacy decisions. We conduct Transfer Impact Assessments (TIAs) and implement supplementary technical measures (encryption, pseudonymization) where required.

9.2UK transfers

For transfers of personal data outside the United Kingdom, we rely on the UK International Data Transfer Agreement (UK IDTA) issued by the Information Commissioner's Office (ICO), and/or the UK Addendum to the EU Standard Contractual Clauses (the "UK Addendum"), as approved under Section 119A of the Data Protection Act 2018. Where the UK Government has made adequacy regulations recognising a country as providing adequate data protection, no additional safeguards are required for transfers to that country. We assess each transfer to ensure that the laws of the recipient country do not undermine the protections guaranteed by UK GDPR.

10Children's privacy

Our Services are only for people aged 18 or over, and are not directed to anyone under 18. We do not knowingly collect personal information from children. If we become aware that a child under 18 has provided us with personal information, we will take steps to delete such information promptly. If you believe a child has provided us with personal data, please contact us at [email protected].

Consistent with § 9 of India’s DPDP Act, the US Children’s Online Privacy Protection Act (COPPA), and equivalent rules, we do not undertake tracking, behavioural monitoring, or targeted advertising directed at children, and we do not knowingly process a child’s personal data: accounts are available only to people aged 18 or over.

11Third-party links and services

Our Services may contain links to third-party websites, services, or integrations. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party service you interact with.

12Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on our website and updating the "Last updated" date. For significant changes, we will provide additional notice via email or an in-app notification. Your continued use of the Services after changes become effective constitutes acceptance of the revised policy.

13Security vulnerability reporting

If you discover a security vulnerability in any SkedX product or service, we encourage you to report it responsibly. Please email [email protected] with a detailed description of the vulnerability, steps to reproduce, and any supporting evidence. We will acknowledge receipt within 2 business days and work to address confirmed vulnerabilities promptly. We request that you do not publicly disclose the vulnerability until we have had a reasonable opportunity to address it.

14Contact us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Data controller & privacy contact

Other contact channels

• General Privacy Inquiries: [email protected]
• Legal Inquiries: [email protected]
• Security Vulnerabilities: [email protected] (see also security.txt)
• Grievance Officer (India — IT Rules 2021 & DPDPA 2023): View named Officer and details
• Data Deletion Requests: Submit a Request
• EU / UK Representatives: SkedX does not currently have an establishment in the EU or UK and therefore has no Article 27 representative appointed. If you are an EEA or UK resident with a privacy concern, please write to [email protected]. We will update this section if and when a Representative is appointed.

15Related policies & documents

This Privacy Policy should be read alongside the rest of our legal and compliance documentation. All of our policies are collected in our Legal & Compliance Center. The documents most closely related to this Privacy Policy are:

• Cookie Policy — cookies and tracking technologies we use.
• Data Processing Agreement — our obligations when we process customer data as a processor.
• Sub-Processors — third parties that process data on our behalf.
• Data Deletion Policy — how to request deletion and our retention rules.
• Data Subject Access Requests (DSAR) — how to exercise your access rights.
• GDPR & UK GDPR Rights — rights for EEA and UK residents.
• CCPA Notice — California privacy rights and “Do Not Sell.”
• EU & UK Representative — representative contact details.
• Grievance Officer — India IT Rules / DPDPA grievance contact.
• Extension Privacy Notice — the SkedX Flow browser extension.
• Widget Privacy Notice — the SkedX chat widget.
• SkedX for Shopify Privacy Policy — store data from Shopify and WooCommerce.
• AI Transparency Policy — how we use AI and your data.
• Opt-In & Consent Policy — consent for messaging.
• WhatsApp Business Compliance — Meta/WhatsApp policy requirements.
• SMS Compliance Policy and SMS Terms — SMS sending rules.
• Email Deliverability & Sending Policy — email sending standards.
• Push Notification Disclosure — how push notifications are used.
• Anti-Spam Policy — rules against unsolicited messaging.
• Security — how we protect your data.
• Terms of Service and Acceptable Use Policy — the agreements governing use of the Services.