TradeEximOS

Privacy Policy

Effective date: 1 April 2026 · Last updated: 15 September 2026

TradeEximOS is committed to handling your data responsibly. This Policy explains what we collect, why we collect it, how we protect it, and what rights you have.

AES-256 Encryption at Rest

TLS 1.2+ In Transit

GCP India Region

Daily Encrypted Backups

RBAC + MFA Access Controls

1. Data We Collect

Account data: name, email address, organisation name, and billing details provided during registration or subscription.
Usage data: pages visited, features used, session duration, and interaction logs — collected automatically via cookies and server logs.
Business data: leads, contacts, orders, quotations, products, email campaigns, social posts, and any other content you upload or create within the platform.
Integration data: when you connect third-party services (Gmail, Outlook, LinkedIn, HubSpot, Facebook, Instagram, WhatsApp Business, etc.), we store the OAuth tokens and any data synced through those integrations. For WhatsApp Business, this includes the messages sent and received through your connected number. Meta platform data is described in full in Section 9.
AI interaction data: prompts, queries, and outputs generated through AI features, used to improve model accuracy and platform quality (see Section 6). This never includes data received through Meta integrations (Section 9).

2. How We Protect Your Data

All data is encrypted in transit using TLS 1.2+ and at rest using AES-256 encryption on cloud storage.
Our infrastructure runs on Google Cloud Platform (GCP) with data hosted in India (asia-south1 region) to comply with data localisation norms.
Access to production databases is restricted to authorised personnel only, via role-based access controls (RBAC) and multi-factor authentication.
We conduct regular vulnerability scans and penetration tests. Security findings are triaged and resolved according to severity SLAs.
We maintain an incident response plan. In the event of a data breach, affected users will be notified within 72 hours as required by applicable law.
Backups are taken daily, encrypted, and stored in geographically separate storage for disaster recovery.

3. How We Use Your Data

To operate and deliver the TradeEximOS platform, including processing your subscriptions, running your campaigns, and powering AI features.
To communicate with you about your account, billing changes, product updates, and support queries.
To analyse aggregated, anonymised usage patterns to improve the platform. We never use individual business data (leads, orders, etc.) for this purpose.
To comply with legal obligations, including tax regulations, court orders, or lawful requests from regulatory authorities.

4. Data Sharing & Third Parties

We do not sell, rent, or trade your personal or business data to any third party for marketing or commercial purposes.
We share data with trusted sub-processors only to the extent necessary to run the platform (e.g., cloud infrastructure, email delivery, payment processors). All sub-processors are bound by data processing agreements.
If you use a third-party connector (e.g., Facebook, Instagram, or WhatsApp from Meta, LinkedIn, Salesforce), data you choose to sync, publish, or send is also processed by that provider and is governed by both this Policy and the third party's own privacy policy.
We may disclose data if required by law, regulation, or a valid governmental request, and will notify you where permitted to do so.

5. Your Rights

Access: you may request a copy of all personal data we hold about you at any time.
Correction: if any data we hold is inaccurate or incomplete, you may request a correction.
Deletion: you may request deletion of your account and associated personal data. Business data (leads, orders, etc.) is deleted within 30 days of account closure.
Data portability: you may export your business data (leads, contacts, orders, products) in CSV format from within the platform at any time.
Withdrawal of consent: where processing is based on consent (e.g., marketing emails), you may withdraw consent at any time without affecting prior processing.
To exercise any of these rights, contact info@tradeeximos.com. We will respond within 15 business days.

6. AI & Data Usage

AI features (win probability, content generation, market strategy, buyer discovery) process your data locally within our infrastructure — your business data is never sent to third-party AI providers in a way that trains their public models.
We use anonymised, aggregated signals across the platform to improve our own AI models. Individual business data (specific leads, orders, customers) is never used for cross-customer model training.
Data received through Meta integrations — Facebook, Instagram, and WhatsApp, including WhatsApp message content and contact phone numbers — is used only to provide the integration you connected. It is excluded from all AI model training and improvement, including the aggregated signals described above.
Social media content may be drafted by AI, but it is only published to a connected Facebook or Instagram account, or sent through a connected WhatsApp number, as a result of your own action — publishing, sending, or scheduling it yourself. TradeEximOS does not independently decide to post or send on your behalf.
AI-generated outputs are suggestions only and do not constitute professional, legal, tax, or customs advice. See the "AI Output & Customer Verification" section of our Terms of Service for the full disclaimer, which applies in particular to trade-compliance features (HS classification, duty estimates, RoDTEP/DGFT evaluations).

7. Data Retention

Paid subscription data is retained for the duration of your subscription plus 12 months, to support billing disputes and regulatory requirements.
Free plan data is retained for as long as the account is active plus 6 months following account deletion.
After the retention period, data is securely purged from all systems including backups within 90 days.
Certain metadata (e.g., billing records) may be retained for up to 7 years as required by Indian tax and accounting laws.
Meta platform data (Facebook, Instagram, WhatsApp) follows the connection-based retention described in Section 9 and can be deleted at any time by disconnecting the integration.

8. Cookies & Tracking

We use essential cookies required for the platform to function (session management, authentication). These cannot be disabled.
We use anonymised analytics cookies (Google Analytics) to understand how the platform is used. These are off by default and are only loaded after you accept them in the cookie consent banner shown on your first visit — not loaded and then hidden.
We do not use third-party advertising or tracking cookies.
See our Cookie Policy for full details and how to change your choice at any time.

9. Meta Platform Data (Facebook, Instagram, WhatsApp)

Facebook Login: connecting Facebook, Instagram, or WhatsApp uses Meta's Facebook Login, which includes Meta's default public_profile permission. We use it only to authenticate you with Meta and to identify the Business, Pages, or WhatsApp Business Accounts you choose to connect — never for advertising or profiling.
Facebook: when you connect a Facebook Page, we request the pages_show_list, pages_manage_posts, and pages_read_engagement permissions to list your Pages, publish posts on your behalf, and read engagement metrics. We store the Page ID, Page name, Page category, and a Page access token.
Instagram: when you connect an Instagram Business or Creator account, we request the instagram_business_basic and instagram_business_content_publish permissions to read your account details and publish content on your behalf. We store your Instagram user ID, username, account type, and access token.
WhatsApp Business account: when you connect a WhatsApp Business Account, we request the whatsapp_business_management and whatsapp_business_messaging permissions to connect your number and to send and receive messages on your behalf. We store your WhatsApp Business Account ID, Meta Business ID, phone number and phone number ID, business and display name, and connection status. Access tokens and the number's two-step verification PIN are stored encrypted.
WhatsApp messages: to provide the team inbox, messaging, and campaign features, we store messages sent through TradeEximOS and messages received by your connected number. This includes sender and recipient phone numbers, the contact's WhatsApp profile name, message text, media captions and media identifiers, template names and parameters, delivery and read status, timestamps, and the related webhook data Meta sends us. If a contact's phone number exactly matches a lead in your workspace, the conversation is linked to that lead.
How we use Meta data: solely to provide the connection, publishing, messaging, inbox, and campaign features you enable. It is never sold, never shared with third parties for advertising, never used to build marketing profiles, and never used to train or improve AI models — ours or anyone else's.
Who can access it: only authorised users of your workspace, according to the roles and permissions your organisation assigns, and TradeEximOS personnel where strictly necessary for support, security, or legal compliance. Messages are transmitted through Meta's WhatsApp Business Platform, which is also governed by Meta's own terms and privacy policy.
Retention & deletion: Meta data is kept only while the integration is connected. Disconnecting an integration from Connectors immediately deletes the connection record and its tokens; for WhatsApp, it also deletes the stored messages and conversations for that number. Any remaining technical webhook logs are deleted on request.
To request deletion of any Meta-related data, email info@tradeeximos.com or follow our Data Deletion Instructions at tradeeximos.com/data-deletion.

10. How We Process Data You Upload About Others

Where you upload or instruct us to process personal data relating to your own customers, leads, employees, or other individuals, you are responsible for ensuring you have the required legal basis and permissions for that processing.
TradeEximOS processes such data solely to provide the Services on your instructions — we do not independently decide why or how that data should be collected.

11. Children's Privacy

TradeEximOS is a business platform intended for use by adults acting on behalf of an organisation. It is not directed to, and we do not knowingly collect personal data from, anyone under the age of 18.
If we become aware that we have inadvertently collected data from a minor, we will delete it promptly upon verification.

12. International Data Transfers

Our primary infrastructure is hosted in India (GCP asia-south1 region). Certain sub-processors that support AI features may process data outside India as part of providing those features.
Any such transfer is made in accordance with the Digital Personal Data Protection Act, 2023, and not to a jurisdiction restricted by the Indian government.

13. Grievance Officer & Data Protection Contact

We have appointed a Grievance Officer and implemented the applicable intermediary and data-protection compliance requirements under Indian law, including the Information Technology Rules, 2021 and the Digital Personal Data Protection Act, 2023.
Grievance Officer: [TODO: name, designation, and contact details to be confirmed].
You may also reach us at info@tradeeximos.com; we aim to acknowledge grievances within 15 business days.

Privacy questions or data requests?

info@tradeeximos.com