1. Introduction

This Privacy Policy explains how Intellixio ("we," "us," or "our") collects, uses, discloses, and safeguards information when you use our ZendoLead autonomous AI sales agent service (the "Service"). This policy applies to all our customers and platform users ("you" or "your"). ZendoLead is owned and operated by Intellixio.

2. Our Data Protection Roles: Controller vs. Processor

Understanding our role is critical for data protection laws like GDPR. This distinction defines our respective legal responsibilities.

• 2.1 We are the Data Controller for Customer Account Data. This is the personal information you provide directly to us to create and manage your account (e.g., your name, company name, email, password, and billing information).
• 2.2 We are the Data Processor for Service Data. This is all data we process on your behalf and according to your instructions to provide the Service. It includes:
  • Your Knowledge Base (the business documents you provide for AI training).
  • Sourced Lead Data (contact information of potential business leads we source for you).
  • Conversation Data (the AI's interactions with those leads).

When we process Service Data, you are the Data Controller. You are responsible for ensuring you have a lawful basis (e.g., Legitimate Interest for B2B marketing) for instructing us to source and process this data. Our obligations as your Processor are defined in our Terms of Service and our Data Processing Addendum (DPA).

3. Information We Process and Its Legal Basis

4. How We Use Information

We use the information we process for specific purposes:

• Customer Account Data: To manage your account, provide customer support, process payments, and send you service-related and marketing communications (from which you can opt out).
• Service Data: To provide the core functionality of the Service, including training your dedicated AI agent, sourcing and engaging leads, and delivering qualified lead reports to you.
• AI Model Training: To improve our core algorithms and the overall quality of our Service, we may use Service Data in an anonymized and aggregated form. Your confidential, identifiable business information is never used to train models for other customers.

5. Data Sharing and Disclosure

We do not sell your personal data. We only share information with:

• Service Providers: Trusted third-party vendors who perform services on our behalf, such as cloud hosting providers and payment processors. They are contractually bound to protect your data.
• On Your Instruction: We deliver lead reports via platforms like WhatsApp as part of the Service.
• Legal Requirements: If required by law, subpoena, or other valid legal process.
• Business Transactions: In connection with a merger, acquisition, or sale of assets, with appropriate legal and security safeguards.

6. Data Security

We implement robust technical and organizational security measures, including end-to-end encryption, data-at-rest encryption, access controls, and regular security assessments, to protect all data we process.

7. Data Subject Rights

Your rights, and how to exercise them, depend on the type of data and our role.

• For Your Customer Account Data (where we are Controller): You have the right to access, rectify, erase, or object to the processing of your account data. You can exercise these rights by contacting us directly at [email protected].
• For Service Data (where you are Controller): If a sourced lead contacts us to exercise their data rights, we will direct them to you. As your Data Processor, we will provide you with the necessary assistance and tools to help you respond to requests for access, rectification, or erasure from the individuals whose data we process on your behalf.

8. International Data Transfers

As a global service, information may be processed in jurisdictions outside of your own. When we transfer personal data from the European Economic Area (EEA), UK, or Switzerland, we ensure data is protected by using legally-approved mechanisms such as the European Commission's Standard Contractual Clauses (SCCs).

9. Data Retention

• Customer Account Data: We retain your account data for as long as your account is active and as required to comply with our legal and financial obligations.
• Service Data: We retain Service Data processed on your behalf for the duration required to provide the Service. This data is securely deleted from our active systems within 90 days of the termination of your account.

10. Data Breach Notification

In the event of a data breach affecting the Service Data we process on your behalf, we will notify you, the Data Controller, without undue delay so you can fulfill your legal obligations to the affected individuals and regulatory authorities.

11. Children's Privacy

Our Service is not directed to individuals under the age of 18, and we do not knowingly collect their data.

12. Changes to This Privacy Policy

We may update this policy to reflect changes in our practices or legal requirements. We will notify you of significant changes by posting the new policy on our website and, where appropriate, via email.

13. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact our Data Protection Team at: