Effective date: 8 September 2026
Last updated: 8 September 2026
OptiCrux AI Labs LLP (“OptiCrux”, “we”, “us”, or “our”) provides AI-powered customer engagement, conversational messaging, workflow automation, digital growth, and business operations services. This Privacy Policy explains how we collect, use, disclose, retain, and protect personal data when you visit https://opticrux.com, use the OptiCrux AI Command Center at https://app.opticrux.com, communicate with a business using services powered by OptiCrux, or otherwise interact with us.
1. Scope and roles
This Policy applies to our websites, applications, dashboards, APIs, WhatsApp integrations, voice services, and related services (collectively, the “Services”).
Depending on the circumstances, OptiCrux may act as:
- a data controller when we determine why and how personal data is processed, such as data about our own customers, website visitors, account users, and business contacts; or
- a data processor/service provider when we process messages, customer records, or other data on behalf of a client organization. In that case, the client organization is responsible for its own privacy notices, legal basis, instructions, and responses to data-subject requests.
2. Personal data we collect
We may collect the following categories of data:
- Identity and contact data: name, business name, job title, email address, telephone or WhatsApp number, postal address, and account identifiers.
- Account and organization data: login and authentication information, organization membership, role, permissions, user status, preferences, and audit information.
- Communication data: WhatsApp messages, email or SMS content, voice-call audio where enabled, transcripts, attachments, message timestamps, delivery status, sender and recipient identifiers, and conversation history.
- Customer and operational data: leads, customers, cases, notes, assignments, workflow records, follow-ups, and information submitted through forms or integrations.
- Technical and usage data: IP address, browser and device information, operating system, cookies, request logs, diagnostic events, security events, webhook metadata, and use of features.
- AI-processing data: prompts, transcripts, messages, workflow context, and generated responses needed to provide AI-assisted features.
- Business and billing data: service enquiries, contracts, invoices, payment status, and related records. Payment-card details may be processed directly by payment providers and are not intentionally stored by us unless expressly stated.
- Information supplied by clients or integrations: data received from client organizations, Meta and WhatsApp, Supabase, OpenAI, email providers, telephony providers, or other services authorized by the client.
Please do not send sensitive personal data through the Services unless it is necessary, lawful, and specifically authorized by the relevant organization.
3. How we collect data
We collect data directly from you; from organizations that use our Services; automatically through our websites and applications; and from authorized platforms and integrations, including the WhatsApp Business Platform and Meta webhooks.
4. How we use personal data
We may use personal data to:
- provide, operate, secure, troubleshoot, and improve the Services;
- authenticate users and enforce organization roles and permissions;
- receive, route, display, respond to, and retain business communications;
- create and manage leads, customers, cases, conversations, and workflows;
- provide AI-assisted responses, summaries, classification, automation, and workflow execution;
- deliver messages, service notifications, invitations, and support;
- monitor availability, prevent fraud and abuse, investigate incidents, and maintain audit records;
- comply with law, enforce agreements, and protect legal rights; and
- analyze service performance using aggregated or de-identified information where appropriate.
We do not sell personal data. We do not use WhatsApp message data for independent advertising purposes.
5. WhatsApp Business Platform and Meta data
When a business connects a WhatsApp Business Account to OptiCrux, we may process WhatsApp phone numbers, profile information, message content, attachments, message identifiers, timestamps, delivery and read status, template information, and webhook events. We process this information to provide messaging, customer support, workflow automation, conversation history, and related Services requested by the business.
WhatsApp and Meta independently process data under their own terms and privacy policies. Businesses using OptiCrux remain responsible for obtaining required consents, providing required notices, honoring opt-outs, and complying with WhatsApp Business Messaging policies and applicable law.
6. AI-assisted processing
Some Services use artificial intelligence to transcribe, classify, summarize, draft responses, extract relevant information, or execute configured workflows. AI output may be inaccurate and should be reviewed by an authorized human where decisions could materially affect a person. We do not intend AI features to make solely automated legal, employment, credit, healthcare, or similarly significant decisions about individuals.
7. Legal grounds
Where required by applicable law, we process personal data based on one or more of the following: performance of a contract; legitimate interests in providing, securing, and improving the Services; consent; compliance with legal obligations; and protection of legal rights. A client organization may rely on a different lawful basis when instructing us to process data on its behalf.
8. How we disclose data
We may disclose data only as reasonably necessary to:
- the client organization that controls the relevant workspace or communication channel;
- authorized users and service personnel subject to access controls;
- service providers supporting hosting, databases, authentication, AI processing, communications, email delivery, monitoring, and security, including Meta/WhatsApp, Supabase, Vercel, OpenAI, and Hostinger where those services are used;
- professional advisers, auditors, insurers, and transaction advisers under appropriate confidentiality obligations;
- regulators, courts, law-enforcement bodies, or other parties where required by law or necessary to protect rights and safety; and
- a successor in connection with a merger, restructuring, financing, or sale, subject to applicable safeguards.
We require service providers to process data only for authorized purposes and under appropriate contractual and security obligations.
9. International processing
Our service providers and clients may process data in countries other than the country where it was collected. Where required, we use contractual, organizational, or other lawful safeguards for international transfers.
10. Data retention
We retain personal data only for as long as reasonably necessary to provide the Services, fulfill the purposes described in this Policy, comply with contractual and legal obligations, resolve disputes, prevent abuse, and enforce agreements. Retention depends on the data type, client instructions, account status, security needs, and applicable law.
When a valid deletion request is approved, we delete or de-identify applicable data from active systems within a reasonable period, normally within 30 days, unless retention is required by law, necessary for security or legal claims, or subject to a documented client instruction. Residual copies may remain in encrypted backups until those backups rotate under our normal retention cycle.
11. Security
We use reasonable technical and organizational safeguards, including access controls, tenant separation, authentication, encryption in transit, provider security controls, logging, and restricted administrative access. No system can guarantee absolute security. Users are responsible for protecting their credentials and promptly reporting suspected unauthorized access.
12. Cookies and similar technologies
We may use necessary cookies for authentication, security, preferences, and service operation, and optional analytics or marketing technologies where enabled. Please see our Cookies Policy for additional information and available choices.
13. Your choices and rights
Subject to applicable law and relevant exceptions, you may request access to, correction of, deletion of, restriction of, or a copy of your personal data, or object to certain processing. You may withdraw consent where processing is based on consent. You may also opt out of marketing communications using the method provided in the communication.
If OptiCrux processes your data solely for a client organization, please contact that organization first. We will assist the organization as required by our agreement and applicable law.
To submit a privacy or deletion request, email info@opticrux.com with sufficient information to identify the relevant account or communication. We may verify your identity and authority before acting.
14. Children’s privacy
The Services are intended for businesses and adults and are not directed to children. We do not knowingly collect personal data from children without appropriate authorization. Contact us if you believe a child has provided data improperly.
15. Third-party services and links
Our Services may contain links to or integrate with third-party services. Their processing is governed by their own notices and terms. We are not responsible for third-party practices outside our control.
16. Changes to this Policy
We may update this Policy to reflect changes in our Services, providers, or legal obligations. We will post the revised version with a new “Last updated” date and provide additional notice where required.
17. Contact us
OptiCrux AI Labs LLP
Plot No. 1250, Padmashali Township, Dammaiguda, Hyderabad, Telangana 500083, India
Email: info@opticrux.com
Website: https://opticrux.com
For deletion requests, see https://opticrux.com/data-deletion/.