Privacy Policy

Plain-language summary: We collect what we need to run your account and your campaigns. We do not sell personal data. Your account data and our main database are in India (Mumbai); a small number of specialist providers process some data outside India, all listed on our Sub-processors page. If you are outside India, Section 11 explains your additional rights. You can ask us to access, correct or delete your data at any time by writing to support@autonomiqa.co.

1. Who we are

Autonomiqa ("we", "us", "our") is business-to-business software for AI-assisted outbound sales, available at autonomiqa.app. Our customers use it to define a target audience, find business contacts, write outreach with AI, and send it from their own LinkedIn and email accounts. We operate from India. For privacy questions, write to support@autonomiqa.co.

2. Two kinds of data: please read this first

How we handle personal data depends on whose data it is:

• Data about you as a customer, team member or website visitor. We decide why and how this data is used, so we are the Data Fiduciary under the Digital Personal Data Protection Act, 2023 ("DPDP Act"). Everything in this policy applies to you directly.
• Data about prospects: the business contacts our customers reach out to. Here our customer is the Data Fiduciary and we act as a Data Processor on their instructions. The customer chooses who is targeted, approves the messaging and is responsible for the lawfulness of the outreach. Section 6 explains how we handle prospect data and how prospects can reach us.

3. What information we collect about customers and visitors

• Account details: name, work email, company name, job title and login credentials. If you sign in with Google, we receive your name, email address and profile image, but never your Google password.
• Connected accounts: when you connect LinkedIn or an email mailbox, we store the access tokens and the data needed to send and receive on your behalf, including messages sent and replies received through those accounts. We use this to run outreach, detect replies, handle bounces, process unsubscribes, and power and improve our AI reply assistant (Section 5).
• Billing details: name, billing address, GSTIN if you provide it, plan and transaction records. Payments are handled by Razorpay. We never receive or store full card numbers, CVV or UPI credentials.
• Usage and technical data: IP address, browser and device type, pages and features used, timestamps and error logs.
• Support messages: anything you send us by email, through the contact form on our website or through a support request. Contact form messages are stored in our database in India (Mumbai) and emailed to our support team.

4. How we use your information

• To create and run your account and provide the features you use
• To process payments and issue invoices
• To provide support and send service, billing and security messages
• To detect and prevent fraud, abuse and security incidents
• To keep the service reliable and improve it
• To comply with the law

We do not sell personal data. Marketing emails go only to people who have opted in, and every one carries an unsubscribe link. Service and account messages continue while your account is active.

5. AI processing

• Writing messages: when you generate or edit outreach, we send the relevant inputs (prospect business details and your messaging instructions) to our AI provider (currently Google, via the Gemini API) and return the result to you.
• Improving the product: we use aggregated statistics such as reply rates, step performance and send-time patterns to improve the service for all customers. These statistics do not identify any individual.

• Our reply assistant learns from conversations: Autonomiqa includes an AI assistant that helps reply to prospects. To make it work and improve it, we use message threads sent and received through connected accounts, including LinkedIn and email replies from prospects, to improve how the assistant reads replies and responds:

  • For your own account: conversation history is used to tailor the assistant to your business and tone. This learning stays inside your account and is never shown to, or used for, another customer in identifiable form.

  • Across customers, de-identified only: before any conversation is used to improve the assistant for all customers, it passes through a de-identification process that:

    • replaces names, email addresses, phone numbers, profile links, social media handles, postal addresses and identification numbers with neutral placeholders;
    • removes the names of the prospect's company and of our customer's company and products;
    • keeps only general context, such as country or region, industry, seniority and the outcome of the conversation;
    • discards a conversation entirely if it cannot be reliably de-identified.

    Only de-identified data is used for shared learning. It is not used to identify, profile or contact any individual.

  • Opting out: prospects who opt out (Section 6) are excluded from this use. Customers can ask us to exclude their account's conversations from cross-customer improvement by writing to support@autonomiqa.co with the subject "AI opt-out".

  • We do not give message content to any third party for their own model training.

6. Prospect data (people our customers contact)

• How prospect data is used: to run our customers' campaigns, and, in de-identified form, to improve our reply assistant, as described in Section 5. For this improvement use, we decide the purpose, so we are responsible for it directly.
• What we process: name, job title, employer, business email, business phone, public professional profile link, and company details such as industry, size, location, funding, technology used and leadership changes. We do not knowingly collect home addresses, government IDs, financial or health information.
• Where it comes from: third-party business data providers and public professional sources (currently Apollo.io, AI Ark, Serper and Apify). We assess the source and intended use of this data and process it in line with applicable law.
• Opting out: if you received a message sent through Autonomiqa and want it to stop, use the unsubscribe link in the message or write to support@autonomiqa.co with the subject "Opt-out". We delete your record within 30 days, exclude your messages from AI improvement, and add a coded identifier to a suppression list so you are not contacted again through Autonomiqa.
• Other requests: prospects can write to us with access, correction or deletion requests. Where our customer is responsible for the data, we will pass your request to them and tell you who they are so you can contact them directly. We respond within 30 days.
• Customer responsibility: customers are responsible for the lawfulness of their targeting and outreach. The compliance warnings shown in the product are helpful prompts, not legal advice.

7. Sharing your information

We share personal data only as follows, and never for anyone else's own marketing:

• Service providers: hosting, database, data sourcing, message delivery, AI, email and payments. Each processes data only for us, under written terms covering confidentiality, security and deletion. The full list, with what each one does and where, is on our Sub-processors page.
• Professional advisers bound by confidentiality.
• A buyer or successor if our business is merged, sold or restructured, with notice to you and the same level of protection.
• When required by law: we disclose information where Indian law, a court order or a lawful government request requires it, and we will tell you unless we are prohibited from doing so.

8. Where your data is stored

Our main database and application servers are in India (Mumbai). Our AI reply assistant runs on Google Cloud in the United States. Our public website (autonomiqa.co) is delivered through Google Firebase Hosting's global network, so the technical data your browser sends when you visit it, such as your IP address, may be processed at a Google location near you. Some service providers process data outside India (for example in the United States or the European Union), as shown on the Sub-processors page. Such transfers follow applicable Indian law, including any restrictions notified under the DPDP Act, and, for data from the EEA or UK, the safeguards described in Section 11.

9. How long we keep data

• Account data: while your account is active, then deleted within a reasonable period after closure, subject to legal retention requirements.
• Prospect data: only while needed for the customer's campaigns; opt-outs are deleted within 30 days (suppression entries are kept so the opt-out keeps working).
• Billing and tax records: eight years, as required by Indian law.
• Security logs: up to twelve months, or longer where the law requires.
• Backups: removed on our normal backup cycle.

Where a legal dispute or investigation is ongoing, we keep the relevant data until it ends.

10. Your rights

Under the DPDP Act and applicable Indian law, you have the right to:

• Access a summary of the personal data we hold about you and who we have shared it with
• Correct or update inaccurate or incomplete data
• Delete your data, subject to legal retention requirements
• Withdraw consent where we rely on consent, as easily as you gave it
• Nominate someone to exercise your rights if you die or become unable to
• Raise a grievance with us, and if it is not resolved, complain to the Data Protection Board of India

People outside India may have further rights; see Section 11. To use any of these rights, write to support@autonomiqa.co with the subject "Data Request". Requests are free. We may ask you to verify your identity, and we respond within 30 days.

11. If you are outside India

Autonomiqa is run from India, but our customers contact people in many countries. Where another country's privacy law applies to how we handle your data, we follow it as well. This section adds to the rest of this policy.

People in the European Economic Area (EEA) and the United Kingdom

The General Data Protection Regulation (GDPR) and the UK GDPR apply where we, or our customers through Autonomiqa, process data about people in the EEA or UK.

• Who is responsible:
  • For customer accounts, and for the de-identified improvement of our reply assistant, we are the controller.
  • For prospect data processed to run a customer's campaign, the customer is the controller and we are their processor.
• Why we process your data (legal bases):
  • Contract: to provide the service to our customers.
  • Legitimate interests: keeping the service secure, preventing abuse, and improving our product, including de-identified improvement of our reply assistant. For prospects, our customers rely on their legitimate interest in business-to-business outreach, limited to people in their professional role.
  • Legal obligation: for example, keeping tax and billing records.
  • Consent: for marketing emails.

• Your extra rights: in addition to the rights in Section 10, you can:

  • ask us to restrict how we use your data;
  • object to our processing based on legitimate interests, and you can object to outreach at any time, which we honour through our suppression list;
  • receive your data in a portable format (data portability).

  We do not make decisions with legal or similarly significant effects about you based solely on automated processing.

• If you are a prospect: we received your business contact details from our customers or from the business data providers listed in Section 6. You can object or opt out at any time using the unsubscribe link in any message, or by writing to us with the subject "Opt-out".

• International transfers: when your data moves from the EEA or UK to India, the United States or other countries, we protect it with the European Commission's Standard Contractual Clauses (and the UK Addendum or equivalent), or another valid transfer mechanism.
• Complaints: you can complain to the data protection authority where you live or work. We'd appreciate the chance to resolve your concern first.

People in the United States

We do not sell personal information, and we do not share it for cross-context behavioural advertising. If you live in a US state with a consumer privacy law, you can ask to access, correct or delete your personal information by writing to us with the subject "Data Request". We will not treat you differently for making a request.

People elsewhere

If you live in another country with a privacy law that gives you rights over your data, write to us with the subject "Data Request" and we will respond in line with that law.

12. Data security

We protect personal data with encryption in transit and at rest, role-based access controls, separation between customer accounts, managed storage of secrets, least-privilege internal access and monitoring of production systems. Multi-factor authentication is available on all accounts.

If a personal data breach occurs, we will notify affected people and the Data Protection Board as required by law, and notify affected customers without delay. No system is completely secure. If you think your account or data has been compromised, write to us immediately at support@autonomiqa.co.

13. Cookies

Our website does not use advertising or analytics cookies. The Autonomiqa app uses only the essential cookies and browser storage needed to keep you signed in and secure.

14. Children

Autonomiqa is a business tool and is not for anyone under 18. We do not knowingly collect children's personal data, and customers must not use the platform to contact anyone under 18. If you believe a child's data has reached us, write to us and we will delete it promptly.

15. Changes to this policy

We may update this policy. The "Last updated" date shows the current version. For significant changes, we will notify customers by email or in the app at least 15 days before they take effect, and we will ask for fresh consent where the law requires it.

16. Contact and grievance officer

Autonomiqa: Privacy and Grievances
Email: support@autonomiqa.co
Subject line for data requests: "Data Request"
Subject line for opt-outs: "Opt-out"
Subject line for complaints: "Privacy Grievance"

We acknowledge grievances within 24 hours and aim to resolve them within 15 days.