Privacy Policy
Effective: 17 June 2026 · AEOX is a product of StarvoxLabs Pvt. Ltd. ("AEOX", "we", "us"), Mumbai, Maharashtra, India. We are the Data Fiduciary for personal data we process about our users.
This Policy explains what personal data we collect when you use AEOX (the "Service"), why, how we share and protect it, and your rights — including under India's Digital Personal Data Protection Act, 2023 ("DPDP Act") and, where applicable, the EU/UK GDPR. It forms part of our Terms of Service. By using the Service you acknowledge this notice and, where required, consent to the processing described below.
1. Who we are
The Service measures how AI answer engines describe a brand, audits websites, and (with your approval) publishes optimisations to sites you connect. For personal data of account holders, we act as a Data Fiduciary (controller). For personal data contained within a website you connect or content you publish, you are the Data Fiduciary and we act as your Data Processor.
2. Personal data we collect
- Account & identity — name, work email, phone, role; authentication data via email link, one-time code, password (stored hashed by our auth provider), or Google sign-in.
- Billing — company legal name, GSTIN, billing address, billing email. Card/payment details are handled by our payment processor; we do not store full card numbers.
- Connected Sites & credentials — the URLs you submit; and, where you connect a CMS, an access token (encrypted at rest, AES-256-GCM). We do not store CMS passwords in plain text.
- Content we process — publicly accessible page content we crawl from sites you submit, and content you draft/approve/publish — which may itself contain personal data you control.
- Usage & technical — measurement prompts and AI-engine responses, audit/report data, Credit usage, and access logs (IP address, timestamps) which we retain to secure accounts and detect fraud or misuse.
We do not knowingly collect sensitive personal data or data of children (under 18). The Service is for business use only.
3. Purposes & lawful basis
We process personal data to: provide and operate the Service (audits, measurement, drafting, approved publishing, reporting); authenticate and secure accounts; meter and bill Credits; provide support; send service and (with consent) marketing communications; comply with law; and prevent fraud/abuse. Our lawful bases are your consent, performance of our contract with you, our legitimate business interests, and legal obligations (e.g. tax). Where we rely on consent, you may withdraw it at any time (Section 7).
4. How we share data & international transfers
We share the minimum data necessary with the following categories of processors, who act on our instructions:
- AI answer engines — OpenAI (ChatGPT), Anthropic (Claude), Google (Gemini/AI Overview via SerpAPI), Perplexity, xAI (Grok), DeepSeek, and Groq — to run measurements and generate drafts. Prompts and relevant site content are sent to these providers; we do not control their independent processing and you should review their policies.
- Infrastructure — Supabase (authentication & database) and Render (hosting).
- Payments & email — our payment processor and transactional email provider.
Some providers are located outside India (e.g. the United States). Where personal data is transferred internationally, we do so consistent with the DPDP Act and applicable law, and (for GDPR-covered data) under appropriate safeguards such as Standard Contractual Clauses. We do not sell your personal data and do not use it for third-party advertising.
5. Security
We apply reasonable technical and organisational safeguards, including encryption of CMS credentials at rest (AES-256-GCM), encryption in transit (HTTPS), access controls, and workspace isolation. No system is perfectly secure; in the event of a personal data breach we will notify the Data Protection Board of India and affected Data Principals as required by the DPDP Act.
6. Retention
We retain personal data for as long as your account is active and as needed to provide the Service, then delete or anonymise it when the purpose is served, unless a longer period is required by law (e.g. tax/accounting records). You can request deletion at any time; some records may be retained where legally required.
7. Your rights (DPDP Act & GDPR)
As a Data Principal you may: access a summary of the personal data we process and how; request correction, completion, updating, or erasure; withdraw consent (as easily as it was given); nominate another person to exercise your rights in case of death or incapacity; and seek grievance redressal. Where the GDPR applies, you also have rights to data portability, restriction, objection, and to lodge a complaint with a supervisory authority. To exercise any right, contact our Grievance Officer below; we will respond within the timeframes required by law. You can also disconnect any Connected Site at any time, which revokes our future access to it.
8. Cookies & local storage
We use only essential cookies/local storage — for sign-in/session, your theme and language preference, and to remember acceptance of our Terms. We do not use third-party advertising or cross-site tracking cookies.
9. Children
The Service is not intended for anyone under 18, and we do not knowingly process children's personal data. If you believe a child has provided data, contact us and we will delete it.
10. Changes
We may update this Policy. For material changes we will provide reasonable notice (in-app or by email) and update the "Effective" date above.
11. Grievance Officer & contact
In accordance with the DPDP Act and the Information Technology Act, 2000:
- Grievance / Data Protection Officer: Ankita
- Email: ankita@aeox.in · legal@aeox.in
- Address: Mumbai, Maharashtra, India
If your concern is unresolved, you may escalate to the Data Protection Board of India.