Privacy Policy

1. Who we are

Basium AI ("Basium", "we", "us") is operated by Soletechnix Pvt Ltd, a company registered in India. Basium lets businesses build AI chatbots and voice agents and deploy them on their website, WhatsApp, SMS, Slack and phone lines.

This policy covers basium.in, the Basium app, and the chat widgets and voice agents our customers deploy. For any privacy question or request, contact us at getbasium@gmail.com.

2. Our two roles

• For your Basium account (you, the business using Basium), we decide how your data is used. We are the "data fiduciary" under India's Digital Personal Data Protection Act, 2023 (DPDP Act) and the "controller" under the GDPR.
• For your customers' data — the people who chat with or call a bot you build — we process data only on your behalf and on your instructions. You are the fiduciary/controller and we are your "data processor". You are responsible for telling your customers about the bot (including that calls may be recorded) and for having a lawful basis to process their data. If you are one of those end users, please contact the business that runs the bot; we will help them answer your request.

3. What we collect

• Account data: name, email address, password (stored hashed) or Google/GitHub sign-in details, organization and team members.
• Billing data: plan and payment records. Card and UPI details are handled by Dodo Payments; we do not store them.
• Content you upload: documents (such as PDFs), website pages you ask us to read, FAQs, media files, and the bot flows you build.
• Conversation data from your bots: chat messages, call transcripts, call recordings (when you turn recording on), call summaries, phone numbers of callers, and details your bot collects (for example a name, email, phone number or appointment time).
• Connected-service data: the access tokens and settings you provide when you connect WhatsApp, SMS, Slack, phone numbers, Cal.com or webhooks.
• Technical data: IP address, browser and device type, pages visited and timestamps, needed to run and secure the service.
• Analytics data — only with your consent: page views, clicks, scrolling and session recordings from Google Analytics and Microsoft Clarity (see section 9).

4. How we use it, and why we are allowed to

• To provide the service — run your bots, answer your customers, place and receive calls, store your content. Basis: our contract with you.
• To bill you and keep records required by tax and accounting law. Basis: contract and legal obligation.
• To keep Basium secure — detect abuse, fraud and outages. Basis: legitimate interest / legitimate use under the DPDP Act.
• To support you and tell you about important changes to the service. Basis: contract.
• To understand how our website is used through analytics. Basis: your consent, which you can withdraw at any time.

We do not sell personal data, and we do not use your content or your customers' conversations to train our own AI models. Our AI providers (listed below) process content to generate replies under their own API terms.

5. Who we share it with (sub-processors)

We share data only with the service providers we need to run Basium, and only for the purpose listed:

We may also disclose data when required by law or by a valid order of a court or government authority, or to protect the rights and safety of our users. If Basium is sold or merged, data would transfer under this same policy, and we would tell you first.

6. International transfers

Your data is stored mainly in Australia and may be processed in the United States, India and other countries where our providers operate. When we transfer data out of the EU/UK, we rely on the providers' Standard Contractual Clauses or equivalent safeguards. Transfers out of India follow the DPDP Act and any restrictions the Government of India notifies.

7. How long we keep it

• We keep your account data, uploaded content, chats, call transcripts and recordings for as long as your account is active.
• You can delete individual bots, documents and conversations at any time.
• When you delete your account, we delete your data within 30 days.
• We keep billing and invoice records for as long as tax and accounting laws require, even after your account is deleted.

8. Your rights

Wherever you live, you can ask us to:

• tell you what personal data we hold about you and give you a copy (access and export/portability);
• correct or update it;
• delete it;
• stop or restrict certain uses, or object to them;
• withdraw consent you gave earlier (for example, to analytics cookies) — this does not affect what we did before.

India (DPDP Act, 2023): you also have the right to grievance redressal and to nominate someone to exercise your rights if you die or become incapacitated. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

EU/UK (GDPR): you may complain to your local data protection authority.

California (CCPA/CPRA): you have the right to know, delete and correct, and to opt out of the sale or sharing of your personal information. We do not sell or share personal information for cross-context advertising. We will not treat you differently for using these rights.

To use any of these rights, email getbasium@gmail.com. We will confirm your identity and reply within 30 days. If your data belongs to a Basium customer's bot, we will pass your request to that business and help them answer it.

9. Cookies and analytics

We use essential browser storage to keep you signed in and remember settings such as your theme. These are needed for the service to work.

With your consent, we also use Google Analytics (traffic and usage statistics) and Microsoft Clarity (heatmaps and session recordings of how pages are used; fields such as API keys are hidden from recordings). Neither loads until you click "Accept" in the cookie banner, and you can change your choice at any time. See Google's Privacy Policy and Microsoft's Privacy Statement.

The chat widgets our customers place on their websites do not use Basium analytics or session recording.

10. Security

Data is encrypted in transit (TLS) and at rest. Each customer's data is isolated at the database level with row-level security, so one organization cannot read another's. Access to production systems is limited to the people who need it. Our hosting providers hold their own SOC 2 Type II and ISO 27001 certifications; Basium itself has not yet been independently certified. No system is perfectly secure — if a breach affects your data, we will notify you and the relevant authorities as the law requires.

11. Business customers: Data Processing Agreement

If you use Basium to process your customers' personal data, you can request our Data Processing Agreement (DPA), which sets out our duties as your processor, our sub-processors, security measures and breach notification. Email getbasium@gmail.com to request it.

12. Children

Basium is for businesses and is not meant for anyone under 18. We do not knowingly collect children's data. Customers who deploy a bot that children may use are responsible for getting verifiable parental consent where the law requires it.

13. Changes to this policy

We may update this policy as Basium changes. We will post the new version here with a new date, and tell account holders by email about significant changes before they take effect.