Privacy Policy

1. Who we are

Zeeyes AI, Inc. ("Zeeyes AI", "we", "us", "our") is a Delaware corporation, incorporated on December 5, 2025, in the United States. Our engineering and operations team works from Tirunelveli, Tamil Nadu, India. We develop enterprise AI software, including our product Xapplets, and provide custom AI, automation and integration services.

For personal data collected through zeeyes.ai and our sales and support channels, Zeeyes AI is the data controller (called a "Data Fiduciary" under India's Digital Personal Data Protection Act, 2023).

2. What this policy covers

This policy applies to:

• our website, zeeyes.ai, and its pages;
• calls, emails, WhatsApp messages and meeting bookings with our team;
• the custom software, AI and integration services we deliver to business clients.

It does not cover:

• Xapplets products and extensions. These are covered by the Xapplets Privacy Policy. When you install an extension through Zoho Marketplace, Zoho's own terms and privacy policy also apply.
• Third-party websites we link to. Their own privacy policies apply.

When we process data inside a client's systems as part of a project, we do so on the client's behalf and under our contract with them (see section 4).

3. Information we collect

Information you give us

• Contact and enquiry details: name, work email, phone or WhatsApp number, company name, job title and the content of your message.
• Meeting bookings: when you schedule a call, our booking provider collects your name, email, chosen time slot and any notes you add.
• Client account and project details: contact details of client staff, project requirements and support requests.
• Billing details: billing name, company and invoice address. Card and bank details are entered directly with our payment processor; we do not store them.

Information collected automatically

• Website usage data through Google Analytics: pages visited, time on page, links clicked, referring website, and approximate location (city or country level).
• Device and technical data: browser type, device type, operating system, screen size, language and IP address. Google Analytics does not log or store full IP addresses.
• Server and security logs kept by our hosting provider to run the site and prevent abuse.

Business data we process for clients

When we deliver a service, we may access records held in a client's connected systems, such as CRM contacts, leads, invoices, workflow logs or reports. We use this data only to deliver the agreed service, under the client's instructions.

Sensitive data, such as health information in healthcare projects, is processed only when the project requires it, under a written agreement, and with stronger access controls.

4. How we use your information and why

We only use personal data where we have a valid reason. If you are in the European Economic Area or the United Kingdom, the table below also shows the legal basis we rely on under the GDPR.

Under India's DPDP Act, we process personal data either with your consent, which you can withdraw at any time, or for legitimate uses permitted by the Act, such as when you voluntarily share your details so that we can respond to you.

You do not have to give us personal data. However, without your contact details we cannot reply to an enquiry or schedule a meeting.

5. AI and automation processing

• Data processed by our AI and automation tools is used only to produce the outputs, workflows and reports the client asked for.
• We do not use client business data or personal data to train public or third-party AI models without explicit written permission.
• Where we use third-party AI services to deliver a feature, we choose providers whose terms do not allow them to train on the data we send.
• We do not make decisions about individuals based solely on automated processing that produce legal or similarly significant effects on them.

6. Who we share your information with

We do not sell personal data, and we do not "share" it for cross-context behavioral advertising. We disclose personal data only to:

Our service providers may use personal data only to perform services for us, and they must protect it.

7. International data transfers

We are a US company with our team in India, so your data may be processed in the United States, India, and the countries where our service providers operate.

When we transfer personal data out of the European Economic Area, the United Kingdom or Switzerland, we use safeguards recognised by law, such as the European Commission's Standard Contractual Clauses. Contact us to request more information or a copy of these safeguards.

8. How long we keep your information

We keep personal data only as long as we need it for the purposes in this policy, then delete or anonymise it.

9. How we protect your information

We use reasonable technical and organisational measures to protect personal data, including:

• encryption in transit (HTTPS/TLS);
• role-based access controls, so staff can only see the data they need for their work;
• secure cloud hosting and activity logging;
• confidentiality commitments from our team and service providers.

No system can be guaranteed to be fully secure. If you believe your data has been put at risk, contact us right away.

10. Your privacy rights

Your rights depend on where you live. We will honour the following requests in line with applicable law.

European Economic Area, United Kingdom and Switzerland

You have the right to:

• access your personal data;
• correct it;
• have it deleted;
• restrict how we use it;
• object to processing based on legitimate interests or used for direct marketing;
• receive it in a portable format;
• withdraw consent at any time, without affecting processing done before you withdrew.

You can also lodge a complaint with your local data protection authority.

India

Under the Digital Personal Data Protection Act, 2023 you have the right to:

• get a summary of the personal data we process about you and how we process it;
• have your data corrected, completed, updated or erased;
• withdraw your consent;
• use our grievance process;
• nominate another person to exercise your rights if you die or become incapacitated.

If you are not satisfied with how we handle a grievance, you can complain to the Data Protection Board of India.

United States

Depending on your state, including California, you may have the right to know what personal data we collect, use and disclose; to access, correct and delete it; and to opt out of its sale or sharing.

We do not sell or share personal data, so there is nothing to opt out of. We honour Global Privacy Control signals as an opt-out request. We will not discriminate against you for exercising your rights.

How to make a request

• Email z-support@zeeyes.ai with the subject line "Privacy request" and tell us what you would like us to do.
• We may ask for information to confirm your identity before we act. An authorised agent may make a request for you if they provide proof that you authorised them.
• We aim to respond within 30 days. Where the law allows us more time, we will tell you why.

11. Data breaches

If a personal data breach occurs that affects you, we will notify you and the relevant authorities as required by applicable law.

Our notice will explain in plain language:

• what happened;
• the likely impact on you;
• the steps we are taking;
• who you can contact for help.

12. Changes to this policy

We may update this policy from time to time. If we make a significant change, we will make it clear on the website or tell you directly.

13. Contact and grievances

For any question, request or complaint about this policy or your personal data, contact us. We will acknowledge your message and work to resolve it within the timelines required by law.