Basalix AI
Start free trial

Legal

Privacy Policy

Effective date: September 24, 2026 · Last updated: October 12, 2026

1. Introduction

Mivikron Solutions Private Limited (“we,” “our,” or “us”) operates Basalix AI. This Privacy Policy describes how we collect, process, use, and share personal information when you access our website, platform, and APIs, and is written to meet our obligations under India’s Information Technology Act, 2000 and Digital Personal Data Protection (DPDP) Act, 2023, and the privacy laws of the other places where we offer the Services.

2. Information We Collect

2.1 Information You Provide Directly: When you register, we collect your name, email address, organization name, billing details (such as billing name, address, and plan), and account credentials. Card details are collected by our payment provider, Dodo Payments, and never reach our servers. (If you register via Google OAuth, we receive your name, email, and profile picture.) If you choose to receive account notifications on WhatsApp, we also collect the mobile number you provide for them.

2.2 Customer Data (Knowledge Base): Documents, web pages, text, and FAQs you add to the Basalix AI platform so your AI agents can answer from your own information. This content is used only to serve your agents; it is never used to train AI models.

2.3 Automatically Collected Information: We collect log data, device information, IP addresses, browser types, and usage statistics (e.g., conversation counts, API request volumes) to operate, secure, and improve the Services.

2.3.1 Cookies: Our marketing website does not use advertising or tracking cookies. We measure website traffic with privacy-friendly analytics — Cloudflare Web Analytics and Umami — that do not use cookies and do not identify individual visitors. These tools collect only aggregate, non-identifying information such as page views, referring sites, and approximate country, and do not track visitors across other websites. Our website is hosted by Cloudflare, which also protects our contact form with Cloudflare Turnstile; Turnstile processes technical information about your browser to detect abuse. The Basalix AI platform uses only essential cookies needed for sign-in, security, and keeping your session active. The chat widget stores a conversation identifier in the visitor’s browser for the current session, and a random visitor identifier in the browser’s local storage so the widget can recognize a returning visitor on that website. The widget does not use these identifiers for advertising or to track visitors across other websites, and visitors can clear them through their browser settings. If we ever introduce non-essential cookies, we will update this Policy and ask for your consent where the law requires it.

2.3.2 Do Not Track: Because we do not use tracking or advertising cookies, there is no cross-site tracking for a browser “Do Not Track” signal to switch off, and we do not currently respond differently to such signals.

2.4 End-User Data: When you deploy Basalix AI on your website, phone line, or messaging channels, we process information from the people who contact you through them. This may include names, phone numbers, and email addresses; call details such as the caller’s phone number, time, and duration; chat messages; call transcripts, and call audio recordings where you enable recording; intake answers, which may include high-level details about injuries and treatment, immigration status, or family matters; and appointment details. It also includes contact lists you import or sync (for example, existing clients, opposing parties, and related parties), which are used to run conflict checks and to recognize returning callers. You are the Data Fiduciary/Controller for your end-users, and we act solely as your Data Processor, processing this information only on your instructions. You are responsible for providing any notices and obtaining any consents your jurisdiction requires, including call-recording notices.

2.5 Website Visitors, Enquiries, and Demos: If you contact us through our website, we collect your name, firm, work email, and message, and use them only to respond to you. If you try our live demo, your call or chat with our fictional demo firm is processed by the same providers as the Services (Section 5) and may be recorded and transcribed. The name, email address, and phone number you enter before a demo call are used to send you the demo’s booking confirmation and case summary, to prevent misuse (for example, limiting the number of demo calls per address), and so that we can follow up with you about Basalix AI. We do not add you to marketing mailing lists, and you can ask us to stop contacting you, or to delete your demo records, at any time using the contact details in Section 13. We are the controller for this information.

3. Google API Data Disclosure & Limited Use Policy

The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements. Furthermore, if you connect your Google Calendar account to Basalix AI via Google OAuth, the collection, use, and transfer of data received from Google APIs will strictly adhere to the Google API Services User Data Policy, including its Limited Use requirements.

3.1 Scopes Requested: We request access to the full calendar management scope https://www.googleapis.com/auth/calendar.

3.2 Specific Use Case: We access your Google Calendar account via this scope solely to read your real-time availability (to prevent booking conflicts) and to dynamically create and manage a dedicated secondary calendar structure within your account. This secondary calendar is utilized by our booking AI application to seamlessly schedule, update, modify, or clear automated consultation appointments without altering your personal calendar entries.

3.3 Strict Prohibitions on Google Data:

  • We do not use Google user data to train foundational artificial intelligence or machine learning models.
  • We do not use Google user data for advertising, marketing, profiling, or tracking across other services.
  • We do not sell, rent, or trade any data obtained from Google APIs to third parties.
  • We do not transfer or share Google user data with third parties unless it is strictly necessary to provide or improve the core user-facing calendar booking features, comply with applicable law, or as part of a merger/acquisition.

4. How We Use Your Information

For general information collected outside of Google APIs, we use it to:

  • Provide, operate, and maintain the Basalix AI platform and AI infrastructure.
  • Process payments and prevent fraudulent transactions.
  • Provide customer support and technical troubleshooting.
  • Analyze usage data (not the content of your Customer Data) to improve the Services and user experience.
  • Communicate with you regarding updates, security alerts, and administrative messages.

We may create aggregated, de-identified statistics about platform usage (for example, total conversation volumes) that cannot reasonably be linked to you or any individual, and use them to operate and improve the Services. Data received from Google APIs is never used for this purpose.

5. AI Processing and Third-Party Subprocessors

  • Strict Data Isolation: Customer Data is logically separated by tenant; each firm’s data is accessible only to that firm’s workspace.
  • No Model Training: We do not use your personal information or Customer Data to train AI models. Our AI providers process data under business API terms that prohibit using it for model training. Some providers may retain API inputs and outputs for a limited period (for example, up to 30 days) solely for abuse and safety monitoring, after which they are deleted.
  • Subprocessors: We share data only with the service providers below, each bound by a data processing agreement or equivalent data protection terms:
    • Amazon Web Services (United States): cloud hosting, database, file storage, backups, and encryption keys.
    • OpenAI and Anthropic (United States): generating AI responses and conversation summaries from conversations and the knowledge you provide.
    • Retell AI (United States): phone and web voice calls, speech-to-text, text-to-speech, and the voice agent’s AI responses, including call transcripts and, where enabled, call recordings.
    • Telnyx (United States): telephone numbers, call routing, and call transfer for the phone channel.
    • Meta Platforms (WhatsApp Business Platform): account notifications sent from our own WhatsApp Business account, such as call summaries, appointment counts, and callback requests. These notifications do not include case details.
    • Dodo Payments: our merchant of record for subscriptions and voice wallet top-ups, including payment processing and sales tax. Card details are entered on their pages and never reach our servers.
    • Bright Data: retrieving publicly available web pages you add to your knowledge base.
    • Amazon Simple Email Service (United States, part of Amazon Web Services): delivery of account, billing, appointment, and follow-up emails.
    • Sentry: application error monitoring.
    • Only when you connect them: Google (see Section 3), Microsoft (Outlook Calendar), and Clio (Clio Grow and Clio Manage: leads, contacts, and matters). Data is sent only to perform the integration you enabled, and stops when you disconnect it.
  • We will update this list before adding a new subprocessor, and we give customers at least 30 days’ notice by email of any addition or replacement, as set out in our Data Processing Addendum.

6. Data Sharing and Disclosure

We do not sell your personal information. We may disclose information:

  • To comply with valid legal processes, subpoenas, or government requests.
  • To enforce our Terms of Service or protect the rights, property, or safety of Mivikron Solutions Private Limited, our users, or the public.
  • In connection with a merger, acquisition, or sale of company assets.

7. Data Security and Retention

We employ industry-standard organizational and technical measures to protect your data, including TLS encryption in transit; AES-256 encryption at rest for our databases, file storage, and backups, with keys managed in AWS Key Management Service in the US; encrypted storage of integration credentials; role-based access controls; and audit logging.

7.1 Retention: You set retention periods for conversations, call recordings, and intake records for each agent, and expired records are purged automatically. If you do not set a retention period, records are kept until you delete them or delete your account. When a record expires, we delete its content (messages, transcripts, recordings, intake answers, and matter records not on legal hold) and keep only the minimal metadata needed for billing and service records, such as call date and duration. We also ask our voice provider to delete its copies of expired calls. You can place individual records on legal hold, erase conversations at any time, and export your leads list to CSV. Account and billing records are kept while your account is active and afterwards for as long as tax and accounting laws require.

7.2 Account Deletion: When you delete your account, it is deactivated immediately. After a 7-day grace period, during which you can cancel the deletion, your Customer Data is permanently purged from our active systems. Residual copies in encrypted backups are overwritten on their normal rotation cycle.

8. Data Location

Mivikron Solutions Private Limited is based in India. Customer Data is stored and processed in the United States (Amazon Web Services, US East region). Our authorized personnel may access it from India to provide and support the Services, under the safeguards described in this Policy and our Data Processing Addendum. The subprocessors listed in Section 5 operate primarily in the United States.

9. Your Privacy Rights

Depending on where you live (for example, California or another U.S. state with a privacy law, or India), you may have the right to:

  • Access and obtain a copy of your personal data.
  • Correct inaccurate or incomplete data.
  • Request deletion of your personal data.
  • Withdraw consent to processing.
  • Object to or restrict processing.
  • Nominate another person to exercise your rights (India).

We do not sell or “share” personal information as those terms are defined under California law. To exercise any of these rights, contact our Grievance Officer (Section 13).

10. Messaging Consent

Appointment confirmations and reminders are sent to the contact details a person provides when booking. Where a customer enables email follow-ups, they are sent only to people who agreed to receive them during the conversation, and every follow-up email contains an unsubscribe link. WhatsApp notifications are sent from our own WhatsApp Business account only to account users who opt in to receive them, contain no case details, and can be switched off at any time. Opt-outs are honored immediately. Mobile numbers and messaging opt-in consent are not shared with third parties or affiliates for their marketing or promotional purposes.

Account owners can unsubscribe from our marketing emails at any time using the link in each email. Service and security notices about your account will continue while your account is active.

11. Children

The Services are not directed to children under 18, and we do not knowingly collect their personal information. If you believe a child has provided us with personal information, please contact us and we will delete it.

12. Changes to This Policy

We will post any changes on this page and update the “Last updated” date. We will notify account owners by email at least 14 days before a material change takes effect.

13. Contact and Grievance Officer

If you have questions or complaints about this Policy or our handling of your personal data, or wish to exercise any of the rights in Section 9, please contact our Grievance Officer:

Ajaykumar Morade
Grievance Officer, Mivikron Solutions Private Limited
Email: [email protected]

We will acknowledge your request promptly and respond within 30 days. If you are in India and are not satisfied with our response, you may complain to the Data Protection Board of India.

If you are an end-user of one of our customers (for example, you contacted a law firm through its website or phone line), please contact that firm first. We process your information on its behalf and will assist it in responding to your request.