Privacy Policy & Data Governance
How CodxBot (operated by codxbyte Pvt Ltd) collects, processes, safeguards, and respects digital personal data as a Data Fiduciary.
CodxBot values your fundamental right to privacy. Under the Digital Personal Data Protection Act, 2023 (DPDP Act), we act as a Data Fiduciary for data you entrust to our platform. We process personal data solely on lawful grounds (explicit consent or legitimate uses), maintain 256-bit AES encryption, strictly prohibit unauthorized tracking of children under 18, and guarantee resolution of all privacy grievances within a maximum period of 90 days.
1. Identity of the Data Fiduciary
The Data Fiduciary responsible for deciding the purpose and means of processing digital personal data on this platform is:
Entity Name: codxbyte Pvt Ltd (Brand: CodxBot)
Official Website: www.codxbot.com / www.codxbytes.com
Registered Email: support@codxbot.com / privacy@codxbot.com
Nature of Service: Universal form ingestion engine, transactional email relay (BullMQ), SPF/DKIM DNS diagnostics, and multi-tenant lead management software.
2. Lawful Grounds for Processing (DPDP Sec 4 & 7)
We only process your digital personal data when we have a recognized lawful basis under the DPDP Act:
- Consent (Section 6): When you freely give specific, informed, unconditional, and unambiguous consent to register an account, subscribe to services, or submit an inquiry.
- Certain Legitimate Uses (Section 7): When you provide personal data for specified purposes, such as receiving transactional billing receipts, essential security alerts, OTP verifications, or fulfilling a service request you initiated.
- Compliance with Law: When processing is mandated to adhere to statutory compliance, court orders, or governmental security audits.
3. Categories of Personal Data We Collect
Account & Profile Data
Full name, official email address, mobile phone number, organization name, profile avatar, authentication credentials, and 2FA authentication logs.
Form & Campaign Content
Data fields collected via hosted forms, API submissions, subscriber email addresses, email templates, message dispatch logs, and audience tags.
Billing & Transaction Details
Subscription tier, invoice history, payment timestamps, GST identification, and tokenized payment gateway references (Razorpay/Stripe).
Technical & Security Telemetry
IP address, approximate location, device type, browser user-agent, session timestamps, and audit access logs required for intrusion detection and fraud prevention.
4. Reasonable Security Safeguards (DPDP Sec 8(5), Rule 6)
CodxBot implements state-of-the-art technical, physical, and organizational safeguards to protect personal data against accidental loss, unauthorized access, alteration, or disclosure:
5. Personal Data Breach Protocol (DPDP Sec 8(6), Rule 7)
In the unlikely event of a personal data breach impacting our infrastructure, CodxBot maintains a mandatory incident response protocol:
- We will inform all affected Data Principals without undue delay detailing the nature of the breach, affected data elements, and recommended mitigation steps.
- We will submit a formal incident report to the Data Protection Board of India within 72 hours of confirmation, in accordance with DPDP Rule 7.
6. Data Retention & Purpose Limitation (DPDP Sec 8(7), Rule 8)
We do not retain digital personal data indefinitely. Personal data is preserved only for as long as necessary to fulfill the specified operational purposes, comply with legal obligations (e.g. accounting, taxation), or as configured by workspace administrators through custom data retention policies. Once the retention period expires or upon a validated erasure request, personal data is permanently sanitized and purged.
7. Protection of Children's Personal Data (DPDP Sec 9, Rules 10 & 12)
CodxBot is designed for professional business use. Under the DPDP Act, an individual under 18 years of age is defined as a child:
- We do not knowingly collect, process, track, or profile personal data of children without verifiable consent from their parent or lawful guardian.
- We prohibit targeted advertising directed at children or behavioral tracking of minors across our services.
- If we become aware that a child's personal data has been submitted without requisite guardian consent, we will promptly erase such records.
8. Rights of the Data Principal (DPDP Sec 11, 12, 14)
As a Data Principal, you are entitled to exercise the following statutory rights under the DPDP Act:
Obtain a summary of personal data processed and identities of Data Fiduciaries/Processors with whom it has been shared.
Request correction of inaccurate or incomplete personal data recorded in our systems.
Request permanent deletion of your personal data when the processing purpose is complete or consent is withdrawn.
Seek swift redressal of grievances regarding the handling of your digital personal data within 90 days.
In compliance with Section 13 of the DPDP Act and Rule 14(3) of the DPDP Rules, 2025, CodxBot has designated an official Grievance Redressal Officer. All privacy inquiries, data subject access requests, or complaints will be acknowledged promptly and resolved within a maximum statutory period of 90 days:
Designation: Data Protection & Grievance Officer
Entity: codxbyte Pvt Ltd / CodxBot
Email: grievance@codxbot.com
Alternate Contact: privacy@codxbot.com
Response Commitment: Within 48 hours acknowledgement
Maximum Resolution SLA: 90 Calendar Days (Rule 14(3))
Mailing Address: Legal Compliance Cell, codxbyte Pvt Ltd, India
10. Cross-Border Data Transfers & Consent Withdrawal
Cross-border transfers of digital personal data are conducted in accordance with Section 16 of the DPDP Act and Central Government guidelines. You may review, modify, or withdraw your consent at any time via your Control Panel settings or by writing directly to privacy@codxbot.com.
We may periodically revise this Privacy Policy to reflect ongoing technological or regulatory updates. We encourage you to review this page regularly.
Have questions or need assistance? Contact our team at support@codxbot.com or visit our Support Desk.