Legal

Privacy Policy

What Xike collects, why, where it is kept, for how long, who helps us, and what you can ask us to do with it. Written in plain English.

Effective date: [Effective date] · Last updated: [Last updated date]

Pilot version: our company details and a few terms are still being finalised. Questions in the meantime: hello@xike.in

1. Who we are

Xike (“Xike”, “we”, “us”) is software that runs a small business from one place: billing (POS), stock, supplier bills, payments, staff, attendance and reports, with an AI assistant you can talk to. It is provided by two companies, and the one your business contracts with is the data fiduciary / controller for your account:

• Businesses in India: [Company legal name — India], a private limited company incorporated in India, [Registered address] (CIN [CIN]).
• Businesses outside India: [Company legal name — US], a company incorporated in Delaware, USA, [Address] (Delaware file number [Delaware file number]).

In this policy “Xike”, “we” and “us” mean that company. The two companies work together to run one service; how they share data is described in section 8.

This policy covers the website xike.in, the Xike app (app.xike.in), the Xike POS, the guest QR menu and ordering pages, and the Xike staff bot on Telegram and WhatsApp.

2. Your role and ours

3. What we collect and why

We only collect what a feature needs. Many items below are collected only when the owner turns that feature on.

We do not sell personal data. We do not use it for advertising. We do not build profiles of people across businesses — each business’s data is kept separate.

4. How the AI uses data

• Xike uses Anthropic’s Claude models to understand messages, read photos of bills, menus and checklists, look at CCTV stills for the checks the owner sets, answer questions, translate team chat and draft replies and messages. Only what is needed for that one request is sent.
• When the AI answers a question about your business, it can only use read-only report tools limited to your own outlet. It cannot see another business’s data.
• Some questions may use web search (for example current prices or rules). The search query goes through Anthropic’s web search tool; your business records are not published.
• The AI is told not to identify people in pictures. Face recognition (section 3) is separate, runs on our servers, and is only for consenting staff.
• Xike does not use your data, or your customers’ or staff’s data, to train AI models. Under Anthropic’s commercial API terms, Anthropic does not train its models on data sent through the API by default and keeps it only for a limited time for safety and abuse monitoring. See Anthropic’s commercial terms and privacy policy for details. [Confirm current Anthropic API retention period and zero-data-retention status]
• Speech services (Sarvam AI, ElevenLabs or Deepgram) receive the audio of a voice note only to turn it into text. Voice notes are only turned into text (and translated). Xike never analyses tone, mood or emotion, from voices or from faces.
• Our AI providers are outside most customers’ countries. Anthropic (USA) processes text, photos, documents and CCTV stills; ElevenLabs or Deepgram (USA) process voice-note audio outside India; Sarvam AI (India) processes Indian-language voice notes. Section 8 explains how transfers are protected.
• Staff are talking to an AI. Replies from the staff bot and the messages and review replies Xike drafts are written by AI. The joining notice tells staff that the bot is an AI assistant. [Confirm the bot’s joining notice says this, and add machine-readable AI marking to generated audio and text before 2 Dec 2026 (EU AI Act Art. 50(2))]
• AI can be wrong. Xike is built to tell you when something is missing, but it can misread a bill, mishear a voice note or give a wrong answer. Check important numbers before you act on them.
• Xike suggests; your owner or manager decides. Pay estimates, attendance flags (such as “late”) and AI alerts are checked by a person before anything happens to anyone.
• Nothing changes without a person confirming it. When the AI prepares a change (a price, a stock entry, a payment), you see it and approve it first. The one exception is a reply to a 4–5★ Google review, and only if the owner turns on automatic replies.
• Xike is not for patient or prescription data. Pharmacies use it for stock and purchasing; don’t enter patients’ health information, prescriptions or clinical notes.

5. Payments

• Xike never holds your customers’ money. In India, customers pay to the business’s own UPI ID (from the QR the business already has). Outside India, a business can connect its own Stripe account, and customer payments settle straight to that account. Xike takes nothing from your sales; your bank, UPI provider or Stripe may charge its own fees (in India, a bank may charge a merchant fee on some larger UPI payments). We store only the UPI ID or the Stripe account ID.
• Xike reads bank alert emails to match payments; it has no access to your bank account and cannot move money.
• Payments to Xike (the plan and AI credits) are handled by Razorpay (India) and Stripe (elsewhere). They receive the payer’s details needed to take the payment and keep them under their own privacy policies.

6. Who we share it with

We use the providers below (“sub-processors”) to run Xike. Each gets only what its job needs. Some are used only if you turn on that feature.

We may also share data: with your permission; with professional advisers under confidentiality; if the law, a court or a government authority requires it; to protect people’s safety or our rights; or with a buyer if Xike’s business is sold, under this same policy. We will tell owners about any change of sub-processor [e.g. 30 days] before it applies.

7. How long we keep it

• CCTV still pictures: 30 days by default, then deleted automatically. Face sightings go with them.
• What the AI saw on camera (text only): 90 days. A picture is kept only when it caused an alert, for the same 30 days.
• Face data (biometric retention and destruction): kept only to recognise the staff member who agreed, and deleted when they send STOP FACE or leave the business, and in any case within 24 months of their last interaction with the business. Sightings are deleted with the CCTV stills after 30 days. Customers’ faces are never enrolled.
• Team-chat photos, voice notes and check-in selfies: 180 days, then deleted. The message text and attendance times stay.
• Voice notes sent to the bot: not kept as audio at all — only the text.
• POS report files received by email: file contents deleted after one year (the imported numbers stay).
• Short text excerpts of emails read from a connected inbox: 30 days. A new sender’s sender and subject, while Xike asks whether to read their mail: until answered, at most 7 days.
• Sign-in codes: one day. Error records: 30 days.
• Bills, accounts, staff and customer records: as long as the business keeps its Xike account, because tax and accounting laws usually require bills to be kept for several years (6–8 years in India). The business can erase a customer’s name and number at any time (section 11).
• After an account is closed: we delete or anonymise the business’s data within [e.g. 90 days], except what we must keep by law (for example our own invoices to you), and backups, which expire within [backup retention period].

8. Where it is stored

Xike’s servers and database are hosted by Railway in [Hosting region, e.g. United States / Singapore]. Some providers in section 6 process data in other countries, including the United States. Between the two Xike companies: the India company and the Delaware company run the same service, so account and business data can move between India and the United States (for example, Indian staff of Xike support customers outside India, and the service is hosted in one place for everyone). The companies have an intra-group data transfer agreement [Intra-group data transfer agreement — India ↔ US (including EU Standard Contractual Clauses / UK Addendum)]. When data about people in India leaves India, we follow the DPDP Act and any rules or country restrictions the Government of India issues. For people in the EU / UK, transfers are covered by the European Commission’s Standard Contractual Clauses (and the UK Addendum) or another lawful transfer mechanism.

9. Security

• All traffic to Xike is encrypted in transit (HTTPS).
• Third-party API keys, mailbox tokens and recipes are encrypted in our database (Fernet: AES with HMAC). Face data is stored encrypted. PINs and sign-in codes are stored only as hashes.
• Each business sees only its own data. Inside a business, staff see only what their role allows. Emails are accepted from banks only when the sender’s identity checks (DKIM / SPF) pass.
• Camera passwords stay on the shop’s PC; fingerprints stay on the attendance machine.
• Regular database backups [confirm backup schedule, e.g. daily].

No system is perfectly secure. If a breach affects personal data, we will tell affected owners without undue delay and help them tell the people affected and the authorities, as the law requires (in India, the Data Protection Board; in the EU / UK, within 72 hours where required).

10. Cookies and browser storage

• The app uses one cookie, xike_session, to keep you signed in (30 days; secure, not readable by scripts). It is strictly necessary, so it does not need consent.
• The app, POS and guest QR pages also save small settings in your browser’s local storage, for example the current cart, the name and mobile a guest typed (so they don’t retype them), the last order, or a remembered country on the website. These stay on your device; you can clear them in your browser settings.
• We use no advertising or analytics cookies. Google and Apple set their own cookies if you use their sign-in buttons, and Razorpay or Stripe when you pay.

11. Your rights

Depending on where you live, you can ask to see your data, get a copy, correct it, delete it, withdraw consent, or object to some uses. We will not treat you differently for using these rights.

• Owners can download everything their business has put into Xike in one click (More → Your data → Download all my data), correct most things in the app, and ask us by email to close the account and delete the data.
• Customers: the business can give you a copy of your data or erase your name and number from its bills, bookings, jobs and feedback (More → A customer’s personal data). Amounts stay for the business’s accounts; erasing waits until any money owed on credit is settled. You can reply STOP to stop reminders and offers.
• Staff: ask your employer. You can send STOP FACE at any time to withdraw face recognition consent.
• Anyone can contact us (section 17). We may need to check who you are. We reply within [e.g. 30 days], or sooner if the law requires.

12. India — Digital Personal Data Protection Act, 2023

When the DPDP duties apply. The Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025. The Act’s duties on notice (section 5) and consent (section 6), legitimate uses, the rights listed below (sections 11–14), transfers abroad and penalties apply from 13 May 2027. Until then, section 43A of the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 apply, and we follow them: this policy, consent before sensitive personal data such as biometric data is collected, the option to refuse, and a Grievance Officer. We already honour the rights below.

Under the DPDP Act, you (the “data principal”) have the right to:

• get a summary of your personal data and how it is processed, and who it has been shared with;
• have it corrected, completed, updated or erased;
• withdraw your consent at any time, as easily as you gave it (this doesn’t affect processing before you withdrew);
• have your grievances addressed by our Grievance Officer;
• nominate someone to use your rights if you die or become unable to.

Where a business on Xike is the data fiduciary for you, send your request to that business; we will help it respond. If you are not satisfied with the answer, you may complain to the Data Protection Board of India.

13. EU and UK — GDPR and UK GDPR

If you are in the European Economic Area or the United Kingdom, the following also applies.

Lawful bases

• Contract: to provide Xike to owners and run their accounts, sign-in and billing.
• Legal obligation: tax, invoicing and accounting records; responding to lawful requests.
• Legitimate interests: keeping Xike secure, preventing abuse, fixing errors and improving the service — balanced against your rights.
• Consent: where we ask for it, which you can withdraw at any time.
• For data a business puts into Xike about its staff and customers, that business chooses and is responsible for the lawful basis; we act only on its instructions (Article 28).

Staff face recognition is not offered in the EU / EEA, the UK or Switzerland. Xike never infers emotions from voices or faces, and when staff use the bot they are told it is an AI assistant (EU AI Act, Article 50).

Your rights

Access, rectification, erasure, restriction, data portability, objection (including to processing based on legitimate interests), and withdrawing consent. You also have the right to complain to your local data protection authority (in the UK, the Information Commissioner’s Office).

Contacts

Data Protection Officer: [DPO name / contact, or “not appointed”]
EU representative (Article 27 GDPR): [EU representative]
UK representative (Article 27 UK GDPR): [UK representative]

14. United States — state privacy laws

If you live in California or another US state with a consumer privacy law (such as Colorado, Connecticut, Virginia, Utah or Texas):

• We do not sell or “share” personal information for cross-context behavioural advertising, and we have not done so in the past 12 months. We do not use sensitive personal information to infer characteristics about you.
• The categories we collect are listed in section 3 (identifiers, commercial information, audio such as voice notes, images such as CCTV stills, approximate location at check-in, employment information, and — only with consent — biometric information). Sources, purposes and recipients are in sections 3, 4 and 6; retention is in section 7.
• You can ask to know, access, correct or delete your personal information, and to opt out of sale, sharing or targeted advertising (we don’t do these). You can use an authorised agent. We will not discriminate against you for using your rights. If we refuse a request you may appeal by replying to our answer.
• For data a business holds about its staff and customers, we act as its service provider / processor; send requests to the business.
• Biometric laws: some states and cities have specific rules for biometric data. Xike does not offer staff face recognition in Illinois, Washington, Texas or Colorado, or in Portland, Oregon (which bans it in places open to the public), or for a business whose state we can’t tell from its address. Elsewhere in the US a business using it must give any notices and get any consent its law requires, and in California must not make it a condition of employment. Our retention and destruction schedule for face data is in section 7.

15. Children

Xike is for businesses and is not meant for children. Owners and staff accounts must be held by adults (18 or over, or the age of majority where they live). We do not knowingly collect data about children; a business should not enter a child’s details except what is needed to serve them as a customer (for example a name on a bill). If you think a child’s data has been given to us, contact us and we will delete it. In India, processing a child’s data needs verifiable consent of a parent under the DPDP Act.

16. Changes to this policy

We will update this page when what we do changes and change the date at the top. For important changes we will tell owners in the app or by email before they take effect.

17. Contact and complaints

India: [Company legal name — India], [Registered address]
Outside India: [Company legal name — US], [Address]
Email: [Privacy email]
Phone: [Phone]

See also: Terms of Use · Data Processing summary · Contact