Introduction
This Privacy Policy explains how Loyus Solutions Pvt. Ltd. ("Loyus", "we", "us" or "our") collects, uses, shares and protects personal data when you use the xenzee suite of applications and related services (the "Services"). "xenzee" is a brand of Loyus Solutions Pvt. Ltd. We are committed to handling personal data responsibly and being clear about what we do with it.
This Policy works alongside our Terms of Service. By using the Services, you acknowledge the practices described here.
Who is responsible
For personal data relating to your own use of the Services (such as your account and how you interact with the Apps), Loyus Solutions Pvt. Ltd. is the data controller. For personal data that you load into the Apps about other people, for example your employees, candidates, customers or contacts, you are the data controller and we act as your data processor, handling that data on your instructions to provide the Services. This distinction is explained further in the roles section below.
Scope of this policy
This Policy covers the xenzee suite, including Delta, Atlas, Haven, Nexus, Forge, Campaigns and Pulse, and the websites and account systems that support them. It does not cover third-party services you choose to connect (Connected Platforms), which are governed by their own privacy policies.
Information we collect
We collect the following categories of information:
- Account information you provide when you sign up and set up your organisation and users, such as name, sign-in identifiers and role.
- Content you submit to the Apps, which may include personal data about other people that you choose to store or process.
- Connected Platform data that you authorise us to access on your behalf, such as advertising metrics, social engagement, search data, mailbox content or payment records, used to provide the relevant App.
- Usage and device information generated as you use the Services, such as log data, actions taken, approximate location derived from IP, browser and device details.
- Billing information needed to manage paid plans, which is processed by our payment providers.
- Communications you send us through in-app support.
How we use information
We use personal data to:
- provide, operate and maintain the Services and the functions you ask them to perform;
- authenticate you, secure accounts and prevent fraud and abuse;
- connect, sync and exchange data with the Connected Platforms you enable;
- generate the reports, insights and automations that are core to the Apps;
- provide support and respond to your requests;
- improve, develop and troubleshoot the Services; and
- comply with legal obligations and enforce our Terms.
Legal bases
Where data protection law requires a legal basis, we rely on: performance of our contract with you to deliver the Services; our legitimate interests in operating, securing and improving the Services in a way that is not overridden by your rights; your consent where we ask for it, for example to enable certain optional features or connections; and compliance with legal obligations. Where you act as controller of data you load into the Apps, you are responsible for establishing the legal basis for that processing.
Controller and processor roles
Several Apps are designed to hold personal data about your own people and customers. For that data you are the controller and we are your processor. As processor, we process such data only to provide the Services and on your documented instructions, apply appropriate security, assist you with data-subject requests and security obligations where reasonable, and delete or return the data at the end of the service in line with our retention practices. You are responsible for the lawfulness of the data you place in the Apps and for honouring the rights of the individuals it concerns.
Connected platforms and tokens
When you connect a Connected Platform, you authorise us, through that platform’s official authentication, to access the data and perform the actions needed to run the relevant App. We store the access credentials (such as tokens) securely and use them only for the connection you set up. You can disconnect at any time, which revokes our ongoing access. What the platform shares with us, and how it uses any data we send, is governed by that platform’s own terms and privacy policy.
Use of Google, Meta and other platform data
Where the Services access information through Google APIs, our use and transfer of that information complies with the Google API Services User Data Policy, including its Limited Use requirements. Specifically, we use Google user data only to provide and improve the features you have enabled; we do not transfer it except as necessary to provide those features, with your consent, or as required by law; we do not use it for advertising; and we do not allow humans to read it unless you give consent, it is necessary for security or to comply with law, or the data has been aggregated and anonymised.
Where the Services access data through Meta (Facebook, Instagram, Threads) or other platforms such as LinkedIn, X, Pinterest, TikTok or Google Business Profile, we handle that data in line with each platform’s developer and platform terms, and use it only to provide the features you enable. We do not sell platform data or use it for purposes you have not authorised.
Automated processing and AI
Some features use automated processing, including AI-assisted tools, to draft content, suggest links, score or route records, and assemble reports. These features are designed to help you work faster and to keep your data complete and consistent; they support your decisions rather than make legally significant decisions about individuals on their own. You remain responsible for reviewing and acting on the outputs.
Data retention
We keep personal data for as long as needed to provide the Services to you, and afterwards only as long as necessary for legitimate business purposes such as security, dispute resolution and legal compliance. When you delete content or close your account, we delete or anonymise the associated data within a reasonable period, except where we are required or permitted to retain it. Where we act as your processor, retention follows your instructions and our agreement with you.
How we protect data
We use technical and organisational measures appropriate to the risk, including encryption in transit, access controls, role-based permissions, keeping sensitive financial figures need-to-know, storing third-party credentials as protected references, and maintaining audit logs of changes. No method of transmission or storage is completely secure, but we work to protect your data and to respond promptly to any incident.
Hosting and international transfers
The Services are hosted on cloud infrastructure provided by Amazon Web Services (AWS), and personal data is processed and stored primarily in the United States. If you access the Services from outside the United States, your personal data will be transferred to, and processed in, the US and potentially other countries where we or our service providers operate.
Where we transfer personal data across borders, we take steps to ensure it remains protected in line with applicable law, including using appropriate safeguards (such as standard contractual clauses) with the providers who process it on our behalf. Details of our infrastructure and other sub-processors are listed on our Sub-processors page.
Your rights
Depending on where you live, you may have rights to access, correct, update, delete, restrict or object to the processing of your personal data, to data portability, and to withdraw consent where processing is based on it. You may exercise these rights through the controls in your account or by contacting us through the in-app support options. Where we act as a processor for data you control, please direct individuals’ requests to you as the controller, and we will assist you as needed. You also have the right to complain to your local data protection authority.
Children
The Services are intended for businesses and adults. They are not directed to children, and we do not knowingly collect personal data from children. If you believe a child has provided us personal data, please contact us through your account so we can address it.
App-specific privacy
The following notes describe data practices specific to individual Apps, in addition to the general Policy above.
Delta (social media)
Delta processes the social accounts you connect and the content and engagement data needed to schedule, publish and manage interactions on your behalf. It may handle the personal data of people who interact with your social profiles, for which you are the controller.
Atlas (SEO)
Atlas processes data about the websites and search properties you add, including crawl data, rankings and analytics you connect. This is generally about your own properties and is used to provide audits, tracking and recommendations.
Haven (HR)
Haven holds personal data about your employees and candidates, which can include sensitive information. You are the controller of this data and we process it for you to provide the App. You are responsible for a lawful basis, for any required notices to your people, and for keeping records accurate.
Nexus (CRM)
Nexus holds personal data about your contacts and customers and supports communications, quoting, invoicing and payments. You are the controller of this data. Payments are handled by third-party payment providers under their own privacy terms.
Forge (projects and ROI)
Forge processes project, client, time and cost data, and combines figures from other Apps and Connected Platforms to produce profitability and ROI reporting and a client portal. Cost and margin data is treated as need-to-know and gated by role.
Campaigns (paid ads)
Campaigns processes the advertising accounts you connect and the spend, performance and audience data needed to launch and track Campaigns. Audience and targeting features are subject to the rules and privacy terms of each advertising network.
Pulse (reporting)
Pulse reads data from the Apps and Connected Platforms you enable to build cross-app reports. It aggregates figures such as revenue, cost, people and marketing performance for your internal reporting, and reflects the access controls of the underlying sources.
Grievance redressal (India)
For users in India, and in line with the Digital Personal Data Protection Act, 2023, you may raise concerns or complaints about how your personal data is handled. Loyus Solutions Pvt. Ltd. has designated a Grievance Officer who is responsible for addressing such requests. You can contact the Grievance Officer and submit a complaint through the dedicated support and grievance options inside your xenzee account dashboard. We will acknowledge your complaint and respond within the timelines required by applicable law.
Changes to this policy
We may update this Policy from time to time. When we make material changes, we will update the "last updated" date and, where appropriate, notify you within the Services. Your continued use after an update means you acknowledge the revised Policy.
How to reach us
If you have questions about this Policy or how we handle personal data, or you wish to exercise your rights, you can reach us through the support options inside your xenzee account dashboard. We will respond in line with applicable law.