Privacy Policy & Data Protection

1. Data Ingestion & Scope of Processing

When an end-user (“Visitor” or “Prospect”) visits a website deploying the Admiyz sales widget, the engine collects only the minimum necessary data to qualify purchasing intent and route the lead to authorized sales representatives:

• Directly Provided Information: Full name, telephone/WhatsApp contact number, email address, preferred inventory configurations (e.g., BHK requirements, carpet area preferences, budget ceiling), and appointment schedule requests.
• Automated Telemetry: IP address (utilized solely for coarse city-level geographic attribution and DDoS mitigation), browser user-agent, referral URL, and timestamped conversational dialogue transcripts.
• Workspace Metadata: Workspace identifier (x-workspace-id) associating all incoming telemetry exclusively with the designated enterprise customer account.

2. AI & Machine Learning Usage Policy

All inference queries are processed in isolated, stateless sessions. Customer data is injected strictly at runtime via Retrieval-Augmented Generation (RAG) prompts bound to the authenticated { workspaceId, isActive: true } scope. Once model inference completes, transient context prompts are permanently purged from inference runtime memory.

3. Meta WhatsApp Cloud API Compliance

Admiyz integrates natively with the Meta Cloud API v20.0 to deliver instant high-intent notifications, appointment confirmations, and direct sales rep handover links:

• Transactional Messaging Consent: WhatsApp notifications are triggered exclusively after a website visitor explicitly inputs their phone number and requests property details, price sheets, or consultation bookings.
• Template Pre-Approval: Outbound business messages utilize Meta-approved message templates conforming strictly to WhatsApp Business Messaging Policies.
• Opt-Out & STOP Processing: Recipients can revoke messaging permissions at any time by replying “STOP”. The Admiyz engine automatically sets communication preference status to OPTOUT in MongoDB and suppresses subsequent automated outreach.

4. Data Retention & Cryptographic Safeguards

Admiyz enforces defense-in-depth cryptographic and infrastructure security standards across the entire application lifecycle:

5. Data Subject Rights & Erasure

In accordance with global data protection frameworks—including the European Union General Data Protection Regulation (GDPR) and the Digital Personal Data Protection Act (DPDP Act 2023)—data subjects maintain specific statutory rights regarding their personal data:

• Right of Access & Portability: Customers can request a full JSON export of all leads, conversation transcripts, and deal records associated with their workspace via Developer Settings.
• Right of Rectification: Authorized team members can edit lead contact details directly from the CRM interface.
• Right of Erasure (“Right to be Forgotten”): Upon receipt of a verified deletion request from a Workspace Owner or individual lead, Admiyz executes a permanent hard-delete across all primary database collections and Redis cache keys within 30 days.

6. International Data Transfers

Admiyz infrastructure is hosted in enterprise-tier Google Cloud Platform (GCP) and AWS data centers. When data is transferred across international boundaries, transfers are executed under Standard Contractual Clauses (SCCs) and compliant Data Transfer Addenda guaranteeing an equivalent standard of protection.