1. Introduction

The Nox Digital ("Nox AI", "we", "us", or "our") is committed to protecting your privacy. This Privacy Policy sets out the basis on which personal data collected from you (the "Data Principal") is processed by us as a "Data Fiduciary" under the Digital Personal Data Protection Act, 2023 (DPDPA) and global data standards.

2. Data We Collect

• Identity & Account Data: Full name, verified email address, organization name, and authentication tokens.
• Creation Data: Prompts, website configuration inputs, section structures, and uploaded media assets.
• Technical & Log Data: Internet Protocol (IP) address, browser client metadata, and 180-day access logs required under CERT-In directives.
• Billing References: Razorpay customer reference IDs, GST details, and transaction receipts (we never store raw card numbers, CVVs, or bank credentials on our servers).

3. Purpose and Legal Basis for Processing

We process your data strictly for legitimate uses and contractual delivery:

• To synthesize multi-page procedural websites and maintain hosting containers.
• To maintain authentication sessions and manage subscription credits.
• To comply with statutory financial records, tax audits (GST), and cyber-incident logging requirements.

4. Third-Party Data Processors (Sub-processors)

We execute standard Data Processing Agreements (DPAs) with trusted infrastructure providers:

• Google Cloud (Vertex AI): AI synthesis (prompts are processed ephemerally without being used for foundational model retraining).
• Supabase (PostgreSQL): Encrypted database records, identity persistence, and access tokens.
• Vercel & Render: Edge reverse-proxying, frontend rendering, and managed backend containers.
• Razorpay: RBI-licensed, tokenized payment processing and invoice dispatch.

5. Your Rights as a Data Principal

Under the DPDP Act and GDPR, you have the right to:

• Right to Access: View all summary data and active projects attached to your account.
• Right to Correction: Update your profile metadata, personal info, and contact details.
• Right to Erasure: Delete your account and initiate a cascading purge across all active tables and hosted containers.
• Right to Grievance Redressal: File a formal grievance directly with our designated compliance officer.

6. Statutory Grievance Redressal Officer

In accordance with the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023, our designated Grievance Officer details are published below: