Privacy Policy

Oxid Live, Dhaka, Bangladesh. The legal entity behind the service is named here once registered. Effective: 2026-09-17. Version 0.1 — draft for legal review; not yet in force.

This policy covers two groups of people:

Tenant users — the people who sign up for and use the Oxid Live console and API on behalf of a business.
End customers — the people who talk to an Oxid Live agent: on a business's website widget, on WhatsApp or Messenger, or on a phone call.

If you are an end customer, the business you contacted decides why your data is processed and how long it is kept; we process it for them. Requests about your data go to that business first, and we help them answer.

1. What we collect

Tenant users

Data	Why	Kept
Email, name, password hash, two-factor secret	Sign-in and account security	Until the account is closed + 30 days
Role, team, sessions, IP address and browser at sign-in	Access control, security and audit	Sessions 7 days; sign-in log 1 year
Business name, address, payment records, invoices	Billing, tax and accounting	7 years, as required by law
Everything you do in the console (audit trail)	Your own record of changes; our security	Life of the account + 1 year
Support conversations	Helping you	2 years

End customers

Data	Why	Kept
Phone number, WhatsApp ID or Messenger ID, name if given	Identifying the conversation and the order it relates to	The business's retention setting (default 90 days)
Messages and call transcripts	Answering, handing over to a person, quality review	Same
Call recordings (two channels: customer and agent)	Quality review, dispute resolution, the business's own compliance	Same; a legal hold set by the business or a court stops deletion
Order details the business shares with the agent	Confirming, changing or cancelling the order	Same
Per-call timing and outcome	Service quality; billing the business	Aggregated after 90 days
Messages that try to extract the agent's instructions or the technology behind it	Platform security; our staff review who is asking	1 year

We do not collect payment-card numbers, national ID numbers or health information from end customers, and the agent is configured not to ask for them.

2. Calls are announced

On every call the agent says, in the customer's language, that it is an automated assistant and that the call is recorded — before anything else. The agent never claims to be human, and says it is automated whenever asked.

3. Who sees the data

The business you contacted: its staff see the conversations and recordings for their own account, with roles that limit who sees what.
Oxid Live staff: do not read transcripts or listen to recordings in the normal course of business. Access needs a ticket and a reason, lasts one hour, and every access is written to the business's own audit trail. Audio is never played back inside our tools; it is pulled from the archive under a ticket.
Sub-processors (section 5).
Authorities, where a Bangladeshi law or court order requires it. We tell the business unless the law forbids it.

We do not sell data. We do not use end-customer data for advertising.

4. Models and training

Conversations are processed by speech-recognition, text-to-speech and language models to produce the agent's replies. During Phase 1 some of these run at the providers in section 5; each is under a contract that forbids using the data to train their models.
We do not train our own models on a business's conversations unless that business has accepted the training clause in its contract. It is off by default. Where it is on, the business tells its customers in its own privacy notice, and recordings marked for training are stripped of phone numbers and names before use.

5. Sub-processors

Provider	What	Where
Hetzner Online GmbH	Servers and database	Singapore
Cloudflare, Inc.	Network edge, object storage for recordings and files, DNS, email routing	Global edge; storage in Asia-Pacific
A language-model provider (United States)	Generating the assistant's replies and knowledge-base retrieval, Phase 1	United States
A second language-model provider, only for businesses that opt in	Reply generation for non-real-time channels	Provider's regions, named in the contract
Speech-recognition and speech-synthesis providers	Transcribing and voicing calls, Phase 1	India; United States / EU
Meta Platforms, Inc.	WhatsApp Business and Messenger delivery	Meta's regions
SSLCommerz	Payments (tenant billing only)	Bangladesh
Stripe, Inc.	Payments for customers outside Bangladesh (tenant billing only)	United States / EU
Mailgun (Sinch)	Transactional email to tenant users	United States / EU
A licensed Bangladeshi IPTSP (named per contract)	Phone calls	Bangladesh

The named providers, their contracts and their data terms are in the data-processing agreement signed with each business; we give 30 days' notice before adding one. Our own speech and language models replace the Phase 1 providers as they come online; we update this table when they do.

6. Where data lives

Phase 1: servers in Singapore, recordings and files in Cloudflare's Asia-Pacific storage, with the providers above wherever their APIs run. We move hosting to Bangladesh when in-country capacity is available; bank and financial-institution tenants may require in-country hosting from day one, and we provide it under contract.

7. Security

Encryption in transit everywhere and at rest for recordings and files, with a separate key per business; row-level isolation between businesses in the database; two-factor sign-in for administrative roles; secrets in a dedicated vault; a full audit trail; break-glass staff access as described in section 3; backups kept for 35 days. Security reports go to security@oxid.live; we acknowledge within 3 working days.

8. Your rights

Whether you are a tenant user or an end customer, you may ask to:

see the data we hold about you,
correct it,
delete it (a business may keep what it needs for an order, a dispute, or the law),
receive a copy in a usable format,
object to a use, or withdraw consent where consent was the basis.

End customers: ask the business you contacted; they can act in the console or ask us to. Tenant users: privacy@oxid.live. We answer within 30 days.

Bangladesh's personal-data law is changing; when the Personal Data Protection Ordinance (or its successor) comes into force we will update this policy to match it, and we already follow its published principles. For businesses subject to the GDPR or similar laws, we sign a data-processing agreement on request.

9. Children

The Service is not directed at children. A business must not configure an agent for a service aimed at children without agreeing additional terms with us.

10. Changes

We announce material changes in the console and by email 30 days before they take effect. The version and effective date are at the top of this page.

11. Contact

Oxid Live · Dhaka, Bangladesh · privacy@oxid.live · security@oxid.live