Legal

Privacy Policy

What Xike collects, why, where it is kept, for how long, who helps us, and what you can ask us to do with it. Written in plain English.

Effective date: [Effective date] · Last updated: [Last updated date]

Pilot version: our company details and a few terms are still being finalised. Questions in the meantime: [email protected]

1. Who we are

Xike (“Xike”, “we”, “us”) is software that runs a small business from one place: billing (POS), stock, supplier bills, payments, staff, attendance and reports, with an AI assistant you can talk to. It is provided by two companies, and the one your business contracts with is the data fiduciary / controller for your account:

Businesses in India: [Company legal name — India], a private limited company incorporated in India, [Registered address] (CIN [CIN]).
Businesses outside India: [Company legal name — US], a company incorporated in Delaware, USA, [Address] (Delaware file number [Delaware file number]).

In this policy “Xike”, “we” and “us” mean that company. The two companies work together to run one service; how they share data is described in section 8.

This policy covers the website xike.in, the Xike app (app.xike.in), the Xike POS, the guest QR menu and ordering pages, and the Xike staff bot on Telegram and WhatsApp.

2. Your role and ours

If you run a business on Xike (an “owner”), you decide what data about your staff, customers and suppliers goes into Xike and why. For that data you are in charge — the law calls you the data fiduciary (India) or controller (EU / UK) — and we process it only on your behalf and on your instructions. We are your data processor. Our Terms and Data Processing summary set this out.

For your own account (your name, email, billing details and how you use Xike), we are the data fiduciary / controller.

If you are a staff member, customer or supplier of a business that uses Xike, that business is responsible for your data. Please contact them first; we will help them answer you. You can also contact us (section 17).

3. What we collect and why

We only collect what a feature needs. Many items below are collected only when the owner turns that feature on.

Business owners and managers

Account details: name, email address, business name, business type, country, and optionally a WhatsApp number for alerts. If you sign in with Google or Apple, we receive your name, email and the provider’s account ID. Apple may give us a private relay email instead of your real one.
Sign-in: one-time email codes (stored only as a hash and deleted after a day) and a session cookie.
Business records: menu or items, prices, recipes, purchases, supplier bills, sales, stock, expenses, checklists, tasks, licences, reports and what you ask Xike.
Billing with Xike: your plan, AI-credit top-ups, invoices and GST / tax details. Card and bank details are entered on Razorpay’s or Stripe’s own pages; we do not see or store your full card number.

Why: to provide the service you signed up for (contract), to bill you, and to meet tax and accounting law.

Staff

Profile: name, phone number, role, language, shift times, and for managers an email to sign in. A POS PIN (stored only as a hash).
Bot and team chat: their Telegram or WhatsApp account ID, and the messages, photos and voice notes they send for work (tasks, checklists, requests, team chat). Each staff member gets a short privacy notice when they join the bot.
Voice notes: turned into text by a speech service. Voice notes sent to the bot are not kept as audio. Voice notes posted in team chat are kept like photos (see section 7).
Attendance: check-in and check-out times from a fingerprint / face machine (the machine keeps the fingerprint or face; only the user number and time reach Xike), from the bot, or entered by a manager. If the business has set a shop location, phone check-in asks for the staff member’s location at that moment only to check they are within the set distance; we keep that location and the distance with the punch. An optional check-in selfie.
Pay: salary, advances, commissions and payments recorded by the business.
Face recognition (only with the staff member’s own consent): if the owner asks and the staff member replies AGREE FACE on the bot, Xike keeps numbers made from 2–5 photos of their face (not the photos) and records when and on which camera they were seen. They can send STOP FACE at any time and their face data is deleted. Face recognition runs on Xike’s own servers with open-source software — no outside face service receives it. It is not offered in the EU / EEA, the UK, Switzerland or Australia, nor in the US in Illinois, Washington, Texas, Colorado or Portland, Oregon, or where we can’t tell from the business address which US state it is in. Customers are never enrolled, and unknown faces are not stored.

Why: to run the team features the business chose (on the business’s instructions). Face recognition: only on the staff member’s explicit consent.

Customers of a business

On bills: name and mobile number when the counter enters them, what was bought, amounts and payment method; a delivery address on delivery orders.
Guest QR orders: the items ordered, table, and — only if the guest types them — a name and mobile number. The guest’s browser remembers these for next time (section 10).
Customer list (CRM): visits, spend, birthday if given, notes, language, and whether they asked not to get messages (STOP).
Credit (khata / udhaar): what a customer owes and pays, credit limit, and reminders sent to them.
Bookings and job orders (salons, repairs, tailoring and similar): name, phone, appointment or job details.
Feedback: rating and comment left through the feedback link on a receipt; reviews the business connects or pastes (for example from Google).
Messages: khata reminders, offers and campaign messages the business sends, and customers’ replies to them.

Why: on the business’s instructions, to bill, deliver, keep accounts and keep in touch with its customers.

Suppliers

Name, contact person, phone, email, what they supply, payment terms, purchase orders and their invoices.

Emails and bank alerts (only when the owner connects them)

Forwarding address: each outlet can have a private Xike email address. Whatever is sent there (POS reports, bank alerts, delivery-app payouts, supplier invoices) is received and processed. Emails we can’t use are stored as “unknown” and the owner is told.
Connected mailbox (Gmail or Outlook): with read-only permission, Xike reads only the messages that match the outlet’s filters — bank and UPI alerts, POS reports, delivery-app payouts and supplier invoices. It does not read, store or use the rest of your mailbox. You can disconnect at any time; for Google we revoke the access.
Other mailboxes (IMAP): a mailbox at another provider (for example Zoho or your own domain) connects over IMAP with the mailbox or app password, which we store encrypted and delete when you disconnect. That password is not limited to reading, but Xike only reads the messages that match the filters, and sends from the mailbox only if its owner turns on “Reply in my style” (below) and taps Send.
Team members’ work inboxes: when the owner allows it, a team member (for example purchase or accounts staff) can connect their own work inbox. Xike reads only supplier mail from it — invoices and bills from senders that are approved. When a new sender writes, Xike asks the mailbox owner first and keeps only that email’s sender and subject until they answer (at most 7 days). Each person can see what Xike read from their inbox (“What Xike read”) and disconnect at any time.
“Reply in my style”: off unless the mailbox owner turns it on. Then Xike asks Google or Microsoft for a separate permission to send email (an IMAP mailbox sends with its saved password), and reads up to 30 of their recent sent replies to approved suppliers, in memory only, to learn their writing style; only a short style profile is kept, which they can see, edit or reset. A reply is always a draft first and is sent only when they tap Send. Turning it off deletes the sending permission we hold.
From emails read in a connected inbox, Xike keeps the invoice or bill file and a short text excerpt of the email; the excerpt is deleted after 30 days.
Bank and UPI alerts: from these we keep the date, amount, debit or credit, counterparty name and reference, to match payments to bills and purchases. Xike never connects to your bank and cannot move money.

Google user data. Xike’s use and transfer of information received from Google APIs will follow the Google API Services User Data Policy, including the Limited Use requirements. We use Gmail data only to provide the features above, we do not use it for advertising, we do not sell it, and no person at Xike reads it unless you ask us to for support, it is needed for security, or the law requires it.

CCTV (only when the owner connects cameras)

Still pictures, not video, taken by the shop’s own billing PC: on counter events (an item voided, a big discount, a cancelled or reprinted bill), when the owner taps “Look now”, for a daily check the owner sets, or for an AI watch rule.
The camera recorder’s password stays on the shop’s PC. Xike’s servers never connect to the cameras.
No video and no sound are stored by Xike.
Staff are told about CCTV in their joining notice. The business must also put up any CCTV notice its local law requires, and follow any rules on telling or consulting staff first (for example a works council in Germany, the CSE in France, staff representatives in Spain, or a union agreement or labour-inspectorate authorisation in Italy; written notice 14 days ahead in New South Wales and the ACT).

Website visitors and technical data

The website has no sign-up form, no analytics and no advertising trackers. It remembers the country you pick in your browser (section 10). Its fonts are loaded from Google Fonts, so your browser connects to Google.
Our servers see your IP address and basic request details. We use them to keep the service secure (for example to limit repeated sign-in attempts) and to fix errors. Error records are deleted after 30 days.

We do not sell personal data. We do not use it for advertising. We do not build profiles of people across businesses — each business’s data is kept separate.

4. How the AI uses data

Xike uses Anthropic’s Claude models to understand messages, read photos of bills, menus and checklists, look at CCTV stills for the checks the owner sets, answer questions, translate team chat and draft replies and messages. Only what is needed for that one request is sent.
When the AI answers a question about your business, it can only use read-only report tools limited to your own outlet. It cannot see another business’s data.
Some questions may use web search (for example current prices or rules). The search query goes through Anthropic’s web search tool; your business records are not published.
The AI is told not to identify people in pictures. Face recognition (section 3) is separate, runs on our servers, and is only for consenting staff.
Xike does not use your data, or your customers’ or staff’s data, to train AI models. Under Anthropic’s commercial API terms, Anthropic does not train its models on data sent through the API by default and keeps it only for a limited time for safety and abuse monitoring. See Anthropic’s commercial terms and privacy policy for details. [Confirm current Anthropic API retention period and zero-data-retention status]
Speech services (Sarvam AI, ElevenLabs or Deepgram) receive the audio of a voice note only to turn it into text. Voice notes are only turned into text (and translated). Xike never analyses tone, mood or emotion, from voices or from faces.
Our AI providers are outside most customers’ countries. Anthropic (USA) processes text, photos, documents and CCTV stills; ElevenLabs or Deepgram (USA) process voice-note audio outside India; Sarvam AI (India) processes Indian-language voice notes. Section 8 explains how transfers are protected.
Staff are talking to an AI. Replies from the staff bot and the messages and review replies Xike drafts are written by AI. The joining notice tells staff that the bot is an AI assistant. [Confirm the bot’s joining notice says this, and add machine-readable AI marking to generated audio and text before 2 Dec 2026 (EU AI Act Art. 50(2))]
AI can be wrong. Xike is built to tell you when something is missing, but it can misread a bill, mishear a voice note or give a wrong answer. Check important numbers before you act on them.
Xike suggests; your owner or manager decides. Pay estimates, attendance flags (such as “late”) and AI alerts are checked by a person before anything happens to anyone.
Nothing changes without a person confirming it. When the AI prepares a change (a price, a stock entry, a payment), you see it and approve it first. The one exception is a reply to a 4–5★ Google review, and only if the owner turns on automatic replies.
Xike is not for patient or prescription data. Pharmacies use it for stock and purchasing; don’t enter patients’ health information, prescriptions or clinical notes.

5. Payments

Xike never holds your customers’ money. In India, customers pay to the business’s own UPI ID (from the QR the business already has). Outside India, a business can connect its own Stripe account, and customer payments settle straight to that account. Xike takes nothing from your sales; your bank, UPI provider or Stripe may charge its own fees (in India, a bank may charge a merchant fee on some larger UPI payments). We store only the UPI ID or the Stripe account ID.
Xike reads bank alert emails to match payments; it has no access to your bank account and cannot move money.
Payments to Xike (the plan and AI credits) are handled by Razorpay (India) and Stripe (elsewhere). They receive the payer’s details needed to take the payment and keep them under their own privacy policies.

We use the providers below (“sub-processors”) to run Xike. Each gets only what its job needs. Some are used only if you turn on that feature.

Provider	What they receive	Why / when
Anthropic (Claude API), USA	Message text, questions, photos of bills / menus / checklists, CCTV stills for checks and watch rules, supplier invoice files	The AI features
Sarvam AI, India	Voice-note audio	Speech to text (Indian languages)
ElevenLabs or Deepgram, USA	Voice-note audio	Speech to text outside India / other languages, when set up
Telegram	Messages, photos and voice notes to and from staff	The staff bot
Meta (WhatsApp Business Platform)	Phone numbers and messages to and from staff, suppliers and customers	WhatsApp add-on: bot, purchase orders, khata reminders, offers
Google	Sign-in (name, email, account ID); filtered Gmail messages; replies sent with “Reply in my style”; Google Business Profile reviews	Sign in with Google; mailbox and reviews only when connected
Apple	Sign-in (account ID, email or relay email, name)	Sign in with Apple
Microsoft	Filtered Outlook / Microsoft 365 messages; replies sent with “Reply in my style”	Only when an Outlook mailbox is connected
Your mailbox provider (IMAP)	The mailbox sign-in, to read the filtered messages (and replies sent with “Reply in my style”)	Only when a mailbox is connected over IMAP
Razorpay, India	Payer details for payments to Xike	Plan and credit payments in India
Stripe	Payer details for payments to Xike; the business’s own Stripe account for its customer payments	Payments outside India
UrbanPiper / Deliverect	Online orders (including delivery customer name, phone, address), menu and item availability	Delivery-app integration, only when connected
Railway	All data held in Xike (hosting and database)	Running the service
Cloudflare	Emails sent to an outlet’s Xike address; website visits	Email routing to Xike; hosting xike.in
[Email sending provider]	Email address, sign-in codes, invites, purchase orders	Sending email from Xike

We may also share data: with your permission; with professional advisers under confidentiality; if the law, a court or a government authority requires it; to protect people’s safety or our rights; or with a buyer if Xike’s business is sold, under this same policy. We will tell owners about any change of sub-processor [e.g. 30 days] before it applies.

7. How long we keep it

CCTV still pictures: 30 days by default, then deleted automatically. Face sightings go with them.
What the AI saw on camera (text only): 90 days. A picture is kept only when it caused an alert, for the same 30 days.
Face data (biometric retention and destruction): kept only to recognise the staff member who agreed, and deleted when they send STOP FACE or leave the business, and in any case within 24 months of their last interaction with the business. Sightings are deleted with the CCTV stills after 30 days. Customers’ faces are never enrolled.
Team-chat photos, voice notes and check-in selfies: 180 days, then deleted. The message text and attendance times stay.
Voice notes sent to the bot: not kept as audio at all — only the text.
POS report files received by email: file contents deleted after one year (the imported numbers stay).
Short text excerpts of emails read from a connected inbox: 30 days. A new sender’s sender and subject, while Xike asks whether to read their mail: until answered, at most 7 days.
Sign-in codes: one day. Error records: 30 days.
Bills, accounts, staff and customer records: as long as the business keeps its Xike account, because tax and accounting laws usually require bills to be kept for several years (6–8 years in India). The business can erase a customer’s name and number at any time (section 11).
After an account is closed: we delete or anonymise the business’s data within [e.g. 90 days], except what we must keep by law (for example our own invoices to you), and backups, which expire within [backup retention period].

8. Where it is stored

Xike’s servers and database are hosted by Railway in [Hosting region, e.g. United States / Singapore]. Some providers in section 6 process data in other countries, including the United States. Between the two Xike companies: the India company and the Delaware company run the same service, so account and business data can move between India and the United States (for example, Indian staff of Xike support customers outside India, and the service is hosted in one place for everyone). The companies have an intra-group data transfer agreement [Intra-group data transfer agreement — India ↔ US (including EU Standard Contractual Clauses / UK Addendum)]. When data about people in India leaves India, we follow the DPDP Act and any rules or country restrictions the Government of India issues. For people in the EU / UK, transfers are covered by the European Commission’s Standard Contractual Clauses (and the UK Addendum) or another lawful transfer mechanism.

9. Security

All traffic to Xike is encrypted in transit (HTTPS).
Third-party API keys, mailbox tokens and recipes are encrypted in our database (Fernet: AES with HMAC). Face data is stored encrypted. PINs and sign-in codes are stored only as hashes.
Each business sees only its own data. Inside a business, staff see only what their role allows. Emails are accepted from banks only when the sender’s identity checks (DKIM / SPF) pass.
Camera passwords stay on the shop’s PC; fingerprints stay on the attendance machine.
Regular database backups [confirm backup schedule, e.g. daily].

No system is perfectly secure. If a breach affects personal data, we will tell affected owners without undue delay and help them tell the people affected and the authorities, as the law requires (in India, the Data Protection Board; in the EU / UK, within 72 hours where required).

10. Cookies and browser storage

The app uses one cookie, xike_session, to keep you signed in (30 days; secure, not readable by scripts). It is strictly necessary, so it does not need consent.
The app, POS and guest QR pages also save small settings in your browser’s local storage, for example the current cart, the name and mobile a guest typed (so they don’t retype them), the last order, or a remembered country on the website. These stay on your device; you can clear them in your browser settings.
We use no advertising or analytics cookies. Google and Apple set their own cookies if you use their sign-in buttons, and Razorpay or Stripe when you pay.

11. Your rights

Depending on where you live, you can ask to see your data, get a copy, correct it, delete it, withdraw consent, or object to some uses. We will not treat you differently for using these rights.

Owners can download everything their business has put into Xike in one click (More → Your data → Download all my data), correct most things in the app, and ask us by email to close the account and delete the data.
Customers: the business can give you a copy of your data or erase your name and number from its bills, bookings, jobs and feedback (More → A customer’s personal data). Amounts stay for the business’s accounts; erasing waits until any money owed on credit is settled. You can reply STOP to stop reminders and offers.
Staff: ask your employer. You can send STOP FACE at any time to withdraw face recognition consent.
Anyone can contact us (section 17). We may need to check who you are. We reply within [e.g. 30 days], or sooner if the law requires.

12. India — Digital Personal Data Protection Act, 2023

When the DPDP duties apply. The Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025. The Act’s duties on notice (section 5) and consent (section 6), legitimate uses, the rights listed below (sections 11–14), transfers abroad and penalties apply from 13 May 2027. Until then, section 43A of the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 apply, and we follow them: this policy, consent before sensitive personal data such as biometric data is collected, the option to refuse, and a Grievance Officer. We already honour the rights below.

Under the DPDP Act, you (the “data principal”) have the right to:

get a summary of your personal data and how it is processed, and who it has been shared with;
have it corrected, completed, updated or erased;
withdraw your consent at any time, as easily as you gave it (this doesn’t affect processing before you withdrew);
have your grievances addressed by our Grievance Officer;
nominate someone to use your rights if you die or become unable to.

Where a business on Xike is the data fiduciary for you, send your request to that business; we will help it respond. If you are not satisfied with the answer, you may complain to the Data Protection Board of India.

Grievance Officer

Name: [__]
Email: [__]
Phone: [__]
Address: [__]

We acknowledge grievances within [e.g. 48 hours] and aim to resolve them within [e.g. 30 days]. This officer also handles grievances under the Information Technology Act, 2000 and its rules.

13. EU and UK — GDPR and UK GDPR

If you are in the European Economic Area or the United Kingdom, the following also applies.

Lawful bases

Contract: to provide Xike to owners and run their accounts, sign-in and billing.
Legal obligation: tax, invoicing and accounting records; responding to lawful requests.
Legitimate interests: keeping Xike secure, preventing abuse, fixing errors and improving the service — balanced against your rights.
Consent: where we ask for it, which you can withdraw at any time.
For data a business puts into Xike about its staff and customers, that business chooses and is responsible for the lawful basis; we act only on its instructions (Article 28).

Staff face recognition is not offered in the EU / EEA, the UK or Switzerland. Xike never infers emotions from voices or faces, and when staff use the bot they are told it is an AI assistant (EU AI Act, Article 50).

Your rights

Access, rectification, erasure, restriction, data portability, objection (including to processing based on legitimate interests), and withdrawing consent. You also have the right to complain to your local data protection authority (in the UK, the Information Commissioner’s Office).

Contacts

Data Protection Officer: [DPO name / contact, or “not appointed”]
EU representative (Article 27 GDPR): [EU representative]
UK representative (Article 27 UK GDPR): [UK representative]

14. United States — state privacy laws

If you live in California or another US state with a consumer privacy law (such as Colorado, Connecticut, Virginia, Utah or Texas):

We do not sell or “share” personal information for cross-context behavioural advertising, and we have not done so in the past 12 months. We do not use sensitive personal information to infer characteristics about you.
The categories we collect are listed in section 3 (identifiers, commercial information, audio such as voice notes, images such as CCTV stills, approximate location at check-in, employment information, and — only with consent — biometric information). Sources, purposes and recipients are in sections 3, 4 and 6; retention is in section 7.
You can ask to know, access, correct or delete your personal information, and to opt out of sale, sharing or targeted advertising (we don’t do these). You can use an authorised agent. We will not discriminate against you for using your rights. If we refuse a request you may appeal by replying to our answer.
For data a business holds about its staff and customers, we act as its service provider / processor; send requests to the business.
Biometric laws: some states and cities have specific rules for biometric data. Xike does not offer staff face recognition in Illinois, Washington, Texas or Colorado, or in Portland, Oregon (which bans it in places open to the public), or for a business whose state we can’t tell from its address. Elsewhere in the US a business using it must give any notices and get any consent its law requires, and in California must not make it a condition of employment. Our retention and destruction schedule for face data is in section 7.

15. Children

Xike is for businesses and is not meant for children. Owners and staff accounts must be held by adults (18 or over, or the age of majority where they live). We do not knowingly collect data about children; a business should not enter a child’s details except what is needed to serve them as a customer (for example a name on a bill). If you think a child’s data has been given to us, contact us and we will delete it. In India, processing a child’s data needs verifiable consent of a parent under the DPDP Act.

16. Changes to this policy

We will update this page when what we do changes and change the date at the top. For important changes we will tell owners in the app or by email before they take effect.

17. Contact and complaints

India: [Company legal name — India], [Registered address]
Outside India: [Company legal name — US], [Address]
Email: [Privacy email]
Phone: [Phone]