Privacy Policy

This Privacy Policy explains how Corex Software Private Limited ("we", "us", "our") collects, uses, shares and protects information through Oxigrid (the "Service"), a CRM and lead-management platform with WhatsApp automation, available at this website and at app.oxigrid.com. By using the Service you agree to the practices described here. Questions: [email protected].

1. Information we collect

Account and workspace data

Your name, email address, phone number, company name and the details you provide when you create an account or invite team members.

Lead data

Information about your prospects and customers that you, your team or your connected integrations bring into the Service — such as name, email, phone number, company, notes and conversation history. For this data you are the data controller and we process it on your behalf.

Data from connected integrations

• Meta (Facebook and Instagram): when you connect a Facebook Page or Instagram business account, we receive lead-form submissions and the messages and comments sent to that Page or account through Meta's Graph API — including the contact's name, profile picture and message content — so you can view and reply to them inside the Service.
• WhatsApp Business Platform (Meta): when you connect a WhatsApp Business Account, we receive your account and phone-number identifiers, your message templates, and the messages exchanged between your business and your contacts — including each contact's WhatsApp number, profile name, message content and delivery status. If you connect an existing WhatsApp Business app number, we also receive messages you send from the app and, with your consent, recent chat history. We send messages only when you or your team initiate them or configure them (for example broadcasts and auto-replies).
• Google: when you connect a Google account, we receive the form responses, spreadsheet rows, ad leads and calendar data you authorise, to import leads and schedule follow-ups. Use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Payment data

Subscription payments are processed by Razorpay. We receive the payment status, amount and a reference ID; we never receive or store your full card, UPI or bank account details.

Usage data

Technical information such as IP address, browser type, pages visited and actions taken in the app, used to keep the Service secure and to understand how it is used. Inside the app we use Microsoft Clarity for aggregated session analytics.

2. How we use information

• To provide the Service — lead capture, pipeline management, the shared inbox, broadcasts, automations and reporting.
• To sync and display data from the integrations you connect, and to send messages you initiate.
• To provide AI features (lead scoring, suggested replies, the AI chatbot). Relevant lead and message content may be sent to Google's Gemini API for processing.
• To send account emails such as verification codes, password resets and billing receipts.
• To process subscription payments and prevent fraud.
• To maintain security, prevent abuse and comply with legal obligations.

We do not sell your data or your leads' data, and we do not use data received from Meta or Google for advertising.

3. How we share information

We share information only with service providers that help us run the Service, and only as needed:

• InterServer — server hosting where the application and database run.
• Cloudflare — DNS, network security and encrypted backup storage.
• Meta Platforms — for the WhatsApp, Facebook and Instagram integrations you connect.
• Google — for the Google integrations you connect and for Gemini AI features.
• Microsoft — for sending account emails and for Clarity analytics.
• Razorpay — for payment processing.

We may also disclose information when required by law, or to protect the rights, safety or property of Corex Software Private Limited, our users or the public.

4. Data retention and deletion

We keep your account and workspace data while your account is active. If you close your account, we delete or anonymise your data within 30 days, except where the law requires us to keep it longer (for example invoices and tax records). Encrypted backups are removed on their normal rotation within a further 30 days.

You can request deletion at any time by emailing [email protected]. Step-by-step instructions, including how to remove data received through Facebook, Instagram and WhatsApp, are on our Data Deletion Instructions page.

5. Your rights

Subject to applicable law, including India's Digital Personal Data Protection Act, 2023, you may access, correct, export or delete your personal data, and withdraw consent — for example by disconnecting an integration from the Integrations page. If a lead in one of our customers' workspaces contacts us, we will refer the request to that customer and assist them in responding.

6. Security

We protect data with encryption in transit (TLS), encrypted storage of integration credentials, workspace-level access controls, signature verification on incoming webhooks, and restricted administrative access. No system is perfectly secure, and we cannot guarantee absolute security.

7. Children

The Service is a business tool and is not intended for anyone under 18.

8. Changes to this policy

We may update this policy as the Service changes. We will update the date at the top of this page and notify registered users of material changes by email or in the app.

9. Contact and grievance officer

Corex Software Private Limited
A-222, Sun South Street, near Safal Parisar Road, South Bopal, Ahmedabad, Gujarat 380058, India
Email: [email protected]
Phone: +91 88668 78299

Complaints about how we handle personal data can be sent to our Grievance Officer at the same email address. We acknowledge complaints within 48 hours and aim to resolve them within 30 days.