Privacy policy

Who is responsible

This notice covers Switchapex’s website and the workspace features expressly enabled for a customer. The legal operator and privacy contact must be verified before this draft is adopted. Privacy enquiries can be addressed to [email protected].

Legal operator

Awaiting business confirmation

Registered address

Awaiting business confirmation

Grievance contact

Officer name and designation to be confirmed

Telephone

To be confirmed

For information used to manage its own enquiries or customer relationships, the operator determines the purposes of processing. Where a business uploads its customers’ records, that business may determine the purposes and Switchapex may act on its documented instructions. The relevant service agreement should define those roles.

Information used by this website

• Enquiries: name, work email, business name, and the service interest you enter. The current form sends these details to a website endpoint and creates a downloadable enquiry file on your device. The endpoint presently uses a non-persistent demonstration connector; it does not deliver an email to the team or create a durable customer record.
• Technical requests: the hosting provider can receive network information such as IP address, request time, browser information, and error details when serving the site. Production log settings and retention need confirmation.
• External fonts: this site loads Google Fonts. Your browser contacts Google to obtain them, which discloses request information to Google. See Google Fonts privacy information.

Do not submit Aadhaar numbers, financial credentials, health records, or other sensitive information through the enquiry form. We have not identified an advertising pixel or optional analytics tracker in the current website implementation. Any later tracking must be disclosed before use, with consent where required.

Workspace data, where enabled

A live workspace may need account contact details, authorised team membership, business profiles, posts, media, reviews, lead records, campaign metrics, and connection tokens to deliver the features you choose. The exact categories, permissions, providers, and storage periods must be documented for each live integration. Merely visiting this website does not connect your social accounts.

Where Razorpay is used for a transaction, it handles payment information through its own flow. Switchapex may receive transaction references, status, amounts, billing details, or refund references needed to administer the purchase. This site currently has no live checkout; the payment disclosure must be verified before one is enabled.

Purposes and consent

Information is used to handle the interaction you request, provide the agreed service, maintain authorised connections, respond to support issues, protect against misuse, and meet applicable record-keeping duties. Marketing communications require an appropriate basis and a practical way to opt out.

Where consent is required, the notice must identify the data and purpose before consent is obtained. Consent can be withdrawn through the privacy contact. Withdrawal stops the relevant consent-based future processing and may disable the feature, but does not automatically erase records that must lawfully be retained.

Google, Meta, LinkedIn, and X data

The following restrictions apply to an integration only when it is enabled and authorised. Provider-specific permissions and approved API access determine what is available.

Google

For authorised Google features, relevant data may include Business Profile details, reviews, posts, and campaign metrics. Use is limited to the disclosed feature and minimum necessary permissions. Switchapex’s use and transfer of information received from Google APIs must adhere to the Google API Services User Data Policy, including its Limited Use requirements where applicable. Such data must not be sold, used for personalised advertising, or transferred for unrelated purposes. Human access is restricted to the permitted consent, security, legal, or aggregated internal-use exceptions. New uses require updated disclosure and consent where required.

Facebook and Instagram (Meta)

Authorised features may involve Page or professional-account details, posts, comments, lead-form submissions, and campaign insights. Access must be tied to the permissions granted and the approved feature. Platform data is not licensed for resale or unrelated profiling. Users must have an accessible way to request deletion. Consult the Meta Platform Terms and our deletion instructions. Current Meta app permissions and review status still require verification.

LinkedIn

Access is limited to the approved LinkedIn product and authorised account or organisation data. Storage must be limited to what is permitted and necessary. Where LinkedIn’s general API terms apply, data and tokens collected for a member must be deleted immediately on their deletion request or account closure, except where law prevents deletion. Marketing APIs may have additional terms. See the LinkedIn API Terms.

X

Authorised features may use account details, posts, and available engagement data. Stored X content must reflect changes or deletions on X. The developer policy requires relevant changes as soon as reasonably possible, and within 24 hours of a request from X or the account owner, subject to its specified legal exception. See the X Developer Policy.

Sharing and AI-assisted features

The proposed policy limits disclosure to the customer’s authorised users, providers needed to deliver a requested feature, legally required disclosures, and appropriately handled business transfers. Connected-platform data must not be sold or shared with data brokers.

An AI feature must explain what information it sends to a model provider before use. Connected-platform information must not be used to train a general-purpose AI model or for unrelated profiling contrary to platform restrictions. AI providers, processing locations, retention settings, and contractual restrictions need verification before customer data is sent. Review generated content before publishing.

No named hosting, messaging, AI, or security vendor is represented here as an active processor without verification. The production processor list and international processing arrangements must be confirmed and disclosed before launch.

Retention and security

Keep information only for the disclosed purpose and necessary legal obligations. Workspace records, connection tokens, enquiry records, backups, and security logs require a documented retention schedule. These periods have not yet been verified; this draft does not promise an automatic 30-day export period or a fixed deletion date for every type of record.

Revoked or expired permissions must stop further authorised collection. A deletion request should remove the relevant operational records and address copies held by processors. Any exception must identify the legal reason, restricted use, and retention period; stricter provider deletion requirements still apply.

Safeguards must reflect the risks of the actual deployment, including access controls, protected credentials, and secure transfers. No specific encryption standard, audit certification, or breach-free guarantee is claimed. Breaches must be assessed and reported to affected people or authorities when applicable law requires.

Your rights and Indian privacy law

You may contact us about access, correction, consent withdrawal, deletion, or a privacy grievance. Where applicable and in force, the Digital Personal Data Protection Act, 2023 also provides rights concerning information about processing and nomination. Requests may require proportionate identity verification. Do not send passwords or unnecessary identity documents.

The DPDP Act and Rules have phased commencement. Applicable obligations must be checked for the date and processing activity; these pages do not claim every DPDP provision is already enforceable. Other applicable Indian laws, including the Information Technology Act and rules where still relevant, must also be considered.

References: DPDP Act, 2023 and government overview of phased implementation.

Delete data or disconnect an account

Use the data-deletion instructions to identify the records you want removed and the connection you want revoked. A deletion request is not an automatic cancellation of a billing mandate. Removing app access at a provider stops future access but does not necessarily remove previously held copies or posts already published on that provider.

If a business holds your information in its Switchapex workspace, contact that business as well. We must verify the appropriate authority before deleting another organisation’s records.

Children and sensitive information

This business service is intended for adults aged 18 or over. Do not knowingly create accounts for children or upload children’s personal data without the required lawful basis, safeguards, and any necessary parental consent. If you believe a child’s information has been submitted improperly, contact [email protected] so it can be investigated.

Questions, grievances, and updates

Send privacy concerns to [email protected] with the subject “Privacy request” and enough information to identify the interaction or account. Grievance-officer details and operational response periods must be completed before this policy is adopted. Applicable statutory and platform deadlines take priority.

The revision date changes when this notice is updated. A new purpose or materially different use of information requires an updated notice and fresh consent where required, rather than relying only on a revised date.