Last Updated: 31-Aug-2026
This Privacy Policy (“Policy”) describes how Xcelore (“Company,” “we,” “us,” or “our”)
collects, uses, discloses, and protects the Personal Data of customers (“End Users”) of businesses
(“Our clients”) using the software product, ‘Exei’ (“AI Agent”). Exei is a tool for helping
businesses to elevate their customer service and automate the redundant operational tasks,
thereby reducing cost & elevating customer experience while driving growth. The AI Agent
powered by Exei can integrate with many channels, such as Websites, Mobile Applications,
WhatsApp, Instagram, Facebook, Slack, Toll-Free Numbers, etc., allowing End Users to
communicate with businesses in these channels. By engaging our Services, our Clients agree to
the practices described herein. End Users should refer to the Client’s privacy policy for
additional details about their data handling.
1. Objective
Xcelore is dedicated to the highest level of data privacy and adheres to all guidelines established
by law. The safeguarding of Personal Data and Sensitive Personal Data or Information is
fundamental to developing confidence in Xcelore and maintaining its reputation. This Policy
designates a sound framework to control and protect Personal Data, and to process Personal Data
lawfully, securely, and transparently, which will enhance our operations and fill customers with
trust. Xcelore processes Personal Data according to Client requirements, as outlined in our
service agreements and Data Processing Agreements, ensuring compliance with the applicable
laws.
2. Definitions
- Data Controller – Our Business Clients using Exei’s services for their customers act as
Data
Controller and determine the purposes and methods of processing Personal Data, including
the types of Personal Data collected and the purposes for their use. - Data Processor – Xcelore, while acting as Data Processor, processes the Personal Data of
customers / End Users on behalf of the Data Controller as per strict contractual agreements. - Customers / End Users: An individual whose Personal Data is subject to Processing.
- Personal Data: Any information relating to an identified or identifiable Customer / End
User, including but not limited to name, email address, contact number, payment
information, billing details, IP address, device information, usage data, location data and chat
logs, provided by Data Controller to Xcelore for processing or submitted to AI Agent by
Data Controller’s Customer / End User. - Sensitive Personal Data or Information: Personal Data requiring heightened protection
provided by the Data Controller to Xcelore for processing or submitted to the AI Agent by
the Data Controller’s Customer / End User, such as:- Political affiliations
- Religious beliefs
- Philosophical beliefs
- Race or ethnicity
- Sexual orientation
- Health data
- Biometric data
- Criminal history
- Credit or financial data
- Trade union and membership information
- Consent: A freely given, specific, informed, and unambiguous indication of agreement by
the Data Controller and/or the End Users to the retention and Processing of Personal Data,
expressed through a clear affirmative action. - Processing Personal Data: Any operation or set of operations performed on Personal Data,
such as collection, recording, organisation, storage, use, disclosure, analysis, restriction,
erasure, or destruction. - Software: The software product ‘Exei’ is provided by Xcelore to Businesses and is
accessible to End Users via AI Agent interactions. - Sub-processors: Trusted service providers engaged by Xcelore to support its Services. The
list of Xcelore’s sub-processors can be found Sub-processors - Third Party / Parties: Any individual or entity other than the Customers / End Users, Data
Controller, Data Processor and Sub-processors.
3. Roles of Data Controller and Data Processor
When we deliver services to our Business Clients who are data controllers, we process data as a
data processor. We process personal data on behalf of and according to the requirements of our
Clients and in response to queries submitted by the End Users. Our Clients are responsible for
the purposes and manner in which personal data is processed. Our Clients are responsible for the
lawful collection of personal data, including obtaining any necessary consent or other legally
mandated authorisations and dealing with End Users in relation to their data rights.
4. How Xcelore Collects and Processes Personal Data
When End Users interact, submit their Personal Data or raise their queries to the AI Agent, or
when our Clients share Personal Data of End Users with us, we collect information that helps our
clients to serve the End Users with the best services. We may collect data in the following ways:
- Personal Data provided directly by our Business Clients about their End Users / Customers.
- Personal Data submitted by End Users / Customers as they engage with the AI agent.
We process the Personal Data as per the requirements of our client and in response to queries
submitted by the End Users. We take reasonable measures to ensure that the personal data is
secure and to prevent unauthorised access or disclosure.
5. Sources of Personal Data
Personal data processed by Xcelore is generally obtained from the following sources:
- Data Provided by our Business Clients: Our Clients share personal data of their End Users /
Customers, which may then be used by our AI agent to deliver customer service. The
Personal Data that may be collected for the below-mentioned processing activities includes
contact information, account details, technical data or other information that may be
necessary to provide customer support services. - Data Collected from End Users: When Customers / End Users interact with our AI agent, we
may collect personal data that they provide during conversations and chats with the AI
Agent to resolve their queries and inquiries. We may also collect technical data, such as IP
addresses, and device information to facilitate our services to the End Users and our
Business clients.
6. Purposes of Personal Data Collection and Processing
We do not process personal data for purposes other than to provide such services to our Clients
and End Users, including but not limited to:
- Running the AI agent to answer End Users’ queries / provide customer service queries on
behalf of our Clients. - Enhancing personal interactions as per data provided by our Client or inputs by the End users
for catering to the specific requirement of customer service. - Improving the performance and functions of our AI agent, where permitted by the Clients.
- Protecting the security and integrity of the Services, including disrupting the
unauthorised access to our Services or any fraudulent activity. - Responding to legal obligations, including but not limited to lawful purposes or record
keeping, as much of the applicable laws provide.
We do not process personal data for our purposes unless explicitly authorised by our Clients or
End Users, nor do we sell personal data to third parties.
7. Cookies and Tracking Technologies
We may use cookies or similar technologies to facilitate the functions of our AI agent, which are
strictly necessary for service delivery. We do not track the Customers / End Users for marketing
purposes. We collect technical data to ensure security and enhance interactions. Our Clients are
responsible for informing their customers / End Users about such technologies in their respective
privacy policies. We provide details to our clients to support compliance with their policy.
8. Data Processing Activities
We only process data that is required to provide the services, such as:
- Safely storing personal data on servers to allow access by AI agents during interactions.
- Processing conversation inputs to produce relevant answers or carry out client directives.
- Sharing Personal Data with Clients or authorised service providers to complete service tasks.
- Technical data analysis to identify and prevent security risks.
- When allowed, transforming personal data into aggregated or anonymised forms for AI
training.
All processing is carried out in accordance with applicable data protection laws and at the
request of our Client or End User.
9. Data Sharing
We may share Personal Data in the following circumstances:
- With Clients: Personal Data collected from End Users / Customers is shared with the
relevant Client to provide customer service and fulfil contractual obligations. - With Sub-processors: We engage trusted service providers to support our Services. Such
service providers are contractually obligated to protect Personal Data and process it only for
purposes specified by us. - For Legal Purposes: If required by law, we may disclose Personal Data, in cases such as
compliance with court orders, responding to government requests, or protecting our rights,
property, or safety. - Business Transfers: In the event of a merger, acquisition, or asset sale, Personal Data may be
transferred to the acquiring entity, subject to appropriate safeguards.
We do not sell Personal Data to third parties.
10. International Data Transfers
We may process Personal Data on servers located outside the country where it was collected. We
comply with the applicable data protection laws for international transfers. Our respective
Clients, as Data Controllers, are responsible for ensuring that they comply with their obligations
for international transfers.
11. Data Security
We implement robust technical and organisational measures to protect Personal Data against
unauthorised access, loss, alteration, or disclosure, including:
- Encryption: Data is encrypted in transit and at rest.
- Access Controls: Access is restricted to authorised personnel only, with role-based
permissions. - Security Assessments: Regular audits and vulnerability scans to maintain system integrity.
- Contractual Safeguards: Agreements with third-party service providers to ensure
compliance with data protection.
In the event of a data breach, we will:
- Notify affected Business Clients as soon as reasonably practicable, as required by our DPAs,
to enable them to inform End Users or authorities. - Take immediate steps to mitigate the breach and prevent recurrence.
- Cooperate with Clients to comply with applicable breach notification laws.
- Despite these measures, no system is completely secure, and we cannot guarantee absolute
security.
12. Rights of End Users
End Users may have rights under data protection laws, including:
- Access: Request a copy of their Personal Data.
- Rectification: Correct inaccurate or incomplete data.
- Deletion: Request deletion of their data.
- Restriction: Limit processing in certain circumstances.
- Objection: Object to processing based on legitimate interests.
- Data Portability: Receive their data in a structured, commonly used format.
As a data processor, we do not directly handle End-user rights requests. End Users should
contact the relevant Client, who acts as the data controller, to exercise their rights. We assist
Clients in fulfilling these requests as required by our DPAs.
13. Data Retention
We retain Personal Data only as long as necessary to provide the Services to the End Users,
comply with the requirements of our Client and to meet legal obligations. When Personal Data is
no longer needed, we securely delete or anonymise it using industry-standard methods.
14. Children’s Privacy
We do not intentionally request or collect Personal Data from children under 18 years of age
through our AI agent chatbot services. Our Services are provided to business Clients, who act as
data controllers and are responsible for ensuring that any Personal Data they provide or that we
collect on their behalf, including from End Users under 18, is obtained with verifiable parental
consent as required by applicable laws. If we become aware that Personal Data from a child
under 18 has been collected without such consent, we will promptly take all reasonable steps to
delete that data from our systems and refrain from using it, except as necessary to ensure the
child’s safety or comply with legal obligations.
End Users under 18 years of age, or their parents/guardians, may request the deletion of their
Personal Data by contacting the relevant Client, who acts as the data controller. We will assist
Clients in processing such deletion requests as required by our Data Processing Agreements.
Please note that while we strive to fulfil these requests diligently, removing Personal Data may
not guarantee its complete elimination from all systems due to technical limitations.
For inquiries about our handling of children’s data, please contact us at the contact information
provided below.
Parents or guardians should first refer to the Client’s privacy policy for contact information to
address concerns or exercise data rights related to children’s Personal Data.
15. Transparency and Notifications
Our respective Business Clients are primarily responsible for informing their customers / End
Users as Data Controllers, about the collection and processing of their Personal Data by us,
through their privacy policies. We ensure transparency by:
- Maintaining this publicly accessible Data Privacy Policy, detailing the categories of Personal
Data collected, purposes of processing, and our role as a data processor. - Providing our Clients with details of the Personal Data categories processed to assist in their
transparency obligations.
16. Changes to This Policy
We may update this Data Privacy Policy to reflect changes in our practices or legal requirements.
Updates will be posted on our website with a revised effective date. Clients will be notified of
significant changes as required by our agreements. End Users should check their Client’s privacy
policy for updates on data processing.
17. Contact Information and Grievance Redressal
For questions about this Data Privacy Policy or our data processing practices, please contact:
- Email: support@exei.ai
- Address: 5th Floor, GM IT Park, Sector 142, Noida, Uttar Pradesh 201305, India.
- Phone Number: +91 81784 97981
End Users should refer to the Client’s privacy policy for contact information to exercise data
rights or raise concerns. We will assist Clients in addressing such inquiries as needed.
We will respond to grievances within a reasonable timeframe.