Privacy Policy
Effective Date: 22 April 2026
Last Reviewed: 22 April 2026
Jurisdiction: European Union (GDPR) | United Kingdom (UK GDPR) | India (DPDP Act 2023) | California, USA (CCPA)
Payment Processors: AIQorex uses multiple payment processors depending on the product or service purchased:
- Dodo Payments (dodopayments.com) — primary Merchant of Record for Marketplace products and Maintenance SaaS subscriptions
- Stripe (stripe.com) — alternative payment processor for Marketplace products and Maintenance SaaS
- Payoneer (payoneer.com) — available for AI Consulting engagements (cross-border B2B payments)
AIQorex selects the appropriate payment processor based on the product type, customer location, and payment method required.
Jurisdiction Notice
This Privacy Policy is drafted for compliance with:
- European Union: Regulation (EU) 2016/679 (GDPR) as implemented by national data protection laws
- United Kingdom: UK GDPR and the Data Protection Act 2018
- India: Digital Personal Data Protection Act, 2023 (DPDP Act)
- California, USA: California Consumer Privacy Act of 2018 (CCPA), as amended by the California Privacy Rights Act (CPRA)
If you are a resident of another jurisdiction, this policy provides a baseline of protections. Additional rights may apply under your local law.
TL;DR
- AIQorex collects only what is necessary to deliver its services.
- We do not sell your personal data. Third-party sharing is limited to Dodo Payments (Merchant of Record for Marketplace/SaaS — payments only), Stripe (Marketplace/SaaS), Payoneer (Consulting), Supabase (database), Cloudflare (Public URL feature for AIQorex Business OS), and OpenClaw (AI processing).
- You have the right to access, correct, delete, port, and restrict processing of your personal data under GDPR, UK GDPR, and applicable local law.
- California residents have additional rights under CCPA/CPRA, including the right to opt out of the sale of personal information.
- India residents have rights under the DPDP Act, 2023 including the right to access information and correct inaccuracies.
- AIQorex Business OS processes your conversations and files locally on your device. License activation runs fully locally — no license metadata is transmitted to AIQorex or any third party. If you enable the optional Public URL feature, inbound traffic is routed via Cloudflare's edge. Conversation content and uploaded files never leave your Mac except to the LLM providers OpenClaw routes to with your consent.
1. Who We Are
AIQorex (a sole proprietorship operated by Shivam Dixit) Website: aiqorex.com Email: [email protected] Business Address: Fatehpur, Uttar Pradesh, India
Payment Processors: AIQorex uses Dodo Payments (dodopayments.com), Stripe (stripe.com), and Payoneer (payoneer.com) depending on the product and customer location. Dodo Payments acts as Merchant of Record for transactions it processes; Stripe and Payoneer act as payment processors.
AIQorex is an AI marketplace and AI agents consulting firm. We operate three business lines:
- Marketplace: Pre-built AI workflows, agents, and automation products sold as one-time purchases
- Maintenance SaaS: Recurring subscription plans for ongoing support and updates
- AI Consulting: Custom AI agent development and strategy engagements
For the purposes of data protection law, AIQorex acts as the Data Controller for personal data collected through our website, marketplace, and services, unless otherwise notified.
2. What Data We Collect
2.1 Data You Provide Directly
| Data Category | Examples | Purpose |
|---|---|---|
| Account & Registration | Name, email address, company name | Service delivery, account management |
| Payment Information | Tokenised payment method details from Dodo Payments, Stripe, or Payoneer depending on processor used; AIQorex does not store raw payment card data | Processing one-time purchases, subscriptions, and consulting fees |
| Consultation Data | Project briefs, business context, goals | Delivering AI consulting engagements |
| Communications | Emails, chat messages, support requests | Customer support, service improvement |
| Browser-Based Uploads | Files submitted for AI processing (e.g., Knowledge Base) | Delivering Business OS functionality |
2.2 Data Collected Automatically
| Data Category | Examples | Purpose |
|---|---|---|
| Technical Data | IP address, browser type and version, OS | Security, analytics, service improvement |
| Usage Data | Pages visited, features accessed, time on site | Product improvement, analytics |
| Cookie Data | As detailed in Section 7 and our Cookie Policy | Consent management, analytics |
| Error Logs | Device type, error type, timestamp | Debugging and reliability |
2.3 Data from AIQorex Business OS (Local Application)
AIQorex Business OS is a local-first application installed on your MacBook. It processes your conversations, files, and generated artifacts locally on your device and communicates with OpenClaw (a local AI gateway on your machine) for LLM inference. AIQorex does not receive, store, or process the content of your conversations or files, except:
- When you voluntarily submit data to our server (e.g., for support)
- When anonymised telemetry is enabled with your consent
License activation runs fully locally on your Mac — no license metadata leaves your device. The install does, however, transmit the following limited operational data when the corresponding optional feature is enabled:
| Flow | Data | Frequency | Purpose |
|---|---|---|---|
| Public URL traffic (optional) | Encrypted HTTPS request/response between your Mac and clients you share the subdomain with | Continuous while enabled | Provide mobile/remote access via Cloudflare Tunnel |
Public URL traffic transits Cloudflare's edge (see §5.6). All other request bodies — license keys, agent conversations, knowledge documents, generated artifacts — remain local to your Mac.
3. Purpose and Legal Basis for Processing
3.1 GDPR / UK GDPR Legal Bases
AIQorex processes personal data under the following legal bases:
| Legal Basis (GDPR Art. 6) | Purpose |
|---|---|
| 6(1)(b) — Contract | Processing necessary to perform the contract for Marketplace purchases, Maintenance SaaS, and AI Consulting engagements |
| 6(1)(c) — Legal Obligation | Processing required for tax, accounting, and financial regulatory compliance |
| 6(1)(f) — Legitimate Interests | Fraud prevention, security monitoring, direct marketing (with opt-out), analytics; overridden only where your interests prevail |
| 6(1)(a) — Consent | Cookie tracking, marketing emails, optional telemetry; freely given, specific, and withdrawable at any time |
| 6(1)(d) — Vital Interests | Emergency data disclosure where necessary to protect life |
3.2 Purpose Limitation
We collect and process personal data only for the following purposes:
- Delivering purchased products and services
- Managing your account and subscription
- Processing payments and issuing invoices
- Providing customer support
- Communicating service updates and product information (you may opt out)
- Preventing fraud and ensuring platform security
- Complying with legal obligations
- Improving our products and services (aggregated, non-personally identifying data)
4. Data Retention
AIQorex retains personal data only for as long as necessary to fulfil the purposes outlined in this policy.
| Data Type | Retention Period |
|---|---|
| Account and registration data | Duration of account + 2 years after closure |
| Transaction and invoice records | 8 years (tax and accounting obligation under India's Income Tax Act, 1961 and the Companies Act, 2013) |
| Payment transaction records | Varies by processor: Dodo Payments controls retention for MoR transactions; Stripe and Payoneer control retention for their respective transactions. AIQorex retains transaction metadata (order ID, amount, product, date) for 7 years for accounting purposes regardless of processor used. |
| Support communications | 3 years from resolution |
| AI Consulting project data | Duration of engagement + 1 year; deleted upon request |
| Analytics and telemetry (aggregated) | 26 months |
| Cookie data | Per Cookie Policy — see Section 7 |
Upon account closure or data subject request, AIQorex will delete or anonymise personal data within 30 days, except where retention is required by law. Payment transaction records are retained by Dodo Payments as the Merchant of Record; for information on Dodo's payment data retention, refer to Dodo Payments' Privacy Policy.
5. Third-Party Data Sharing
AIQorex shares personal data only with trusted service providers under strict data processing agreements. We do not sell personal data.
5.1 Dodo Payments
Purpose: Payment processing for AIQorex Marketplace products and Maintenance SaaS subscriptions; acts as Merchant of Record for these transactions
Data Shared: Email address, name, billing address, transaction amount, product purchased, order details
Legal Basis: Contract (Art. 6(1)(b))
Privacy Notice: Dodo Payments Privacy Policy
Data Location: Dodo Payments is a Bangalore, India-based company with global infrastructure. Customer payment data is stored in Dodo Payments' PCI DSS Level 1 certified infrastructure.
Important — Merchant of Record: When Dodo Payments is the selected processor, Dodo is the Merchant of Record (MoR) — the legal seller of record for the transaction. Dodo assumes responsibility for VAT, GST, and indirect tax collection and remittance in applicable countries. AIQorex receives the net amount after Dodo's transaction fee (4% + 40c per transaction). Because Dodo is the MoR, Dodo — not AIQorex — is the data controller for the payment transaction data. Please review Dodo Payments' Privacy Policy for full details.
Note on AIQorex Business OS licensing: License activation for the installed Business OS app runs fully locally on the customer's Mac. Dodo Payments does not receive any license-state data from the install. License keys are issued out-of-band by AIQorex after purchase and stored only in the customer's local install configuration.
5.2 Stripe
Purpose: Payment processing for AIQorex Marketplace products and Maintenance SaaS subscriptions (alternative processor)
Data Shared: Email address, name, billing address, transaction amount, product purchased, order details
Legal Basis: Contract (Art. 6(1)(b))
Privacy Notice: Stripe Privacy Policy
Data Location: Stripe's US/EU infrastructure with EU-US Data Privacy Framework (DPF) adequacy protection.
Note: When Stripe is the selected processor for a transaction, AIQorex — not Stripe — is the merchant of record. AIQorex bears responsibility for applicable tax compliance. Please review Stripe's Privacy Policy for how Stripe handles your payment data.
5.3 Payoneer
Purpose: Cross-border payment processing for AI Consulting engagements
Data Shared: Email address, name, billing address, company name, engagement details, invoice amount
Legal Basis: Contract (Art. 6(1)(b))
Privacy Notice: Payoneer Privacy Policy
Data Location: Payoneer Global Inc., New York, USA. Payoneer is publicly listed on Nasdaq (PAYO) and regulated in multiple jurisdictions including Singapore (Major Payment Institution licence).
Important: Payoneer is a cross-border payment and funds transfer service, not a Merchant of Record. When Payoneer is used for an AI Consulting engagement, AIQorex remains the seller of record and responsible for applicable tax obligations. Payoneer processes the international funds transfer and currency conversion. EU-US data transfers with Payoneer are covered by Standard Contractual Clauses where applicable.
5.4 Supabase
Purpose: Database infrastructure for customer accounts, order records, and service data
Data Shared: Account data, email address, order history, consultation briefs
Legal Basis: Contract (Art. 6(1)(b)) and Legitimate Interests (Art. 6(1)(f)) for security
Privacy Notice: Supabase Privacy Policy
Data Location: EU/US depending on project configuration
5.5 OpenClaw
Purpose: Local AI gateway providing LLM inference for AIQorex Business OS
Data Shared: AIQorex Business OS communicates with OpenClaw running locally on your device. AIQorex does not transmit your conversation data to OpenClaw's servers. OpenClaw processes queries locally on your machine.
Note: OpenClaw may send anonymised usage telemetry to its own servers. Please refer to OpenClaw's privacy policy for details. This is outside AIQorex's control.
5.6 Cloudflare (AIQorex Business OS — Public URL feature)
Purpose: AIQorex Business OS includes an optional Public URL feature that exposes the customer's local install at a unique subdomain on a domain owned by AIQorex (for example customer-acme.aiqorex.app), so the customer can access their AI workforce from a phone or away from their desk. AIQorex provisions the subdomain through a Cloudflare Tunnel; inbound HTTPS traffic is terminated at Cloudflare's edge and forwarded over an outbound-only tunnel to the customer's Mac.
Data Shared: While the feature is enabled, all HTTPS request and response traffic between the user (and anyone the customer shares their subdomain with) and the local install transits Cloudflare's edge network. TLS is terminated at the edge; payloads are not stored. Cloudflare may log connection metadata (timestamps, IPs, request paths) per its standard service.
Legal Basis: Contract (Art. 6(1)(b)) — the Public URL feature is part of the AIQorex Business OS service offering when activated by the customer.
Privacy Notice: Cloudflare Privacy Policy
Data Location: Cloudflare's global edge network. Cloudflare, Inc. is headquartered in San Francisco, USA, and participates in the EU-US Data Privacy Framework.
Disabling: The customer can request the Public URL be torn down at any time by contacting support. Once Cloudflare's DNS record is removed, the install remains fully functional on localhost but is no longer reachable from the public internet.
5.7 Analytics and Marketing Tools
AIQorex uses first-party cookies and, with consent, third-party analytics tools. See Section 7 (Cookie Policy) for full details.
5.8 Legal Disclosures
AIQorex will disclose personal data if required by law, court order, or regulatory authority, or where disclosure is necessary to protect the rights, safety, or property of AIQorex, its users, or the public.
6. International Data Transfers
AIQorex is based in India. Because we offer services to data subjects in the EU and the UK, we comply with the GDPR and UK GDPR on the basis of their extra-territorial scope (Article 3(2) GDPR; section 3 UK GDPR), even though we have no establishment in the EU or UK. We have not appointed an EU or UK representative under Article 27 at this time; EU and UK data subjects may contact [email protected] directly and may also lodge complaints with their national supervisory authority (see Section 13 below).
Personal data may be transferred outside the European Economic Area (EEA) or UK in the following circumstances:
| Transfer Scenario | Safeguard | Adequacy |
|---|---|---|
| Dodo Payments (India HQ, Merchant of Record) | MoR model — Dodo is legal seller of record for payment transactions only; payment data processed in India and globally | India: no EU/UK adequacy; transfers covered by SCCs where applicable |
| Stripe (US HQ) | EU-US Data Privacy Framework (DPF) | EU-US DPF (adequacy decision in force) |
| Payoneer (US HQ, Nasdaq listed) | Standard Contractual Clauses + supplementary measures | EU-US DPF applies (Payoneer participates in DPF); UK: IDTAs |
| Supabase (EU project) | EU-based processing | No transfer |
| Supabase (US project) | SCCs + supplementary measures | EU-US DPF |
| Cloudflare (US HQ — Public URL feature only) | EU-US Data Privacy Framework (DPF); TLS terminated at edge, payloads not stored | EU-US DPF (Cloudflare participates) |
| UK-specific transfers | UK International Data Transfer Agreements (IDTAs) | UK adequacy regulations for EEA |
India Data Transfers (Dodo Payments): Dodo Payments is headquartered in Bangalore, India. Payments processed through Dodo involve data transfers to India. These transfers are governed by Dodo Payments' Data Processing Agreement and Standard Contractual Clauses where applicable. India is working toward an EU adequacy decision; in the interim, SCCs provide the legal transfer mechanism.
US Data Transfers (Stripe, Payoneer): Stripe and Payoneer are headquartered in the United States. EU-US data transfers to these processors are covered by the EU-US Data Privacy Framework (DPF) where the processor participates. For UK transfers, UK IDTAs apply.
Where data is transferred to third countries without an adequacy decision, AIQorex relies on Standard Contractual Clauses and conducts Transfer Impact Assessments (TIAs) as required.
7. Cookies
AIQorex uses cookies and similar tracking technologies. Full details, including the complete list of cookies and opt-out mechanisms, are provided in our Cookie Policy.
Summary:
- Essential cookies (required for platform function) are always active and do not require consent.
- Analytics and marketing cookies are activated only with your explicit consent via our cookie consent banner.
- You may withdraw consent or change your preferences at any time via our Cookie Settings page.
8. Data Subject Rights
8.1 GDPR / UK GDPR Rights
Under GDPR (EU) and UK GDPR, you have the following rights:
| Right | Description |
|---|---|
| Access (Art. 15) | Request a copy of your personal data held by AIQorex |
| Rectification (Art. 16) | Correct inaccurate or incomplete personal data |
| Erasure (Art. 17) | Request deletion of your personal data ("right to be forgotten"), subject to legal retention obligations |
| Restriction (Art. 18) | Request restriction of processing in certain circumstances |
| Portability (Art. 20) | Receive your data in a structured, machine-readable format; transmit it to another controller |
| Objection (Art. 21) | Object to processing based on legitimate interests or for direct marketing |
| Withdraw Consent | Where processing is based on consent, withdraw at any time without affecting lawfulness of prior processing |
| Lodge Complaint | File a complaint with your national data protection authority (e.g. the Data Protection Board of India, your EU Member State DPA, or the ICO in the UK — see Section 13) |
8.2 California Rights (CCPA / CPRA)
California residents have additional rights:
- Right to Know: Request disclosure of categories and specific pieces of personal information collected, used, disclosed, or sold in the past 12 months
- Right to Delete: Request deletion of personal information, subject to certain exceptions
- Right to Correct: Request correction of inaccurate personal information
- Right to Opt Out: Opt out of the sale or sharing of personal information (AIQorex does not sell personal data)
- Right to Limit Use: Limit use of sensitive personal information to that which is necessary to perform the service
- Non-Discrimination: Equal service and pricing regardless of rights exercised
To exercise California rights, contact us at [email protected] with "California Privacy Rights" in the subject line.
8.3 India Rights (DPDP Act 2023)
India residents have the following rights under the DPDP Act:
- Right to Access Information: Obtain a summary of personal data being processed
- Right to Correction and Erasure: Correct inaccuracies and request deletion (subject to legitimate interests of the data fiduciary)
- Right to Grievance Redressal: Raise grievances and receive acknowledgement within a reasonable timeframe
- Right to Nominate: Nominate a nominee to exercise rights in the event of death or incapacity
To exercise India DPDP rights, contact: [email protected]
8.4 Exercise Your Rights
To exercise any data subject rights, contact us at:
Email: [email protected]
Subject Line: Include the specific right you are exercising (e.g., "Subject Access Request", "Right to Erasure")
We will respond to all verified requests within 30 days. For complex requests, we may extend by up to an additional 60 days with notice.
9. Data Security
AIQorex implements appropriate technical and organisational security measures to protect personal data against unauthorised access, loss, misuse, or destruction. These measures include:
- Encryption of data in transit (TLS 1.2+)
- Role-based access controls and least-privilege principles
- Regular security reviews and vulnerability assessments
- Secure configuration of Supabase and payment processor integrations (Dodo Payments, Stripe, Payoneer)
- Local data processing (AIQorex Business OS) to minimise server-side exposure
No security measure is 100% effective. AIQorex cannot guarantee absolute data security but commits to industry-standard protections and prompt incident response.
10. Data Breach Notification
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, AIQorex will:
- Notify the relevant supervisory authority within 72 hours of becoming aware
- Notify affected data subjects without undue delay when the risk is high
- Document the breach, its effects, and remedial actions taken
11. Children's Data
AIQorex does not knowingly collect personal data from children under 16 years of age (EU/UK GDPR threshold) or under 13 years (CCPA). If you believe a child's data has been collected without parental consent, contact us immediately at [email protected].
12. Changes to This Policy
AIQorex may update this Privacy Policy from time to time to reflect changes in our services, legal obligations, or regulatory requirements. Material changes will be communicated via:
- Email notification to registered users
- Notice on our website with updated effective date
- Re-request of consent where required
The current effective version is always available at aiqorex.com/policy.
13. Contact Information
Data Controller: AIQorex (Shivam Dixit, Founder)
Email: [email protected]
Website: aiqorex.com
For data protection authority contact details:
- India (primary supervisory authority): Data Protection Board of India (upon establishment under the DPDP Act, 2023) — currently the Ministry of Electronics and Information Technology (MeitY) — www.meity.gov.in
- European Union: Each EU data subject may file a complaint with the supervisory authority of their EU Member State of residence. A directory is available at edpb.europa.eu/about-edpb/about-edpb/members_en
- United Kingdom: Information Commissioner's Office (ICO) — www.ico.org.uk
- California, USA: California Privacy Protection Agency (CPPA) — cppa.ca.gov