Privacy Policy

1. Who we are, and what this policy covers

Axgen is operated by AXGEN AI PVT LTD ("Axgen", "we", "our", "us"), a company incorporated in India.

This policy covers both the axgen.co website and the Axgen service: an AI sales agent that answers, qualifies and follows up with the enquiries a business receives on WhatsApp, and keeps a record of every conversation.

It replaces earlier versions of this policy, which described a different Axgen product for planning and running advertising campaigns. That product is no longer what Axgen builds, and the processors named in those versions are not the ones this service uses.

2. This policy is about two different groups of people

Axgen is unusual in a way that matters for your privacy, so it is worth being plain about it before anything else.

Businesses that use Axgen. A business signs up, connects the WhatsApp Business Account it already uses, and tells Axgen how it sells. We hold that business's account details and settings for our own purposes as well as theirs, and the rest of this policy applies to them directly.

People who message a business that uses Axgen. If you sent a WhatsApp message to a shop, a clinic, a builder or an agency, and that business uses Axgen, your message reached our systems so that it could be answered. You never signed up with us and you may never have heard of us.

For that second group, the business you messaged decides what is collected and why. Under India's Digital Personal Data Protection Act, 2023, that business is the Data Fiduciary and Axgen is a Data Processor acting on its instructions. We do not decide what happens to your messages, we do not use them for our own purposes, and we do not sell them.

If you want to know what is held about you, or want it deleted, the fastest route is to ask the business you messaged. You can also email us at hello@axgen.co and we will identify the business and pass your request to them, and act on it ourselves once they instruct us.

3. What we collect

3.1 When you use the axgen.co website

• What you type into the waitlist form: your name, your WhatsApp number, your business type and your team size.
• Collected automatically by your browser: your IP address, the approximate country it resolves to, your browser and device type, your operating system, the page that referred you, the pages you viewed, and cookie or similar identifiers.

The approximate country is used for one thing: choosing which currency symbol to show in the calculator. We do not store a precise location.

3.2 When a business signs up for the service

• Account and contact details for the people who use it, and the business's own name and details.
• The identifiers and access tokens issued when the business connects its WhatsApp Business Account through Meta's Embedded Signup — the WhatsApp Business Account ID, the phone number ID, the display name, and the access token that lets us send and receive on that number.
• How the business has configured the service: the prices it has approved us to quote, what makes an enquiry worth its team's time, message templates, and who conversations should be handed to.

3.3 When someone messages a business that uses Axgen

• The WhatsApp profile name and phone number the message came from.
• The content of the messages — text, and any images, documents, audio or other files sent in the conversation.
• Timestamps, and delivery and read status.
• Where the conversation started by tapping an advertisement, which advertisement and campaign it came from.

3.4 Conversation history, where a business enables it

WhatsApp lets a business keep using its own WhatsApp Business app on the same number that Axgen answers. Where a business turns this on, WhatsApp sends us, at the moment the number is connected:

• Up to 180 days of the conversations that already existed on that number, including messages sent and received before Axgen was involved.
• The contacts saved on that number.
• Copies of messages the business's own staff send from their own phones, on an ongoing basis, so that Axgen knows a person has taken over and stops replying.

This means we may hold messages you sent to a business before that business started using Axgen. The business chose to import that history and remains responsible for it. You can ask for it to be removed — see section 9.

3.5 What we do not collect

• We do not read conversations on any WhatsApp number that a business has not explicitly connected to Axgen.
• We do not collect WhatsApp group conversations.
• We do not ask for or store card or bank details on the website.

4. Why we use it

Each purpose, and the information it uses:

• To contact you about early access — the name and number you gave the waitlist form. We use these details for that and nothing else: we do not add you to a marketing list, and we do not share them with anyone else.
• To operate the service — receiving enquiries, replying to them, working out what the enquirer needs, following up when there is no reply, and handing the conversation to a person when it is asked for or when the business's rules say so.
• To keep a record — so the business can see who said what and when, rather than relying on anyone's memory.
• To write leads into the business's own systems — where a business has connected a CRM, the lead details and the conversation are written there.
• To measure advertising — see section 6.
• To keep the service working and secure — diagnosing faults, preventing abuse, spam and fraud, and meeting our legal obligations.

We do not sell personal data, and we never have. We do not use the messages a business or its customers send to train general-purpose AI models, and we do not make them available to anyone else for that purpose.

5. Replies are drafted automatically

The replies Axgen sends are generated automatically from the configuration the business gave us — its prices, its services, and what it has told us about how it sells. They are not written by a person each time.

To generate a reply, the content of the conversation is sent to a language-model provider, which produces the draft on our behalf and returns it to us. We use Groq by default, and OpenAI or Anthropic for some requests or as alternatives; which one handles a given account is a configuration setting, and the current provider for your account is available on request. Every provider we use is engaged under its API terms, which do not permit content submitted through the API to be used to train that provider's models. If a provider cannot commit to that, we do not send conversation content to it. They are listed in section 7.

Ask to speak to a person at any point and the automated replies stop and a member of the business's team takes over. Axgen does not present itself as a named member of staff, and it does not quote a price the business has not approved.

6. WhatsApp, Meta and advertising measurement

Axgen is built on the WhatsApp Business Platform (Cloud API), which is provided by Meta Platforms, Inc. Messages between a business and its customers travel through WhatsApp, and Meta processes them under its own terms and privacy policy, not ours.

We act on a business's WhatsApp Business Account only after that business has connected it to Axgen through Meta's Embedded Signup flow, and only on that account. We do not have, and do not seek, access to any other business's WhatsApp data.

Where a business advertises — on Meta, or through Google Ads — we may tell that advertising platform what became of the leads its advertisements produced: that an enquiry arrived, that it was qualified, or that it converted. This is how the business learns which advertisements actually worked. We send this through Meta's Conversions API and Google's enhanced conversions for leads.

These events describe the outcome of a conversation, never its content. They do carry identifiers so the platform can match the event to the right click: the enquirer's email address and phone number, each hashed with SHA-256 before it leaves our systems, and on a conversion the deal value the business recorded. A hash cannot be read back into a phone number by us or by anyone receiving it, but it is still information about a person, and we would rather say so than let "no content" imply "nothing about you".

Our use of data obtained through Meta's platforms is governed by Meta's Platform Terms and Developer Data Use Policy, and nothing in this policy is intended to conflict with them.

7. Who else handles this data

We use a small number of service providers, each under contract, each only for the purpose named:

• Meta Platforms — the WhatsApp Business Platform itself, which carries every message, and advertising measurement as described in section 6.
• Our language-model provider — generating the replies Axgen sends, as described in section 5. Currently Groq, with OpenAI and Anthropic used for some requests. The content of a conversation is sent to produce each draft; none of them may use it to train their models.
• Google — where a business advertises with Google Ads, the hashed identifiers described in section 6, so it can measure which advertisements produced customers. Nothing else is sent to Google.
• Supabase — the database in which account information, configuration and conversation records are stored.
• Vercel — hosting for both the axgen.co website and the Axgen application itself, which means our servers run there and conversation data is processed there. Our deployment region is India (Mumbai).
• Resend — sending the emails we send you: team invitations, and alerts about a lead that needs attention. A lead alert can include the enquirer's name and what they asked for.

We keep this list current. If you need the complete list of our processors in writing — for a contract, a security review or a data-protection assessment — email hello@axgen.co and we will send it.

We do not sell, rent or trade personal data. We disclose it outside this list only where the law requires it, or in response to a valid and lawful request from a public authority.

If Axgen is ever merged with or acquired by another company, or its assets sold, personal data may transfer as part of that. We will say so before it happens, and give you the chance to delete your data first.

8. Where it is kept, and how it is protected

Axgen is operated from India. Data is stored with the providers named in section 7, which may process it in other countries where data-protection law differs from your own. By using the service you consent to that transfer.

• All traffic to and from our services uses HTTPS/TLS.
• Access tokens for connected WhatsApp Business Accounts are encrypted at rest, held server-side, and never exposed to code running in a browser.
• Access to conversation data is restricted to the services that need it and to the small number of staff who need it to run and support the product.

No system is perfectly secure, and anyone who tells you otherwise is selling something. We use reasonable technical and organisational measures, and we will tell you and the relevant authority if a breach affects you.

9. How long we keep it, and how to have it deleted

Waitlist details are kept until we open access to you, or until you ask us to remove them — whichever comes first.

Conversations and lead records are kept for as long as the business's account is open, because that record is the thing the business is paying for. When a business closes its account we delete its data, and the conversations belonging to its customers, within 30 days.

We keep some records longer where the law requires it — tax and billing records for up to seven years.

You can ask us to delete your data at any time. The full instructions, including the route through Facebook's own settings, are on our data deletion page. In short:

• If you signed up for Axgen or the waitlist — email hello@axgen.co with the subject "Data Deletion Request".
• If you connected Axgen through Facebook — removing Axgen under Settings & Privacy → Settings → Apps and Websites withdraws your permissions at once. It does not delete what we hold, so email us as well.
• If you messaged a business that uses Axgen — ask that business, or email us and we will pass the request on and act on it.

We respond to verified requests within 30 days, and sooner where the law requires it.

10. Your rights under the DPDP Act

Under India's Digital Personal Data Protection Act, 2023, you have the right to:

• Ask what personal data we hold about you and how it is being used.
• Have inaccurate or incomplete data corrected, completed or updated.
• Have your data erased, where we are not required to keep it.
• Withdraw consent you previously gave, at any time. Withdrawing is as easy as giving it was; it does not undo processing that already happened lawfully.
• Nominate someone to exercise these rights on your behalf if you die or become incapable of exercising them.
• Have a grievance heard, and escalate it.

Where Axgen is acting as a Data Processor for a business — that is, for the messages that business's customers send — the business is the Data Fiduciary and these rights are exercised against it. Write to us anyway if that is easier; we will route the request and act on it.

To exercise any of these rights, email hello@axgen.co.

Grievance redressal: if you are not satisfied with how we have handled a request, write to our Grievance Officer at hello@axgen.co with "Grievance" in the subject line. We will acknowledge within 7 days and respond substantively within 30. If you remain dissatisfied, you may complain to the Data Protection Board of India.

11. Children

Axgen is a tool sold to businesses and is not directed at children. Under the DPDP Act a child is anyone under 18.

We do not knowingly collect a child's personal data, and we do not use it for advertising or tracking. We cannot always tell the age of someone who sends a WhatsApp message to a business. If you believe a child's data has reached us, email hello@axgen.co and we will delete it.

12. Cookies

The website uses cookies and similar technologies. One remembers which currency symbol to show you. Others, where analytics are enabled, help us understand which pages people read and whether the waitlist form works.

Your browser can refuse cookies or warn you when one is set. The website works without them; the currency symbol falls back to a default.

13. Changes to this policy

We may update this policy. When we do, we change the date at the top of the page. If a change materially affects what we do with your data, we will tell you rather than relying on you to notice.

14. Contact

AXGEN AI PVT LTD, India.

Privacy, data requests and grievances: hello@axgen.co

See also our terms of service and our data deletion page.