Privacy Policy

Introduction

At Exicube App Solutions (OPC) Private Limited, we are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy describes how we collect, use, disclose, and protect the information you provide to us when you interact with our website, mobile applications, and services.

Note for Exicube Clients (B2B): When providing our white-labelled platform services, our clients act as the "Data Controller" for their end-users' (riders, drivers, customers, etc.) data. Exicube acts as the "Data Processor," managing and processing this data on Exicube-managed cloud infrastructure solely on behalf of our clients to operate the platform. Our clients are solely responsible for obtaining appropriate consent from their end-users and complying with relevant local privacy laws. B2B clients should review our Data Processing Agreement (DPA) which governs data processing obligations.

Information We Collect

Personal Information

We may collect the following types of personal information from you when you voluntarily provide it to us:

• Contact information: such as your name, email address, phone number, and mailing address.
• Account information: if you create an account with us, we may collect your username and password.
• Payment information: when you subscribe or make a transaction, payment details are collected and processed securely by our third-party payment processors (e.g., Stripe, Square). Exicube does not directly store your full credit card or debit card numbers.
• Demographic information: we may collect demographic information, such as your age, gender, and location, to better understand our user base.

Usage Information

We automatically collect certain information about your use of our services, including:

• Device information: such as your IP address, device type, operating system, and browser type.
• Log data: we collect log data, including the pages you visit, the time and date of your visit, the time spent on each page, and other statistics.

Cookies and Website Analytics

The exicube.com website sets no cookies and stores no advertising or analytics identifier on your device.

We count visits with Umami, an analytics tool we host ourselves. It is loaded from exicube.com and reports to exicube.com, so no analytics company receives your visit. It sets no cookies and stores nothing on your device. It records the pages you view, the site that referred you, your browser, operating system, device type, screen size and language, and an approximate location worked out from your IP address. It does not store the IP address itself.

If you start a conversation in the website's chat window, the chat keeps a random visitor ID, the conversation's ID and an access token in your browser's local storage, so the conversation carries on as you move between pages and when you return. Nothing is stored before you start a chat. Clearing your browser's data for exicube.com removes them.

Some pages show videos hosted on YouTube. Until you press play, such a page shows only the video's thumbnail, an image your browser loads from YouTube's image server (i.ytimg.com), which receives your IP address with that request. The YouTube player loads, from youtube-nocookie.com, only when you press play, and from then on YouTube may set its own cookies and store data in your browser, under Google's Privacy Policy.

Location Data

Our platform services collect and process location data to provide core functionality:

• Driver GPS data: real-time GPS coordinates from drivers/delivery personnel using our driver mobile application, used for dispatch, live tracking, route navigation, and delivery verification.
• Customer location: pickup and delivery addresses provided during booking, and device location when using map-based features in our customer applications.
• Location history: historical location data for drivers is retained for trip verification, waiting time calculation, disputes, and operational analytics (heat maps, geo-fencing).

Location data is classified as sensitive personal data. It is collected only when necessary for service delivery and is retained according to our data retention schedule below.

AI & Automated Processing

Our platform may use artificial intelligence and machine learning technologies to improve service quality. This includes:

• Automated dispatch scoring: Our platform uses a daily performance score to rank and prioritise drivers for job offers. The score is calculated based on: job acceptance (+1), delivery completion (+2), five-star ratings (+1), job timeouts (−1), and job cancellations (−4). Scores reset daily at midnight. This score directly influences which drivers receive job offers first, and constitutes automated decision-making that may significantly affect drivers' income.
• Dynamic/surge pricing: Algorithmic pricing models may analyse demand signals (real-time demand, time of day, weather conditions, and geo-fenced zone rules) to adjust pricing. Customers are shown the surge multiplier and estimated fare before confirming any booking.
• Customer support agents: AI-powered chat agents may classify incoming support messages and answer routine questions directly, such as trip status, arrival time, and past trips. Anything concerning money or a cancellation, including refunds, is passed to human support. On our clients' platforms these agents answer in text.
• AI voice demo: On our demo taxi website, taxi.demo.exicube.com, you can book a demo ride and ask questions by talking to an AI assistant. The assistant says it is an AI when the call starts. Your voice goes to our own voice server in Frankfurt, Germany, which runs LiveKit, open-source calling software we host ourselves. Amazon Transcribe turns your voice into text and Amazon Polly turns the assistant's replies into speech, both in AWS's Frankfurt region (eu-central-1). We have set AWS's AI services opt-out policy on our account, so AWS does not store or use this audio or text to develop or improve its services. The assistant answers using a model on Amazon Bedrock in Stockholm, Sweden (eu-north-1). Calls are not recorded. The text of a demo call is kept on our servers for seven days and then deleted. Copies in our encrypted nightly backups are deleted as those backups are replaced. If you share your location and say "here" for the pickup or the drop-off, your location is used as that place. A demo booking is not a real ride; it stays in the demo's booking desk.
• Sentiment analysis: Customer reviews may be automatically analysed for sentiment and theme extraction to improve service quality.
• Business intelligence: Aggregated and anonymised operational data may be processed by AI models to generate analytics and insights for platform administrators.
• CRM and sales outreach (Exicube internal): AI models may generate personalised outreach messages for B2B sales leads using publicly available business information (company name, contact name, industry, location). This processing is conducted by Exicube for its own legitimate business interests under GDPR Article 6(1)(f) and includes an unsubscribe mechanism in all communications.

Third-party AI processors: AI inference may be performed by third-party providers as listed on our Sub-Processor List. For platform AI features (support, analytics, dispatch), PII such as names, phone numbers, and email addresses is automatically stripped from text before it is sent to third-party inference providers. Speech-to-text needs the voice as it is, so on AI voice calls the audio reaches Amazon Transcribe unchanged; the text it returns is stripped in the same way before the assistant's model answers it. For CRM outreach by Exicube, business contact information may be included in prompts where it is essential for personalisation; this data is processed under legitimate interest and all providers are contractually prohibited from using input data for model training.

Your rights regarding automated decisions: Under GDPR Article 22, you have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects. Specifically:

• Drivers: You may request a full explanation of your current dispatch score calculation and request human review of any scoring decision by contacting your platform operator's support or Exicube directly at [email protected].
• Customers: You may request human review of any surge pricing or automated service decision.
• B2B leads: You may opt out of AI-generated outreach at any time by replying "STOP" or using the unsubscribe link included in all communications.

Use of Information

We use the information we collect for the following purposes, with the corresponding legal basis:

• To provide and improve our services: we use your information to deliver our services, process your transactions, and enhance the user experience.
• To personalise your experience: we may use your information to customise our services and recommend content.
• To communicate with you: we may use your contact information to send you updates, newsletters, promotional materials, and respond to your inquiries.
• To conduct research and analysis: we may use the information to analyse usage patterns, evaluate the effectiveness of our marketing campaigns, and improve our services.
• To protect our rights and interests: we may use the information to detect and prevent fraud, enforce our terms of service, and protect our legal rights.

Disclosure of Information

We may disclose your information in the following circumstances:

• Service Providers & Sub-Processors: we may share your information with trusted third-party service providers who assist us in delivering our services, such as cloud hosting providers, payment processors (e.g., Stripe, Square), mapping services, AI inference providers, and SMS/email providers. These providers are bound by data processing agreements and are only authorised to use your information to perform services on our behalf. A complete list of our sub-processors is maintained on our Sub-Processor List page.
• Legal Requirements: we may disclose your information if required by law or in response to a valid legal request, such as a court order, subpoena, or government inquiry.
• Business Transfers: in the event of a merger, acquisition, or sale of our company assets, your information may be transferred to the acquiring entity or third party involved. We will notify you via email or prominent notice on our website of any such change in ownership or control.
• Consent: we may disclose your information to third parties with your consent or at your direction.

Data Security

We take reasonable measures to protect your personal information from unauthorised access, disclosure, alteration, or destruction. Our security measures include:

• Encryption in transit: all data transmitted between clients and servers is encrypted using TLS (SSL/TLS).
• Access controls and isolation: role-based access controls (RBAC), and deployment-level tenant isolation: each client's platform runs as its own isolated deployment with its own database.
• Payment security: payment processing is handled by PCI-compliant third-party providers. Exicube does not store raw payment card data.
• API security: targeted API rate limiting on security-sensitive endpoints, input validation, parameterised queries (SQL injection prevention), and secure session management.

However, please note that no method of transmission over the internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

Data Retention

We retain your personal information according to the following schedule, unless a longer retention period is required or permitted by law:

We will securely delete or anonymise your information when it is no longer needed. For B2B clients, data associated with a terminated tenant account is cascade-deleted within 30 days of account termination.

Your Rights and Choices

You have certain rights and choices regarding the personal information we collect about you. These include:

• Access and Update: you have the right to access and update your personal information. You can do this by logging into your account or contacting us directly.
• Right to Erasure (Deletion): you have the right to request deletion of your personal information. Upon receiving a verified deletion request, we will delete or anonymise your data within 30 days, except where retention is required by law (e.g., billing records). To request erasure, email [email protected] with the subject line "Data Deletion Request."
• Data Portability: you have the right to receive a copy of your personal data in a structured, commonly used format (CSV or JSON).
• Right to Object: you have the right to object to certain types of processing, including automated decision-making (see AI & Automated Processing section above).
• Opt-out: you have the option to opt-out of receiving promotional communications from us. You can unsubscribe by following the instructions provided in the communication or contacting us.
• Global Privacy Control (GPC): we honour Global Privacy Control signals. When we detect a GPC signal from your browser, we treat it as a valid opt-out request for the sale or sharing of personal information, as required by applicable laws such as the CCPA/CPRA.

Your Rights by Region

Depending on your location, you may have additional rights under local privacy laws:

European Economic Area & United Kingdom (GDPR)

If you are in the EEA or UK, you have rights under the General Data Protection Regulation (GDPR), including: access, rectification, erasure, restriction of processing, data portability, and the right to object. Our legal basis for processing is: (a) performance of a contract, (b) legitimate interest for B2B operations, or (c) your consent. You may lodge a complaint with your local supervisory authority.

EU/UK Representative: As Exicube is headquartered in India and offers services to individuals in the EEA and UK, we are in the process of appointing a formal EU/UK representative in accordance with GDPR Article 27. In the interim, all GDPR-related inquiries can be directed to our Data Protection contact at [email protected]. We will update this section once a formal representative has been appointed.

California, USA (CCPA/CPRA)

If you are a California resident, you have rights under the California Consumer Privacy Act, including: the right to know what personal information is collected, the right to delete, the right to opt-out of the sale of personal information, and the right to non-discrimination. We do not sell personal information as defined by the CCPA.

India (DPDP Act 2023)

If you are an Indian resident, you have rights under the Digital Personal Data Protection Act 2023, including: the right to access, correction, and erasure of your personal data, the right to grievance redressal, and the right to nominate a representative. The Director of Exicube App Solutions (OPC) Private Limited serves as the designated data protection point of contact and can be reached at [email protected].

Data Protection Officer

Given the current nature and scale of our processing activities, Exicube has determined that a formal Data Protection Officer (DPO) appointment is not required under GDPR Article 37. The Director of Exicube App Solutions (OPC) Private Limited serves as the designated point of contact for all data protection matters across all jurisdictions and can be reached at [email protected]. We will revisit this assessment as our operations grow and will appoint a formal DPO if required by applicable law.

Australia (Privacy Act 1988)

If you are an Australian resident, we handle your personal information in accordance with the Australian Privacy Principles (APPs). You have the right to access and correct your personal information, and to make a complaint about our handling of your data to the Office of the Australian Information Commissioner (OAIC).

International Data Transfers

Your data may be transferred to and processed in countries other than your own, including India (where Exicube is headquartered) and the locations of our sub-processors (see Sub-Processor List). We ensure appropriate safeguards are in place for such transfers, including Standard Contractual Clauses (SCCs) where required by GDPR, and compliance with applicable data protection regulations.

Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:

• Notify the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by GDPR Article 33.
• Notify affected individuals without undue delay if the breach is likely to result in a high risk to their rights and freedoms.
• For B2B clients (where Exicube acts as Data Processor), we will notify the client (Data Controller) within 48 hours of becoming aware of a breach affecting their end-users' data.

Breach notifications will include the nature of the breach, the categories and approximate number of individuals affected, likely consequences, and the measures taken or proposed to address the breach.

Children's Privacy

Our services are not directed to individuals under 18. We do not knowingly collect personal information from children. If you believe we have collected information from a minor, please contact us and we will take steps to delete it.

Changes to the Privacy Policy

We reserve the right to update or modify this Privacy Policy at any time. We will notify you of material changes via email at least 30 days before they take effect. The latest version will always be available on our website.

Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us at: [email protected]

Exicube App Solutions (OPC) Private Limited
3, Sreenagar, Madhyamgram
Kolkata, West Bengal – 700129
India

We appreciate your trust in us and assure you that we will handle your personal information with the utmost care and responsibility.