Privacy Policy
Effective: [Date the website goes live]
This policy explains how NSDBytes ("NSDBytes", "we") handles personal data for ZeroDelay and the website zerodelay.si. It is written to meet India's Digital Personal Data Protection Act, 2023 and its Rules, US state privacy laws (such as the California CCPA/CPRA), Canada's PIPEDA and Quebec's Law 25, and the EU and UK GDPR where they apply.
1. Two roles we play
- Data fiduciary / controller for people who visit our website, contact us, book a call, sign up, or pay us.
- Data processor for our clients when their staff, dealers, customers or suppliers ("End Users") use ZeroDelay. The client decides who is added and what they can see; we process that data only on the client's instructions under our Data Processing Addendum. If you are an End User, contact the business that added you first; we will help them respond.
2. What we collect and why
| Data | Where it comes from | Why | Basis |
|---|---|---|---|
| Name, company, work email, WhatsApp number, country, team size | Website form, call booking, emails | To reply, set up a demo or call, and prepare a quote | Your consent; steps before a contract |
| Software you selected and how you want to connect it | Website form | To tell you how each system connects and to plan setup | Your consent; steps before a contract |
| Account, billing and invoice details | Sign-up and checkout | To provide the service, invoice and meet tax law | Contract; legal obligation |
| Payment status | Our payment partner (Razorpay) | To activate and renew your plan. We never see or store full card details | Contract |
| End Users' name, role, phone number | The client | To identify who is asking and apply their access | Processor for the client |
| Messages, voice notes and the questions asked | End Users, via WhatsApp, Telegram or the web app | To answer questions, read back updates and create drafts | Processor for the client |
| Logs of who asked what and when | The service | Security, audit trail for the client, abuse prevention | Processor for the client; legitimate use |
| Technical data (IP address, browser, pages viewed) | Your browser | To run and secure the website | Legitimate use |
Credentials you give us to connect your systems (API keys, OAuth tokens) are encrypted with a key unique to your company, kept in a secrets vault apart from your other data, and used only to perform the queries you and your End Users ask for.
Business data in your connected systems (balances, stock, bookings and so on) is read on demand to answer a question and is not copied into our database, apart from references, the encrypted drafts described below, and a list of customer and item names (refreshed daily) used to recognise names in messages.
We do not sell personal data and do not use it for advertising.
3. AI processing
To understand a request, ZeroDelay sends the End User's message text (and a transcript of a voice note) to an AI model, which returns which approved question is being asked. The model does not receive the answers from your systems. Voice notes are transcribed by a speech-to-text provider.
The AI provider is chosen with each client for their project, from Claude (Anthropic), Gemini (Google), OpenAI, Groq, DeepSeek and Kimi (Moonshot AI), and is named in the client's order with the region where it processes data. Where the provider offers processing in the client's region we use it; otherwise the provider's own region is used, which may be outside the client's country. We use the providers' business API terms, and where a provider lets us choose, we turn off use of the data for training and keep its retention to the minimum it allows. A client can also run ZeroDelay with AI switched off, in which case messages are matched on our servers and no AI provider receives them. We never create voiceprints or identify people by their voice; voice notes are used only to produce a transcript.
4. How long we keep data
| Data | Kept for |
|---|---|
| Website enquiries and leads | 24 months from our last contact, then deleted |
| Message text in chats, including questions we could not answer | 30 days |
| Conversation context (the last question, so a follow-up makes sense) | 15 minutes |
| Voice notes | Deleted once transcribed and confirmed; at most 30 days |
| Staff updates (drafts) and their photos | Until approved or rejected, then 30 days. After that we keep only the update number, its status and the reference of the record created in your system |
| Photos that were never sent as an update | 1 day |
| Customer and item names used to recognise names | Replaced every day; deleted when the client leaves |
| Query log (who asked what, when) | 1 year, for the client's audit trail |
| Console activity log (what admins changed or viewed, without the values) | 1 year |
| Account and invoice records | For the contract, then as long as Indian tax law requires |
When a client closes their account, we delete their End User data within 30 days, except what the law requires us to keep.
Messages sent on WhatsApp or Telegram are also held by those platforms, under the client's own business account and the platform's own terms; the periods above apply to the copies ZeroDelay keeps. A custom chat app built for a client is a separate service with its own terms.
5. Who we share data with
Only with the service providers we need to run ZeroDelay (hosting, messaging, payments, AI and speech-to-text, email, error monitoring), listed on our Sub-processors page, under contracts that protect the data; and with authorities where the law requires it.
6. Where data is stored
By default, ZeroDelay is hosted by NSDBytes on cloud servers in India. On request, and at the client's cost, we deploy a dedicated ZeroDelay in the client's own cloud account in the client's chosen country; after go-live we do not monitor or access that account unless the client gives us access to investigate an issue. AI processing follows section 3. Our own website, sales and billing systems are hosted in India. Some providers (for example messaging or AI) may process data in other countries; we use providers with appropriate safeguards and follow any transfer restrictions notified under Indian law. For EU or UK data, we use standard contractual clauses where required.
7. Security
Data is encrypted in transit and at rest, each client has its own encryption key, access is role-based and logged, and credentials are kept in a secrets vault. See our Security page. If a breach affects your personal data, we will notify you and the authorities as the law requires.
8. Your rights
You can ask us to:
- tell you what personal data we hold about you and how we use it;
- correct, complete or update it;
- erase it, where we are not required to keep it;
- withdraw consent you gave (this does not affect earlier processing);
- nominate someone to exercise your rights if you die or become unable to;
- for EU/UK residents: restrict or object to processing, and receive your data in a portable format.
Write to [email protected]. We may need to verify your identity. We will respond within 30 days (and in any case within the time your local law requires).
9. Residents of the United States
We do not sell or share personal information for cross-context behavioural advertising, and we do not use sensitive personal information to infer characteristics. Depending on your state, you may have the right to know, access, correct, delete and port your personal information, and to opt out of sale, sharing, targeted advertising and certain profiling; we honour these requests without discrimination. Where we process data for a client, we act as their service provider or processor and help them answer your request. Authorised agents may submit requests with proof of authority. If we decline a request, you may appeal by replying to our response.
10. Residents of Canada
We are accountable for personal information under our control, including when it is processed by our service providers. Canadian clients can have ZeroDelay deployed in Canada in their own cloud account; otherwise it is hosted in India. Our own website, sales and billing data are held in India; where we transfer your information outside Canada (or outside Quebec), we protect it by contract and assess the transfer first. You may access and correct your information and withdraw consent, and in Quebec also request portability and be told when a decision about you is made by automated processing (we do not make such decisions). Our person in charge of the protection of personal information is our Grievance Officer below. You may complain to the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d'accès à l'information.
11. Grievances
Our Grievance Officer is the Grievance Officer, NSDBytes, reachable at [email protected] or at B903, Times Square 2, opp. Eris Lifesciences Ltd, Bodakdev, Ahmedabad, Gujarat 380059, India. If you are not satisfied with our response, you may complain to the Data Protection Board of India, or, in the EU/UK, to your local data protection authority.
12. Children
ZeroDelay is a business service and is not meant for anyone under 18. We do not knowingly collect children's data.
13. Cookies
See our Cookie Policy.
14. Changes
We will post updates here and change the effective date. For material changes affecting clients, we will email account owners in advance.