This Privacy Policy describes how ESAA.AI ("Exceptionally Smart AI Agents"), operated by GENXSYS Technologies Private Limited, collects, uses, processes, stores, and protects information across our website, SaaS Control Panel, Omnichannel AI Support Desk (Web Chat, Voice AI, WhatsApp), AI Intake Assistant, Model Context Protocol (MCP) integrations, and third-party authentication providers (Google, Microsoft, and Meta/Facebook).
ESAA.AI is a multi-tenant Artificial Intelligence Software-as-a-Service (SaaS) platform owned and operated by GENXSYS Technologies Private Limited ("Company", "we", "us", or "our"). Our platform enables subscribing businesses, educational institutions, healthcare providers, and government departments ("Tenants" or "Customers") to deploy autonomous digital workers—including the Omnichannel AI Support Desk, AI Intake & Form Assistant, AI Appointment & Lead Concierge, and AI Follow-Up & Reminder Agent.
When We Act as Data Controller / Fiduciary
When you visit our marketing websites, register for an ESAA.AI Control Panel account, sign in via Google, Microsoft, or Facebook OAuth, or pay for a subscription plan, we act as the Data Controller / Data Fiduciary for your account information.
When We Act as Data Processor
When end-customers interact with an ESAA.AI widget, voice line, WhatsApp number, intake form, or grievance ticket portal deployed by one of our Business Tenants, we process that data strictly on behalf of and under the instructions of the subscribing Tenant.
Section 02
2. Categories of Information We Collect
We practice strict data minimization and only collect information necessary to deliver and secure the requested AI services:
Account & Social Login (OAuth) Data: When you create an account or sign in using Email/Password, Google, Microsoft, or Facebook, we collect your full name, business email address, profile avatar URL (if provided), organization name, and the unique app-scoped OAuth identifier token issued by the identity provider.
Omnichannel Conversation Data (Text, Voice & WhatsApp): Text messages entered into website chat widgets, real-time audio streams and speech-to-text transcripts from Voice AI phone/WebRTC calls, and inbound/outbound WhatsApp Business messages (including sender phone number and WhatsApp profile name).
AI Intake & Onboarding Submissions: Structured form responses, onboarding checklists, appointment preferences, and verification documents voluntarily provided by end-users during conversational form completion.
Grievance & Support Ticket Records: When an AI agent escalates an unresolved query to the background Grievance Portal, we store the generated Ticket ID, issue summary, customer contact reference, department routing status, and resolution notes.
Tenant Knowledge Base Documents: PDFs, brochures, FAQs, website URLs, and policy documents uploaded by Tenants to train their isolated AI agents.
Section 03
3. How We Use Information & Strict AI Model Training Policy
We use collected information solely to authenticate users, operate our AI agents, fetch authorized real-time customer records via Model Context Protocol (MCP) connectors, generate support tickets, process subscription billing, and maintain platform security.
Zero Generalized AI/ML Model Training Guarantee
ESAA.AI does NOT use your organization's uploaded knowledge documents, live MCP application payloads, customer chat/voice transcripts, WhatsApp logs, or Google/Microsoft/Meta user data to train, retrain, or improve generalized, foundational, or third-party Artificial Intelligence or Machine Learning models. Each Tenant's knowledge base is logically isolated and used exclusively to serve that specific Tenant's authorized AI agents.
Mandatory Google OAuth & API ComplianceLimited Use Verified
4. Google API Services User Data Policy (Limited Use Disclosure)
"ESAA.AI's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements."
When you choose to sign in to the ESAA.AI Control Panel using "Sign in with Google" or connect Google Workspace services (such as Google Calendar for the AI Appointment Concierge), we only request the minimum scopes necessary (`openid`, `email`, `profile`, and, where explicitly authorized by you, calendar scheduling scopes). In strict compliance with Google's Limited Use requirements:
Limited to User-Facing Features: We limit our use of Google user data strictly to providing or improving user-facing authentication and scheduling features that are prominent in the ESAA.AI user interface.
No Generalized AI/ML Training: We never transfer or use Google user data or raw/derived Workspace data to train non-personalized or generalized AI/ML models.
No Advertising or Sale of Data: We never sell Google user data to third parties, nor do we use or transfer Google user data for serving advertisements, retargeting, personalized ads, or creditworthiness evaluation.
Strict Prohibition on Unauthorized Human Access: We do not allow humans to read Google user data unless we have obtained your affirmative agreement to view specific data for a support ticket, it is necessary for security/abuse investigation, or it is required to comply with applicable law.
Section 05 • Microsoft Entra ID & OAuth
5. Microsoft Identity Platform Disclosures
When you authenticate using your Microsoft Account or Microsoft Entra ID (Azure AD) work or school account, ESAA.AI receives your basic profile claims (`name`, `preferred_username`, `email`, and tenant/object ID `oid`/`tid`) solely to verify your identity, provision your workspace access, and enforce organization-level single sign-on (SSO). Microsoft credentials and OAuth refresh tokens are encrypted at rest using AES-256 encryption and are never shared with external marketers or data brokers.
Section 06 • Meta Platform Terms Compliance
6. Meta (Facebook Login & Official WhatsApp Business API) Disclosures
ESAA.AI integrates with Meta Platforms, Inc. technologies in two distinct ways, strictly adhering to the Meta Platform Terms and WhatsApp Business Messaging Policy:
A. Facebook Login Authentication
When you click "Login with Facebook" on our Control Panel, we request the `public_profile` and `email` permissions. This provides us with your App-Scoped User ID (ASID), full name, email address, and profile icon. We use this data exclusively to log you into your ESAA.AI account and link your workspace profile.
B. Official WhatsApp Business Cloud API Integration (Enterprise Plan)
When a Business Tenant connects their WhatsApp Business Account (WABA) to the ESAA.AI Omnichannel Support Desk, we process incoming customer WhatsApp messages, media attachments, and phone numbers solely to deliver automated customer support, fetch live order/status updates requested by the user, and log unresolved grievances into the Tenant's Support Portal. We never sell WhatsApp user data, build cross-business behavioral profiles, or send unsolicited promotional messages without explicit user opt-in.
Official Data Deletion Instructions URL#data-deletion
7. User Data Deletion Instructions (Facebook, Google, Microsoft & WhatsApp Users)
In accordance with Meta Platform Terms (Section 3.d.i & Section 4.b), Google API Policy, the Digital Personal Data Protection Act (DPDP Act 2023), and GDPR, users have the absolute right to request the complete deletion of their account and platform data. You can delete your data at any time through any of the following methods:
Method 1: Revoke & Trigger Deletion Directly via Facebook Settings
Log into your Facebook account and navigate to Settings & Privacy → Settings → Apps and Websites.
Locate ESAA.AI (or GENXSYS AI) in your active apps list and click Remove.
Click View Removed Apps and Websites and select Send Data Deletion Request. Our automated Data Deletion Callback endpoint will purge your App-Scoped User ID (ASID) and return a unique confirmation code and status tracking URL.
Method 2: Self-Service Deletion Inside the ESAA.AI Control Panel
Log into your ESAA.AI Control Panel account, navigate to Account Settings → Privacy & Security → Delete Account & Data, and confirm deletion. All associated profile records, OAuth tokens, and knowledge bases are permanently queued for erasure within 72 hours.
Method 3: Online Data Deletion Portal & Email Request
Click the button to submit an immediate deletion request and receive an alphanumeric confirmation code on the spot, or email privacy@esaa.ai with the subject line "Data Deletion Request". All verified requests are completed within 7 business days.
Section 08
8. Real-Time Application Data (MCP Server) & Grievance Portal Processing
In our Pro and Enterprise plans, Tenants integrate their internal software (e.g., e-commerce order systems, hospital lab portals, university ERPs, or civic databases) with ESAA.AI via our Model Context Protocol (MCP) Server layer.
Ephemeral Runtime Lookups: When an end-user asks for live order, billing, or application status, the MCP server fetches only the specific record needed for that authenticated session over TLS 1.3. We do not bulk-harvest or mirror external databases without authorization.
Grievance Ticket Escalation: When a query cannot be resolved autonomously, the AI transcribes the relevant context into a structured ticket inside the Tenant's isolated Grievance Management Portal so authorized human staff can resolve the issue.
Section 09
9. Data Retention, Sub-Processors & Security Measures
We retain account information for as long as your ESAA.AI subscription remains active. Tenants may configure custom retention periods (e.g., 30, 90, or 365 days) for chat transcripts, voice recordings, and grievance tickets. Upon account termination or a verified deletion request, personal data is purged or irreversibly anonymized within 30 days, except where retention of billing invoices or audit logs is mandated by applicable tax or cyber laws. For full technical encryption details, please visit our Data Security & Trust Center.
Section 10
10. Data Protection & Grievance Officer Contact Information
If you have any questions about this Privacy Policy, our Google/Microsoft/Meta integrations, or wish to exercise your statutory rights, please contact our designated Privacy & Grievance Officer:
Legal Entity & Operator
GENXSYS Technologies Private Limited (ESAA.AI Division) Maharashtra, India
