Privacy Policy

We at Nemati AI LLC (the "Company", "we", or "us"), the company that operates Indox, are committed to safeguarding the privacy of our users. This Privacy Policy explains how your Personal Information and Usage Information are collected, used, shared, stored, protected, and disclosed when you use our services, including the Indox website and related applications.

Indox provides online tools for converting files (such as documents and images) from one format to another. This Privacy Policy applies to all websites, applications, and services operated by the Company in connection with these file-conversion services ("Services").

By using our Services, you agree to the terms of this Privacy Policy. If you do not accept the terms of this Privacy Policy, you must stop using our Services. We strongly recommend that you read this policy carefully before proceeding with any activity on our platform.

Your use of Indox is also governed by our Terms of Use.
For details on your rights, obligations, and limitations of liability, please review the Terms of Use available on our website.

We collect information about you to:

• Register and manage your account;
• Provide access to and use of our Services;
• Communicate with you about the Services;
• Respond to your questions and support requests;
• Monitor service usage and prevent abuse or illegal activities;
• Enforce our Terms of Use.

When you visit or use our Services, we collect information about your device and interactions with the platform.

1. Technical Information

We may collect:

• IP address of the device used to access our Services;
• Device identifiers (e.g., mobile device ID);
• Technical details such as device type, browser type, operating system.

We use this information to:

• Optimize performance of the Services;
• Diagnose and resolve technical issues;
• Improve compatibility and stability.

2. Content Characteristics

When you use Indox, we process:

• Inputs you provide (e.g., file uploads, text inputs);
• Feedback or support messages;
• Metadata related to usage and conversions.

This information is used to:

• Provide core functionality (e.g., converting files, maintaining history where enabled);
• Improve reliability and quality of the Service;
• Support debugging and service optimization.

3. Cookies

When you access our Services via web browser, we use cookies and similar technologies.

Cookies are small identifiers stored on your device that allow us to:

• Recognize your browser or device;
• Track how and when pages and features are accessed;
• Measure usage and performance.

You may configure your browser to refuse cookies or notify you when a cookie is being sent. However, disabling cookies may limit certain features of the Service.

Third-party websites that you access via links on our platform may also use cookies. This Privacy Policy does not govern third-party cookies.

4. Personal Data

We may ask you to provide personally identifiable information, including but not limited to:

• Email address;
• First and last name;
• Usage and content generation data;
• Phone number;
• Location data (where applicable or required by law/regulation).

Some Indox tools, such as AI Extract, Doc Chat and Summarize, use artificial-intelligence models.

When you use one of these tools, the content of the document you select and the instructions you type are sent to third-party AI model providers so they can generate the result. These providers are currently Anthropic, Google and OpenAI. If we add or change a provider, we will update this policy.

We do not use your files or your prompts to train AI models.

The Company may use Personal Data for the following purposes:

• To provide and maintain the Service
  Including monitoring usage, ensuring proper functionality, and improving service quality.

• To manage your account
  Managing registration, authentication, and access to features available to registered users.

• For the performance of a contract
  Fulfilling contractual obligations related to purchased products, services, or subscriptions.

• To contact you
  Communicating via email or other electronic means (e.g., in-app notifications) regarding service updates, security notices, or essential information.

• To provide you with news and offers
  Sending information about similar services, features, or events, unless you opt out of such communications.

• To manage your requests
  Handling and resolving support requests or user inquiries.

• To deliver targeted content or advertising
  Where applicable and lawful, using your information (possibly together with third-party vendors) to tailor content or measure advertising effectiveness.

• For other internal purposes
  Such as data analysis, identifying usage trends, evaluating or improving our Services, and refining our marketing and user experience strategies.

We retain Personal Data only as long as necessary to:

• Fulfill the purposes set out in this Privacy Policy;
• Comply with legal obligations;
• Resolve disputes;
• Enforce our agreements and policies.

Retention periods may vary depending on data type, legal requirements, and business needs.

We use commercially reasonable technical and organizational measures to protect your information, including:

• Access controls and authorization limits;
• Encryption where appropriate;
• Firewalls and intrusion detection systems;
• Secure data transmission practices.

No system can guarantee absolute security, but we aim to minimize risk and restrict access to authorized personnel only.

If you access our Services from outside the United States, your data may be transferred to, stored in, or processed in the United States, where our primary infrastructure is located. Data protection laws in the United States may differ from those in your jurisdiction.

We take reasonable steps to ensure that your data is treated securely and in accordance with this Privacy Policy, and that no transfer occurs without appropriate safeguards.

We do not rent or sell your personally identifiable information for ad or lead monetization. However, we may share your information as described below.

1. Third-Party Vendors

We may engage third-party vendors to perform services on our behalf, such as:

• Business analytics;
• Customer support;
• Payment processing;
• Infrastructure and hosting;
• Email delivery;
• Marketing and communications;
• Live chat or support interfaces.

These vendors are authorized to use your information only as needed to perform their functions and are not permitted to use or share your information for other unrelated purposes.

2. Companies Within Our Corporate Family

We may share information with our subsidiaries or affiliates as needed to provide and improve services.
Any such entity handling your data must follow privacy practices consistent with this Privacy Policy.

3. Business Partners

We may collaborate with business partners to offer integrated or optional services. If you choose to use such services, we may share relevant information with those partners. Their use of your data will be governed by their own privacy policies.

4. User Profiles and Submissions

If the Service exposes any social or collaborative features (e.g., profile, comments, discussion areas), certain information you voluntarily provide (such as name, location, profile content, or uploaded media) may become visible to other users.

Any content you publish in public areas may be collected or used by others. We do not control third-party practices in such contexts.

5. Affiliated Websites

If you were referred to Indox from another website, it may be necessary to share limited registration information (e.g., name, email) with that referring site. Their privacy practices are governed by their own policies.

6. Business Transfers

In the event of a merger, acquisition, reorganization, sale of assets, bankruptcy, or similar event, user information may be transferred as part of the business assets.

7. Government Bodies and Legal Requirements

We may disclose your Personal Information when required by law or in response to valid legal processes (e.g., subpoena, court order, government request), or to protect our rights, property, or safety.

Where legally permitted and practical, we will attempt to notify you when such disclosures are made.

We may use your email address to send:

• Service updates;
• Security or important notices;
• Optional newsletters, marketing, or promotional materials.

You can opt out of marketing emails by:

• Clicking the unsubscribe link in our emails, or
• Contacting us at [email protected].

We may use email infrastructure providers (e.g., Amazon SES or similar services). Their privacy practices are governed by their own privacy policies.

We may use third-party payment processors (such as Stripe) to handle payments.

• We do not store full credit card details on our servers.
• Payment data is processed directly by the payment provider under their own PCI-DSS–compliant policies.

You can review Stripe's Privacy Policy here: https://stripe.com/privacy.

Our mobile application may request access to certain device features to provide core functionality. Each permission is requested only when you use the feature that needs it, and you can deny or revoke it at any time in your device's system settings.

Camera

Used to scan documents and capture images for conversion. Images are sent to our servers only when you choose to convert or process them.

Photos and Files

Used to select images and documents for conversion, and to save converted files to your device or photo library.

Microphone and Speech Recognition

Used to search files and formats by voice. Your speech is converted to text on your device by the operating system's built-in speech recognition engine (for example Google Speech Services on Android or Apple Speech Recognition on iOS). We do not record, store, or receive audio. Your device's speech recognition service may process audio under its own privacy policy.

Biometrics

Used to unlock the app with your fingerprint or face. Biometric checks are performed by your device's operating system; we never receive or store your biometric data.

Internet Access

The application requires internet access to convert files, synchronize your account, and communicate with our servers. Data sent over the internet is encrypted using industry-standard TLS.

Depending on where you live, you may have the right to access, correct, or delete the personal information we hold about you, and to object to or restrict certain processing. You can close your account at any time from your account settings. A closed account, and the files stored in it, is permanently erased 30 days later; signing in before then reactivates it. If the account has an active paid subscription or owns a business workspace, it is erased once the subscription has ended or the workspace is closed. Records of purchases are kept without your account details, as tax and accounting rules require.

When the erasure is complete, we send a final confirmation email to the address on the account. At erasure we also delete the customer record our payment processor holds for you. The processor keeps the transaction records it must keep by law. Our security audit log, which records the email address, IP address and browser used for sign-ins and other account events, is not erased with the account. Each entry is kept for 365 days from the day it is recorded, as security and fraud evidence, and is then deleted. Erased data may remain in our backups for up to 30 days after erasure. Temporary copies that our spreadsheet and document editors store when you import a file into them or export one from them are not tied to your account. They are deleted automatically once they are more than 24 hours old. The AI model providers and the email delivery service we use keep their own short-lived request and delivery logs, under their own retention periods. We send them no account ID, only the content an AI request needs or an email and the address it goes to, so there is no account record at these services for us to delete.

To exercise these rights, contact us at [email protected]. The sections below describe the specific rights under GDPR and CCPA.

If you are located in the European Economic Area (EEA) or another GDPR jurisdiction, the following applies.

Legal Basis for Processing Personal Data

We may process Personal Data under one or more of the following legal bases:

• Consent – You have given consent for one or more specific purposes.
• Performance of a contract – Processing is necessary to perform a contract with you or fulfill pre-contractual steps.
• Legal obligations – Processing is required to comply with applicable laws.
• Vital interests – Processing is necessary to protect someone’s vital interests.
• Public interest – Processing is related to tasks carried out in the public interest or under official authority.
• Legitimate interests – Processing is necessary for our legitimate interests, provided they do not override your rights and freedoms.

We will help clarify which legal basis applies in specific situations upon request.

Your Rights under GDPR

If you are within the EU/EEA, you have the right to:

• Access your Personal Data
• Request correction of inaccurate or incomplete data
• Object to processing based on legitimate interests or for direct marketing
• Request erasure of your Personal Data where there is no valid reason for continued processing
• Request data portability in a structured, commonly used, machine-readable format
• Withdraw consent where processing is based on consent

To exercise these rights, contact us at [email protected].

This privacy notice section for California residents supplements the information contained in Our Privacy Policy and applies solely to all visitors, users, and others who reside in the State of California.

Sources of Personal Information

We obtain the categories of personal information listed above from the following categories of sources:

• Directly from You. For example, from the forms You complete on our Service, preferences You express or provide through our Service, or from Your purchases on our Service.
• Indirectly from You. For example, from observing Your activity on our Service.
• Automatically from You. For example, through cookies We or our Service Providers set on Your Device as You navigate through our Service.
• From Service Providers. For example, third-party vendors to monitor and analyze the use of our Service, third-party vendors to provide advertising on our Service, third-party vendors to deliver targeted advertising to You, third-party vendors for payment processing, or other third-party vendors that We use to provide the Service to You.

Use of Personal Information for Business Purposes or Commercial Purposes

We may use or disclose personal information We collect for "business purposes" or "commercial purposes" (as defined under the CCPA), which may include the following examples:

• To operate our Service and provide You with our Service.
• To provide You with support and respond to Your inquiries, including investigating and addressing Your concerns and monitoring and improving our Service.
• To fulfill or meet the reason You provided the information. For example, if You share Your contact information to ask a question about our Service, We will use that personal information to respond to Your inquiry. If You provide Your personal information to purchase a product or service, We will use that information to process Your payment and facilitate delivery.
• To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations.
• As described to You when collecting Your personal information or as otherwise set forth in the CCPA. For internal administrative and auditing purposes.
• To detect security incidents and protect against malicious, deceptive, fraudulent, or illegal activity, including, when necessary, prosecuting those responsible for such activities.

Please note that the examples provided above are illustrative and not intended to be exhaustive. For more details on how we use this information, please refer to the "How We Use Your Information" section. If We decide to collect additional categories of personal information or use the personal information We collected for materially different, unrelated, or incompatible purposes, We will update this Privacy Policy.

Your Rights under the CCPA

The CCPA provides California residents with specific rights regarding their personal information. If you are a resident of California, you have the following rights:

The Right to Notice: You have the right to be notified of which categories of Personal Data are being collected and the purposes for which the Personal Data is being used.

The Right to Request: Under the CCPA, you have the right to request that we disclose information to you about our collection, use, sale, disclosure for business purposes, and sharing of personal information. Once we receive and confirm your request, we will disclose to you:

• The categories of personal information we collected about you.
• The categories of sources for the personal information we collected about you.
• Our business or commercial purpose for collecting or selling that personal information.
• The categories of third parties with whom we share that personal information.
• The specific pieces of personal information we collected about you.

If we sold your personal information or disclosed your personal information for a business purpose, we will disclose to you:

• The categories of personal information sold.
• The categories of personal information disclosed.

The Right to Say No to the Sale of Personal Data (Opt-Out): You have the right to direct us not to sell your personal information. To submit an opt-out request, please contact us.

The Right to Delete Personal Data: You have the right to request the deletion of your Personal Data, subject to certain exceptions. Once we receive and confirm your request, we will delete (and direct our Service Providers to delete) your personal information from our records, unless an exception applies.

We may deny your deletion request if retaining the information is necessary for us or our Service Providers to:

• Complete the transaction for which we collected the personal information, provide a good or service that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform our contract with you.
• Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.
• Debug products to identify and repair errors that impair existing intended functionality.
• Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law.
• Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 et seq.).
• Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information's deletion may likely render impossible or seriously impair the research's achievement, if you previously provided informed consent.
• Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us.
• Comply with a legal obligation.
• Make other internal and lawful uses of that information that are compatible with the context in which you provided it.

The Right Not to Be Discriminated Against: You have the right not to be discriminated against for exercising any of your consumer rights, including by:

• Denying goods or services to you.
• Charging different prices or rates for goods or services, including the use of discounts or other benefits or imposing penalties.
• Providing a different level or quality of goods or services to you.
• Suggesting that you will receive a different price or rate for goods or services or a different level or quality of goods or services.

Requests under the CCPA can be made by contacting us at [email protected].

Our Services are not intended for children under 13 years of age (or under 16 in certain jurisdictions). If you believe a child has provided us with Personal Information, please contact us so we can delete it.

We may update this Privacy Policy from time to time. When we do:

• We will post the updated version on this page;
• We may notify you via email or a prominent notice on the Service;
• The "Update" date at the top of this document will be revised.

Your continued use of the Service after changes take effect means you accept the updated Privacy Policy.

If you have any questions about this Privacy Policy or our data practices, you can contact us:

• Company: Nemati AI LLC
• Email: [email protected]
• Support Page: https://indox.org/support