Privacy Policy

1. Introduction

IntegrityX ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or use our services for financial fraud prevention, discovery, and recovery.

2. Information We Collect

2.1 Personal Information

We may collect personal information that you voluntarily provide to us, including:

• Name and contact information (email address, phone number)
• Company name and job title
• Account credentials
• Payment and billing information
• Communications and correspondence with us

2.2 Business Data

When you use our fraud detection services, we may process:

• Financial transaction data
• Vendor and supplier information
• Invoice and payment records
• Employee-related data as necessary for fraud detection

2.3 Automatically Collected Information

We automatically collect certain information when you visit our website, including IP address, browser type, device information, and usage data through cookies and similar technologies.

3. How We Use Your Information

We use the collected information for the following purposes:

• Providing and maintaining our fraud detection and prevention services
• Processing transactions and sending related information
• Responding to your inquiries and providing customer support
• Sending promotional communications (with your consent)
• Improving our services and developing new features
• Complying with legal obligations
• Protecting against fraudulent or illegal activity

4. Data Security

We implement appropriate technical and organizational security measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include encryption, access controls, regular security assessments, and employee training.

5. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.

Client uploads are purged 30 days after processing.Copies kept by AI processors follow each processor's own retention, stated in section 8. Personal data is masked by default within the platform; unmasking requires an authorised role and a recorded reason, and is logged. The tamper-evident audit trail is retained separately for up to seven years and is not user-deletable. A data deletion certificate is issued on request and on offboarding.

6. Information Sharing

We may share your information with:

• AI sub-processors that process data on our instruction — Google Gemini (Vertex AI), Anthropic Claude, Jev (TypeSafe), reached through OpenRouter, Snap (subq) and OpenAI (GPT). They do not all handle data the same way, so where each processes, what it keeps and the terms we rely on are stated for each in section 8 and in our Responsible AI Policy §6
• Other service providers who assist in our operations
• Professional advisors (lawyers, accountants, auditors)
• Law enforcement or regulatory bodies when required by law
• Business partners with your consent

We do not sell your personal information to third parties.

7. Your Rights

Subject to applicable law, you have the right to:

• Access your personal information
• Correct inaccurate or incomplete information
• Request deletion of your personal information
• Object to or restrict certain processing activities
• Data portability
• Withdraw consent where processing is based on consent

8. International Data Transfers

Platform storage, compute and backups are in India (Google Cloud, asia-south1, Mumbai). AI processing is the disclosed exception. Each AI processor, where it processes and what it keeps:

• Google Gemini (Vertex AI) — India (Mumbai, asia-south1) for reading client documents, the scoping chat, search embeddings and data alignment. Scoping analysis and written summaries use Google’s global endpoint, where Google chooses the region. Google keeps a temporary cache of requests in the region that serves them, deleted no later than 24 hours after it is written. Google may log prompts to detect abuse. No training on client data, under Google Cloud’s terms. Google Cloud’s commercial terms.
• Anthropic Claude — United States. Anthropic stores data in the US. Requests use Anthropic’s default routing, which may serve them from other regions. Inputs and outputs are deleted within 30 days. Content flagged by Anthropic’s safety systems may be kept for up to 2 years. No training on client data, under Anthropic’s commercial terms. Anthropic’s standard commercial terms.
• Jev (TypeSafe), reached through OpenRouter — Outside India. The processing location is not confirmed. Requests go only to endpoints that OpenRouter lists as zero data retention. Requests go only to endpoints that OpenRouter lists as not collecting data. TypeSafe has not confirmed this to us in writing. No written agreement with TypeSafe. We rely on OpenRouter’s routing settings.
• Snap (subq) — Not confirmed. Under subq’s default terms, requests are kept until deleted. We have not requested zero retention. Not confirmed by subq. subq’s standard terms. No written agreement with subq.
• OpenAI (GPT) — To be stated here before first use. To be stated here before first use. To be stated here before first use. To be stated here before first use.

Client data, including the files a client uploads and the values in them, is processed by the processors listed here, some of them outside India. Each processor’s entry states where it processes data. The check for employee data, and the removal of employee identities, run in India before anything is sent to a model outside India. This list is kept on our Responsible AI Policy, section 6. Processors handle data differently, so each one’s location, retention and terms are stated separately. When a processor is added or changed, clients are notified as their agreement says. Full detail, including what each processor is used for, is in our Responsible AI Policy §6.

9. Children's Privacy

Our services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date.

11. Contact Us

If you have any questions about this Privacy Policy or our privacy practices, please contact us at: