Privacy Policy

1 Who we are & this policy

CXODash (“CXODash”, “we”, “us”, “our”) is a spend- and finance-operations platform that helps organisations route reimbursements, petty cash and vendor spend through their own approval workflows, keep a full audit trail, and post entries into their accounting system. This policy applies to our marketing website at cxodash.in and to our product application at app.cxodash.in (together, the “Services”).

The Services are operated by MEKONS AUTOMATIONS PRIVATE LIMITED, a company incorporated in India (CIN U62013MR2026PTC478831) with its registered office at H. No. 8/1/A, Old Gauri Pada, Guruvandana Apartment, Anjur, Bhiwandi, Thane – 421302, Maharashtra, India. In this policy, “CXODash”, “we”, “us” and “our” refer to that company.

We are committed to handling personal data lawfully, fairly and transparently, in line with the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and other applicable Indian law. In this policy, a “Data Principal” is the individual to whom personal data relates, a “Data Fiduciary” is the party that decides why and how personal data is processed, and a “Data Processor” processes personal data on a Fiduciary’s behalf.

2 Our two roles

Because CXODash is a business-to-business platform, our role depends on whose data is involved:

• As a Data Fiduciary. For the personal data of our own account holders and website visitors — for example, the person who signs up, the contact and login details of users, billing contacts, and visitors to cxodash.in — we decide the purposes and means of processing, so we act as the Data Fiduciary.
• As a Data Processor. When a customer organisation uses the product, it uploads or generates personal data about its own employees, approvers, vendors and payees (for example, claim details, receipts, bank details). For that data, the customer organisation is the Data Fiduciary and CXODash processes it strictly on the customer’s instructions to provide the Services. If you are an employee or vendor of such an organisation, please direct data requests to that organisation first; we will support them in responding.

3 Personal data we collect

We collect only what is needed to run the Services. The main categories are:

We do not seek to collect special/sensitive categories beyond what is inherent in expense documentation, and we ask you not to upload unnecessary sensitive personal data. We do not run advertising profiles or sell personal data — ever.

4 How & why we use it

We use personal data to:

• Create and secure accounts, and authenticate sign-ins (including OTP and password login).
• Provide the Services — route approvals, manage advances and vendors, and post approved entries to your accounting system.
• Send transactional and service communications (OTPs, approval notifications, reminders, important notices).
• Operate billing — verify the payment proof you submit and activate or renew your plan.
• Maintain security, prevent fraud and abuse, debug, and keep an audit trail for accountability.
• Meet legal, tax and accounting obligations, and enforce our terms.
• Improve and support the Services.

Under the DPDP Act we process personal data on the basis of your consent and, where applicable, the “legitimate uses” permitted by the Act (for example, a purpose for which you have voluntarily provided data, or employment-related purposes of the customer organisation). Where we rely on consent, you may withdraw it at any time (see Your rights).

5 Cookies, local storage & analytics

The marketing site at cxodash.in does not set advertising or cross-site tracking cookies. The product application uses only strictly necessary cookies and browser storage — for example, a session/authentication token to keep you signed in. Without these the Services cannot function.

To understand how our website is used and to improve it, we operate our own first-party, privacy-friendly analytics. We do not use third-party advertising networks or cross-site trackers, and we do not build marketing profiles about you. Our analytics records, in aggregate, your IP address (used to count unique visitors and approximate broad location), the pages you view, and the time spent on each page. We use this only for basic, aggregate insight into traffic and engagement; we do not sell it or share it for advertising. This analytics data is retained only as long as needed for that purpose, and is then deleted or anonymised.

6 Who we share data with

We do not sell personal data. We share it only with service providers (“Data Processors”) who help us run the Services under contract, and only as needed:

We may also disclose personal data if required by law, court order or a lawful request from a public authority, or to protect our rights, users and the security of the Services. If we are ever involved in a merger, acquisition or asset transfer, personal data may be transferred subject to this policy.

7 Where your data is stored

Personal data is hosted on AWS infrastructure in AWS Asia Pacific (Mumbai) — ap-south-1, India. We aim to keep personal data within India. Where any limited processing involves a provider outside India, we do so only as permitted by the DPDP Act and applicable Government of India notifications, and under contractual safeguards.

8 How long we keep it

We keep personal data only for as long as needed for the purposes above. As a guide, our standard retention periods are:

When data is no longer required for these purposes, we delete or anonymise it. On account closure we will, on request, delete or return personal data, subject to retention we are legally required to maintain.

9 How we protect it

We apply reasonable security safeguards appropriate to the risk, including encryption of data in transit, strong password hashing, short-lived hashed one-time passcodes, opaque session tokens, rate-limiting, strict per-tenant data isolation enforced at the database layer, least-privilege access, and a full audit trail. A fuller description is on our Security page. No method of transmission or storage is perfectly secure, but we work to protect your data and to notify affected parties and the Data Protection Board of India as required by law in the event of a personal-data breach.

10 Your rights under the DPDP Act

As a Data Principal, you have the right to:

• Access — obtain a summary of the personal data we process about you and how we process it.
• Correction & completion — have inaccurate or incomplete data corrected or updated.
• Erasure — request deletion of personal data that is no longer needed for the purpose it was collected, unless retention is required by law.
• Withdraw consent — withdraw consent at any time, as easily as it was given (withdrawal does not affect processing already carried out).
• Grievance redressal — raise a complaint with our Grievance Officer and receive a timely response.
• Nominate — nominate another individual to exercise your rights in the event of your death or incapacity.

To exercise any of these rights, email admin@cxodash.in. We may need to verify your identity before acting. If your data was provided by your employer or another organisation (where we act as Processor), we will direct your request to them. If you are not satisfied with our response, you may escalate to the Data Protection Board of India.

11 Children’s data

The Services are intended for business use by adults (18 years and over) and are not directed at children. We do not knowingly collect personal data of children. If you believe a child’s data has been provided to us, please contact us and we will delete it.

12 Changes to this policy

We may update this policy from time to time — for example, as the Services evolve or as the law changes. We will revise the “Last updated” date above and, for material changes, take reasonable steps to notify you. Continued use of the Services after an update means you accept the revised policy.

13 Grievance Officer & contact

For any question, request or complaint about privacy or your personal data, you can reach our Grievance Officer / privacy contact: