Legal

Privacy Policy

How TICCO collects, uses, and protects information when you use QUIIQ.

Last updated: October 25, 2026

Back to home

Privacy Policy URL: https://quiiq.com/privacy

Policy version: 2026.10.25

This Privacy Policy describes how TICCO (The Indian Consultancy & Company) ("TICCO", "we", "us", or "our") collects, uses, discloses, and protects information when you use the QUIIQ SaaS platform, including our website at https://quiiq.com, the web application at https://app.quiiq.com, iOS and Android apps, website chat widgets, APIs, CRM, workflows, AI Assistants, and connected messaging channels (collectively, the "Platform" or "Service").

QUIIQ is a product developed and operated by TICCO (The Indian Consultancy & Company).

By accessing or using the Service, you acknowledge this Privacy Policy. Using the Service after we post a revised version means you accept the update for processing that does not require a new consent. Where law requires a separate consent for a new purpose, we will ask for that consent and will not treat continued use as consent.

WhatsApp, Messenger, Instagram, and Facebook are trademarks of Meta Platforms, Inc. Telegram is a trademark of Telegram FZ-LLC or its affiliates. Apple and Google Play marks are trademarks of their respective owners. QUIIQ integrates with these platforms and is not affiliated with, sponsored by, or endorsed by them.

1. Interpretation and roles

Definitions

  • Account means a login created for a person to access the Service.
  • Business Customer means the organization that subscribes to QUIIQ and instructs us how to process its Customer Data.
  • Customer Data means conversations, contacts, CRM records, knowledge documents, channel credentials, workflows, and similar content that a Business Customer (or its End Users) submit through the Service.
  • End User means a person who messages a Business Customer on a connected channel (for example WhatsApp, Messenger, Instagram, Telegram, or a website widget).
  • Workspace means an organization space in QUIIQ that holds Customer Data, users, channels, and billing for that space, unless a Custom group order says otherwise.
  • You means the individual or legal entity using the Service, including Business Customers and authorized team members.

1.1 Who is the controller and who is the processor

Owning and operating QUIIQ does not make TICCO the controller of every Business Customer's inbox or CRM data. Roles are:

  • Controller (TICCO): account registration, authentication, billing, invoices, security logs, product analytics on our website and apps, support tickets you send us, and similar data we decide how to use to operate the SaaS.
  • Processor (TICCO): Customer Data processed on the Business Customer's instructions, including messages, attachments, contact profiles, CRM fields, workflow outputs, uploaded knowledge, embeddings, and channel identifiers. The Business Customer is the controller of that Customer Data as against its End Users.

Processing of Customer Data is further described in our Data Processing Agreement, which is incorporated into the Terms of Service for Business Customers.

2. Information we collect

2.1 Account, billing, and security data

When you register or manage an Account, we may collect:

  • Name, email address, phone number, and job title
  • Organization name, billing address, and tax or invoicing details
  • Login credentials and authentication tokens
  • Team roles, permissions, and workspace settings
  • Device information, IP address, and security logs
  • Support communications and preferences

2.2 Channel and product data

QUIIQ can connect supported channels so your organization can handle conversations in one inbox, run CRM and workflows, and use AI Assistants. Data we process depends on which features you enable.

Common channel data may include channel identifiers, encrypted access tokens or bot tokens, message content and metadata, display names where the channel provides them, attachments, delivery status, and assignment history.

  • WhatsApp Business Platform: WABA and phone number identifiers, templates, media, and related webhook events.
  • Facebook Messenger: Page ID, encrypted Page access tokens, PSIDs, message content and metadata, and display names Meta makes available.
  • Instagram messaging: professional account identifiers, Instagram-scoped IDs, message content and metadata, and profile fields Meta makes available.
  • Telegram: bot username and encrypted bot token, Telegram user and chat IDs, message content and metadata.
  • Website widgets: visitor or session identifiers, page URL, browser metadata, and messages sent through the widget.
  • iOS and Android apps: device identifiers needed to operate the app, and push tokens used to deliver notifications.

CRM, workflows, and knowledge: contact records, tags, notes, custom fields, workflow configuration and run history, uploaded knowledge documents or URLs, and embeddings generated from that knowledge for retrieval.

Your use of a channel is also governed by that provider's terms. You are responsible for End User notices, consents, and opt-outs required for your business.

2.3 How Messenger and similar Meta connections are used

When a Facebook Page or Instagram professional account is connected, we use the data to receive and send customer support messages in your organization's QUIIQ inbox and related CRM and workflow features. We do not sell this data. We do not use it to train public third-party models (see Section 3.1).

2.4 Usage data, logs, and cookies

We automatically collect usage data when you visit our website or use the Platform, including IP address, device type, browser, pages viewed, features used, and diagnostic logs. Cookie practices are described in our Cookie Policy.

2.5 Payment information

Subscription payments are collected by TICCO as merchant of record and processed by independent payment aggregators such as Razorpay and Cashfree. We receive billing status, transaction references, invoices, and limited payment metadata. We do not store full card numbers, UPI PINs, or complete bank credentials on our servers. Billing inquiries: accounts@ticco.in. See our Refund and Cancellation Policy.

2.6 Sensitive information

Please do not submit special categories of personal data (such as health, biometric, or government ID data) through the Service unless you have a lawful basis and appropriate safeguards. We do not request identity documents by email as a routine step for deletion requests (see our Data Deletion page).

3. How we use personal data

We use data we control, and we process Customer Data on instructions, to:

  • Provide, operate, maintain, and secure the Service
  • Authenticate users and manage Accounts, teams, and permissions
  • Enable connected channels, unified inbox, CRM, workflows, widgets, and mobile apps
  • Operate AI Assistants as described in Section 3.1
  • Process subscriptions, invoices, add-ons, and support requests
  • Send service announcements, security alerts, and administrative messages
  • Monitor usage, prevent fraud and abuse, and enforce our terms
  • Comply with legal obligations and respond to lawful requests

3.1 Live AI processing

QUIIQ uses AI features in production. Depending on your configuration, this may include draft suggestions, automated replies by AI Assistants, classification, routing, and answers grounded in knowledge you upload.

When an AI feature runs, we may send to the model provider:

  • The current message and limited relevant conversation context
  • Retrieved snippets from uploaded knowledge documents (via embeddings and search)
  • Instructions, tool outputs, and workspace settings needed to generate the reply

Our current model provider is OpenAI, via its API. Embeddings used for retrieval are generated through that API and stored in our AWS-hosted infrastructure.

Training: we do not use Customer Data to train public third-party models. We use provider settings and terms under which API inputs are not used to train the provider's general models. Providers may retain limited data for a short period for abuse monitoring according to their policies. We do not grant providers a right to use your content to improve their general models.

You choose whether Assistants send automatically or only draft for a human. Configuration, testing, monitoring, and escalation duties are described in our Acceptable Use Policy.

4. Legal bases (EEA, UK, and Switzerland)

If you are in the EEA, UK, or Switzerland, we process Personal Data when:

  • Contract: necessary to provide the Service
  • Legitimate interests: to secure and operate the Service in a balanced way
  • Consent: where you have given clear consent (for example certain cookies)
  • Legal obligation: where we must comply with applicable law

For Customer Data, the Business Customer determines the lawful basis for its End Users. You may object, restrict processing, or withdraw consent where applicable by emailing hello@ticco.in.

5. How we share personal data

  • Subprocessors in Section 6 who host, deliver, or run AI on our behalf
  • Independent channel and payment providers in Section 6.1, which act under their own terms (for example Meta, Telegram, Razorpay, Cashfree, Apple, Google)
  • Your team and End Users according to workspace configuration
  • Professional advisers under confidentiality obligations
  • Authorities when required by law or to protect rights and security
  • Business transfers in a merger or asset sale, with appropriate safeguards

We do not sell Personal Data. We do not share End User identifiers or message content with other QUIIQ customers.

6. Subprocessors

The following providers process data on our behalf to operate the Service:

  • Amazon Web Services (AWS): Cloud hosting, compute, databases, object storage, caching (including Redis), backups, and related production infrastructure. Vector indexes derived from uploaded knowledge are stored in this infrastructure. Processing location: AWS regions used for production, including India where configured.
  • Vercel: Hosting and delivery of the public website at quiiq.com Processing location: Global edge network.
  • OpenAI: AI Assistants, draft and automated replies, embeddings, and retrieval over uploaded knowledge and relevant conversation context Processing location: United States and other locations used by OpenAI to provide the API.

Transactional email (service, billing, and support messages) is sent using SMTP through our email delivery provider. That provider processes email addresses and message content of those emails solely to deliver them.

We require subprocessors to protect Personal Data through contractual and technical measures. Material changes to this list will be reflected in this Policy and, for Customer Data, handled under the DPA.

6.1 Independent providers (not subprocessors of inbox content in the same way)

These parties deliver payments, channel messages, or device notifications under their own terms. We do not control how they independently process data on their networks:

  • Razorpay: Payment aggregation for subscriptions and invoices. Acts independently as a payment processor, not as a processor of inbox or CRM content.
  • Cashfree: Payment aggregation for subscriptions and invoices. Acts independently as a payment processor, not as a processor of inbox or CRM content.
  • Meta Platforms, Inc.: Delivery of WhatsApp, Messenger, and Instagram messages for connected business accounts and Pages.
  • Telegram: Delivery of Telegram messages through the Telegram Bot API for connected bots.
  • Apple: iOS app distribution and Apple Push Notification service for device notifications.
  • Google: Android app distribution and Firebase Cloud Messaging for device notifications.

7. International data transfers

Information may be processed in India and other countries where we or our subprocessors operate, including locations used by OpenAI. When we transfer Personal Data from the EEA, UK, or Switzerland, we rely on appropriate safeguards such as Standard Contractual Clauses where required. Contact hello@ticco.in for more information.

8. Retention schedule

We do not apply a single blanket period to all data. Unless a written order form or law requires otherwise:

  • Active workspace Customer Data (inbox, CRM, knowledge, embeddings) is kept while the workspace is active. Conversation history is available for up to 24 months unless you delete it sooner.
  • Deleted contacts, conversations, knowledge, or a workspace are removed from production systems within 30 days after the deletion is confirmed.
  • Encrypted backups may retain residual copies for up to 90 days, then they are overwritten or purged in the ordinary backup cycle.
  • Security and audit logs are kept for up to 12 months.
  • Account, billing, and tax records that we control are kept as required by applicable tax and accounting law (in India, company books are commonly retained for eight years) and then deleted or archived with restricted access.

Disconnecting a channel, cancelling billing, and deleting data are different events. See Section 8.1 and our Data Deletion page.

8.1 Disconnection, cancellation, and deletion

  • Disconnect a channel: we stop receiving new messages on that channel and revoke or delete stored credentials (for example Page tokens or bot tokens). Previously imported conversations and contacts remain in the workspace until you delete them.
  • Cancel a subscription: access continues until the end of the paid period (see the Refund Policy). Cancellation does not delete the workspace or its history.
  • Delete a user Account: that person's login is removed. Business records that belong to the organization remain. An organization admin must delete the workspace if the organization should be erased.
  • Delete a contact: that contact and associated conversation content are queued for production deletion as in Section 8.
  • Delete a workspace: an authorized organization admin may delete the workspace in the web app at https://app.quiiq.com (and equivalent controls in the mobile apps where available) or by emailing hello@ticco.in. That request deletes the organization space and its Customer Data on the schedule in Section 8.

9. Security

We implement technical and organizational measures designed to protect Personal Data, including encryption in transit, access controls, monitoring, and least-privilege access. No method of transmission or storage is completely secure. You are responsible for safeguarding Account credentials and connected channel access.

If a security incident materially affects Personal Data, we will notify you and, where required, regulators without undue delay, and we will assist Business Customers as described in the DPA.

10. Your rights and choices

Depending on your location, you may have the right to:

  • Access, correct, or delete Personal Data we hold about you
  • Restrict or object to certain processing
  • Data portability for information you provided
  • Withdraw consent where processing is consent-based
  • Lodge a complaint with your local supervisory authority

End Users should usually contact the Business Customer that messaged them. We will assist that Business Customer under the DPA. Direct requests to us are handled as described on Data Deletion.

11. California privacy rights (CCPA / CPRA)

If you are a California resident, you have rights to know, delete, correct, opt out of sale or sharing, and non-discrimination. We do not sell Personal Data or share it for cross-context behavioral advertising. Submit verifiable requests to hello@ticco.in.

12. Children

QUIIQ Accounts (Business Customer users) are for people who are at least 18 years old. We do not knowingly create Accounts for anyone under 18.

End Users who contact a Business Customer may be of any age the channel and the Business Customer allow. We process those conversations as a processor on the Business Customer's instructions. Business Customers must comply with child-protection and channel rules that apply to them. If we learn that an Account holder is under 18, we will close that Account. If an End User or parent asks us to delete conversation data, we will follow the Data Deletion process and notify the Business Customer where appropriate.

13. Third-party links and services

The Service links to third-party websites and channel platforms we do not control. Their practices are governed by their own policies.

14. Privacy complaints and policy changes

Privacy questions and grievances: email hello@ticco.in with the subject Privacy Grievance. We aim to acknowledge within 7 business days and complete a response within 30 days, or within any shorter period required by applicable law. If you are unsatisfied, you may escalate in writing to TICCO (The Indian Consultancy & Company) at 15A, City Vista, Tower A, Fountain Road, Kharadi, Pune 411014, Maharashtra, India, or to a competent data-protection or consumer authority.

We may update this Policy. Each version is identified by the version number and last-updated date on this page. We will post the revised Policy at https://quiiq.com/privacy. For material changes, we will give notice by email or in-product notice. Continued use is not treated as consent for a new processing purpose that legally requires consent.

15. Contact us

By using QUIIQ, you acknowledge that you have read this Privacy Policy (version 2026.10.25).