Privacy Policy

Effective 5 October 2026

CorpAi is a service operated by Business Lead Intelligence, a sole proprietorship based in Mumbai, India (“we”, “us”). It helps businesses see and manage the conversations they have with their own customers on WhatsApp and email. This policy explains what personal data we handle, why, who else handles it, how long we keep it, and how you can have it exported or deleted.

1. Two kinds of people, two roles

• Our customers (the businesses and their staff who sign up). For their account and billing details we decide how the data is used.
• Our customers’ own customers and contacts (the people who message a business that uses CorpAi). For this data the business decides why and how it is used, and we process it on the business’s behalf to provide the service. If you wrote to a business and want to see or delete what it holds, please contact that business first; we will also help directly (see Data Deletion).

2. What we collect

We do not store card or bank details; payments are taken by our payment provider.

3. Why we use it

• To provide the service: show conversations, analyse messages, create tasks and reminders, send replies you ask us to send.
• To run accounts, billing, invoices and support.
• To keep the service secure, prevent abuse and fix problems.
• To meet legal, tax and accounting obligations.

We do not sell personal data and we do not use customers’ messages to advertise.

4. AI processing

Some messages are analysed by software that includes an AI model provided by OpenAI. Only the text needed to analyse a message (with recent context) is sent for that purpose. Most analysis is done by our own rules and does not leave our systems. The AI’s output can be wrong and is meant to assist people, not replace their judgement. A monthly limit applies to how many messages per workspace are sent for AI analysis.

5. Google user data (Gmail)

If a workspace connects a Gmail account, CorpAi asks Google for read-only access to the mailbox (the gmail.readonly scope). We use it only to detect new messages and copy the sender, subject and body of customer-facing emails into that workspace as conversation records, and, at the workspace’s discretion, to produce an advisory summary of a message’s likely intent. We never send, delete or change anything in the Gmail account, and nothing acts on a conversation unless a person chooses to.

CorpAi’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular: we do not use Gmail data for advertising; we do not allow people to read it except with your consent, to investigate abuse, to comply with the law, or to provide support you have asked for; we do not transfer it to others except as needed to provide the features you asked for (for example our hosting and AI providers, under contract), to comply with the law, or as part of a merger or sale; and we do not use it to train generalised AI or machine-learning models. You can disconnect Gmail at any time in Settings or in your Google Account permissions; that stops future syncing, and records already copied stay in the workspace until it is deleted.

6. Who else handles the data

We use these service providers to run CorpAi. Each receives only what it needs for its role.

We may also disclose data where the law requires it or to protect our rights, and to a successor if the business is transferred.

7. How long we keep it

• Workspace data is kept while the account is active. An owner can delete the workspace (there is a 30-day waiting period in which the request can be cancelled), after which customer data is erased as described in Data Deletion.
• Raw copies of incoming messages held for troubleshooting are blanked after 90 days; finished background-job records after 30 days.
• Sign-in records (time, IP address, browser) are deleted after 180 days, and with the workspace if it is deleted.
• Billing, payment and invoice records are kept for as long as Indian tax and accounting law requires.
• Backups of our database are kept for a limited time (up to about three months) and then expire; data erased from the live service can remain in a backup until it expires.
• Operational history and AI-processing logs. Some internal records (an activity timeline, task and commitment history, and a log of AI requests) are kept in a protected, append-only form and can include short excerpts of messages. They are not removed by an individual erasure request. If you want them reviewed, write to us.

8. Your rights

You can ask to access, correct, export or delete your personal data, to withdraw consent where we rely on it, and to complain about how it is handled. Workspace owners can export data and erase a contact or the whole workspace themselves under Settings → Data & Privacy. Anyone can write to support@nexoracorpai.com; we may need to verify who you are, and we will respond without undue delay.

9. Security

Access tokens are stored encrypted, connections use HTTPS, access is limited by role, and every workspace’s data is kept separate from others. No system is perfectly secure; if we learn of a breach that affects you we will tell you as the law requires.

10. Cookies

We use only the cookies needed to sign you in and keep your session. We do not use advertising cookies.

11. Children

The service is for businesses and is not directed at children under 18.

12. Changes

If we change this policy we will update the date above and, for significant changes, tell account owners.

13. Contact