- We collect what we need to run CXVoice: account details, survey feedback (including optional voice notes) and, when connected, Google Business Profile reviews.
- Businesses control the feedback their customers leave. We process it on their behalf.
- We do not sell personal information or use feedback for advertising.
- You can ask to access, correct or delete your information at any time.
01Who we are and what this policy covers
CXVoice.io (“CXVoice”, “we”, “us” or “our”) provides a customer feedback platform that helps businesses collect surveys, voice feedback and Google reviews, understand what their customers are saying, and follow up with care.
This Privacy Policy explains how we collect, use, share and protect personal information when you:
- visit our website at cxvoice.io or contact us;
- use the CXVoice platform as a business customer or a member of a business’s team; or
- leave feedback for a business through a CXVoice survey, QR code or link (a “respondent”).
It should be read together with our Terms and Conditions and Cookie Policy.
02Our role: controller and processor
Website visitors and business customers. When you browse our website, contact us, or create and manage a CXVoice account, we decide how and why your information is used. For this information we act as the data controller.
Respondents. When you leave feedback for a business (for example, a café, salon, hotel or shop) using a CXVoice survey, that business decides what to ask and how to use your answers. The business is the controller of your feedback, and CXVoice processes it on the business’s behalf and according to its instructions. If you have a question about feedback you left, or want to exercise your rights over it, please contact the business directly. We will help them respond.
03Information we collect
Information you give us
- Enquiries: your name, business name, email address, phone number and the content of your message when you contact us or ask for a demo.
- Account details: the name, work email, role, password (stored in hashed form) and preferences of each team member, and the business, locations and touchpoints you set up.
- Billing details: billing contact, address, tax details and payment records. Card details are handled by our payment provider and are not stored on our servers.
- Support: information you share when you ask for help.
Feedback submitted through CXVoice surveys
- Ratings, written comments and the language you choose (for example English, Sinhala or Tamil).
- Voice notes, if you choose to record one, and text transcripts or translations created from them.
- The location and touchpoint the feedback relates to (for example “Table 08” or “Front desk”), and the date and time it was submitted.
- Contact details, only if the business asks for them and you choose to provide them.
- Basic technical information such as browser type, device type and an approximate location derived from your IP address, used to keep surveys secure and to prevent spam or duplicate submissions.
Please do not include sensitive information, such as health details or payment card numbers, in your feedback.
Google Business Profile information
If a business connects its Google Business Profile, we access the profile and location details, public reviews (including the reviewer’s public name, profile photo, rating, review text and date) and the business’s replies, so the business can read and respond to reviews in CXVoice. See How we use Google user data.
Information collected automatically
- Log and device information, such as IP address, browser and operating system, pages viewed, referring page, and the date and time of your visit.
- Security information generated by our hosting and content delivery provider, Cloudflare, which protects the website from abuse.
- Information from cookies and similar technologies, as described in our Cookie Policy. Our website does not currently use advertising or analytics cookies.
04How we use information
- To provide the CXVoice platform: hosting surveys, collecting and organising feedback, transcribing voice notes, showing dashboards and trends, routing feedback to the right team member and sending manager alerts.
- To let businesses read, manage and reply to their Google reviews from CXVoice.
- To create and manage accounts, authenticate users, and control which locations each team member can see.
- To respond to enquiries, provide support, and send service messages such as security notices, billing information and important changes.
- To send product news and marketing to business contacts, where permitted by law. You can unsubscribe at any time. We do not send marketing to respondents on behalf of CXVoice.
- To keep our services secure, detect and prevent fraud, spam and abuse, and enforce our terms.
- To maintain and improve our services, including by analysing usage in aggregated or de-identified form.
- To comply with legal obligations and respond to lawful requests.
We do not sell personal information, and we do not use respondents’ feedback to build advertising profiles.
05Legal bases for processing
Where data protection laws such as Sri Lanka’s Personal Data Protection Act, No. 9 of 2022, or the EU and UK General Data Protection Regulation apply, we rely on the following legal bases:
- Contract: to provide the services a business has signed up for and to manage its account.
- Legitimate interests: to respond to enquiries, secure and improve our services, and communicate with business contacts, balanced against your rights and interests.
- Consent: where required, for example for optional marketing emails or non-essential cookies. You can withdraw consent at any time.
- Legal obligation: to keep financial records and respond to lawful requests.
For respondent feedback, the business that runs the survey is responsible for identifying its own legal basis and for giving respondents any required notice.
06Voice feedback
Recording a voice note is always optional. Your browser will ask for permission before your microphone is used, and recording only starts when you choose to record.
Voice notes are stored securely and may be converted into text and translated so the business can read, search and analyse feedback. We do not use voice recordings to identify individuals by their voice, and we do not create voiceprints or other biometric identifiers.
Businesses control how long voice notes are kept, and can delete them at any time.
07How we use Google user data
When a business connects its Google Business Profile, it authorises CXVoice through Google’s secure sign-in to access Business Profile information on its behalf. We use this access only to:
- display the business’s locations, reviews and review replies inside CXVoice;
- let authorised team members draft and publish replies to reviews; and
- show review trends and insights to the business.
CXVoice’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we do not use Google user data for advertising, we do not sell it, and we do not allow people to read it except where the business has given permission, where it is needed for security or to comply with the law, or where the data has been aggregated and anonymised.
Replies are only published to Google when an authorised team member chooses to publish them. A business can disconnect its Google Business Profile at any time in CXVoice, or remove CXVoice’s access from its Google Account permissions.
09International data transfers
CXVoice is used by businesses in Sri Lanka and elsewhere, and our service providers may store or process information in other countries. When personal information is transferred across borders, we take steps required by applicable law to protect it, such as working with providers that offer appropriate safeguards and contractual protections.
10How long we keep information
- Feedback and review data is kept for as long as the business keeps its CXVoice account, or until the business deletes it. Businesses can set shorter retention periods.
- Account information is kept while the account is active. After an account is closed, we delete or anonymise customer data within 90 days, unless we need to keep it longer by law.
- Enquiries are kept for up to 24 months after our last contact, unless you become a customer.
- Billing records are kept for as long as tax and accounting laws require.
- Security logs are kept for a limited period, normally no longer than 12 months.
11How we protect information
We use technical and organisational measures designed to protect personal information, including encryption in transit, access controls based on each person’s role and locations, secure authentication, monitoring, and regular review of our practices. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we become aware of a data breach that affects your information, we will notify you and the relevant authorities as required by law.
12Your rights and choices
Depending on where you live, you may have the right to:
- access the personal information we hold about you and get a copy of it;
- correct information that is inaccurate or incomplete;
- ask us to delete your information;
- object to, or ask us to restrict, certain processing;
- receive your information in a portable format;
- withdraw consent at any time, where we rely on consent; and
- opt out of marketing emails using the unsubscribe link in any message.
To make a request, email [email protected]. We may need to verify your identity before we respond, and we will reply within the time required by law. If you are a respondent, please contact the business you gave feedback to first. We will support them in responding to your request.
You also have the right to complain to a data protection authority. In Sri Lanka this is the Data Protection Authority of Sri Lanka. If you are in the EU or UK, you can contact your local supervisory authority. We would appreciate the chance to address your concern first.
13Children
Our website and platform are intended for businesses and are not directed at children. CXVoice surveys are not designed to collect information from children under 16. If you believe a child has given us personal information, please contact us and we will delete it.
14Links to other websites
Our website and platform may link to websites and services we do not control, such as Google or a business’s own website. Their privacy practices are governed by their own policies, and we encourage you to read them.
15Changes to this policy
We may update this Privacy Policy from time to time. When we do, we will change the “Last updated” date at the top of this page. If the changes are significant, we will give business customers notice by email or in the platform before they take effect.
16Contact us
If you have any questions about this Privacy Policy or how we handle personal information, please get in touch.