Data Deletion Policy

1. Scope and Legal Basis

Nyxara AI Automation ("Nyxara AI", "we", "us") acts as the Data Fiduciary and Data Controller for the personal data described in our Privacy Policy. This policy sets out the binding rules under which we erase that data. It applies to every individual whose personal data we hold, regardless of location, and gives effect to:

• the Digital Personal Data Protection Act, 2023 (India), including the right to erasure and the right to withdraw consent;
• the EU and UK General Data Protection Regulation, Article 17 (right to erasure) and Article 12 (procedure and time limits), for individuals in the EEA and the United Kingdom;
• the California Consumer Privacy Act as amended by the CPRA, for California residents; and
• the deletion obligations imposed on us by the platforms we integrate with, including the Meta Platform Terms.

2. Your Rights

You have the right, at any time and free of charge, to:

• obtain erasure of the personal data we hold about you;
• withdraw any consent you previously gave, with erasure following as a consequence unless Section 6 applies;
• be told, in writing, what was erased, what was retained, and the legal ground for any retention; and
• escalate our decision to a regulator under Section 10 if you are not satisfied.

We will never charge a fee, require you to create an account, ask you to justify your request, or attempt to talk you out of it. We will not treat you differently, degrade any service, or change any price because you exercised this right.

3. Mandatory Identity Verification

Erasure is irreversible, so verification is a strict precondition. We do not act on any request we cannot verify. To be accepted, a request must:

• be sent by email only, from an email address already present in our records for you;
• state the full name, email address(es) and phone number(s) you used when you contacted us; and
• where the sending address is not on record, be accompanied by proof of control of a channel we do hold — for example a reply to a confirmation message we send to the phone number or address in our records.

If we cannot reasonably confirm that the request comes from you, we will refuse it and tell you why, rather than risk erasing another person's records or acting on an impersonation attempt. Where we hold too little data to identify you at all, we will say so; we are not required to acquire additional data purely to enable identification.

A request made on behalf of another person must include written authorisation from that person, or proof of legal authority such as a power of attorney or guardianship order. For a child, the request must come from the parent or lawful guardian.

4. How to Submit a Request

Requests are accepted by email only. Every request is reviewed and carried out by a member of our team. Our automated assistant has no authority to accept, verify, refuse or execute a deletion request, and a message sent to it is not a valid request under this policy.

• Primary address: hello@nyxaraai.com — subject line "Data Deletion Request". This link opens a pre-filled message containing every detail we need.
• Alternate address: nyxaraai.com@gmail.com

5. What We Erase

On a verified request we permanently erase, from live systems and from every copy under our control:

• your name, email address, phone number, company name and website;
• enquiry and lead records submitted through any form on this website;
• transcripts of conversations with our AI assistant and any messaging channel we operate;
• booking, appointment and calendar records created for you;
• marketing and follow-up records, and any profiling or scoring derived from the above; and
• any profile data received from a connected platform, including Meta (Facebook and Instagram).

6. Data We Are Required to Retain

Deletion is not absolute in any jurisdiction. Where the law compels retention, we keep the minimum data necessary, isolate it from active use, and never use it for marketing, profiling, model training or any purpose other than the one that compels its retention. Specifically:

• Accounting records — invoices and books of account, retained for the period required by the Companies Act, 2013.
• Tax records — retained for the period required under the Income-tax Act, 1961 and applicable GST legislation.
• Legal claims — data strictly necessary to establish, exercise or defend a legal claim, retained only while that claim is live or the limitation period runs.
• Statutory or regulatory orders — data we are directed to preserve by a court, regulator or law enforcement authority.
• Suppression records — a minimal record of your email address or phone number, retained solely so that we can honour your erasure and never contact you again. You may ask us to erase this too, but we will then be unable to prevent re-collection.

In every case we will tell you exactly what was retained and the ground relied on, and we erase it as soon as that ground expires.

7. When We May Refuse or Pause a Request

We may refuse a request, or pause it until the obstacle is resolved, only on these grounds. We will always give the reason in writing, together with your route of escalation:

• we cannot verify your identity to the standard in Section 3;
• the request is made by a third party without demonstrated authority;
• a legal obligation in Section 6 requires us to keep the specific data;
• the data is required for a live legal claim involving you; or
• the request is manifestly unfounded or excessive, in particular because it is repetitive — in which case we still respond, explain, and act on any part of it that is valid.

A refusal is never silent, and it never extends beyond the specific data it applies to. Everything outside the scope of the refusal is still erased.

8. Binding Timelines

• Within 7 days — we acknowledge your request in writing and tell you whether anything further is needed to verify you.
• Within 30 days of successful verification — we complete the erasure and send you written confirmation listing what was erased and anything retained under Section 6.
• Extension — where a request is genuinely complex, we may extend once by a further 30 days. We will tell you before the first 30 days expire, and explain why. We will not extend for our own convenience.
• Backups — encrypted backups are purged on their normal rotation and in any event within 90 days. Data in a backup is never restored to live use once erasure has been confirmed.

9. Erasure Is Permanent

Erasure under this policy is final. We cannot recover, reconstruct or reverse it, and any history of your enquiries, conversations, quotes and bookings will be gone. If you have an active engagement with us, erasure will normally end our ability to deliver it. Please retain your own copy of anything you need before you send the request.

10. Grievance Redressal and Escalation

Our Grievance Officer under the Digital Personal Data Protection Act, 2023 is reachable at hello@nyxaraai.com. We respond to grievances within 30 days.

If you remain dissatisfied, you may complain to the Data Protection Board of India; if you are in the EEA or the United Kingdom, to your national supervisory authority or the Information Commissioner's Office; and if you are in California, to the California Privacy Protection Agency. Nothing in this policy limits that right, and we will not ask you to waive it.

11. Changes to This Policy

We may update this policy to reflect changes in law or in our systems. We will not apply a change retroactively to weaken a request already made, and the version in force when you submit your request governs it.