CognitiveUX AI

    Privacy Policy

    Last updated: October 1, 2026

    Digi Performance Technologies Private Limited ("we", "us", or "our") operates CognitiveUX.ai (the "Service"), an AI-powered marketing personalization and automation platform. This Privacy Policy explains how we collect, use, and protect your information when you use the Service.

    Information We Collect

    We value your privacy and are committed to protecting the confidentiality and security of your information. Here is what we collect when you use CognitiveUX.ai:

    Account Information

    When you create a CognitiveUX.ai account, we collect your name, email address, and profile photo URL (if made available by your authentication provider). This information lets us personalize your experience and enable core features of the Service.

    Integrations

    As you connect your marketing platforms to CognitiveUX.ai, we collect information about the platforms you connect and their associated data. This is necessary to power accurate analytics, reports, personalization, and workflow automation. For data collected through Google APIs, we adhere to Google's API Services User Data Policy, including its Limited Use requirements — see the Google API Services section below.

    Usage Information

    To understand how you interact with the Service and to improve your experience, we collect usage information, including log data, device information, and activity within the Service.

    Execution Logs

    We temporarily store execution logs — records of operations run through workflows, MCP servers, and AI agents, including operation inputs and outputs (large outputs are stored as truncated summaries). These logs are available in your account for a period of 7-30 days depending on your subscription plan. Execution logs are separate from synced data: synced advertising data and content synced from Slack, Gmail and Google Drive are stored as described in "Google Ads" and "Connected Workspace Apps" below.

    AI Agent Conversation History

    If you use AI agent features, we store conversation history so agents can use it as context to continue conversations, and so you can review past interactions. You can delete this history at any time. This data is not used to develop, improve, or train generalized AI/ML models.

    Payment Information

    If you subscribe to a paid plan, we collect billing information such as your billing address. Your payment card details are handled securely by our PCI-compliant third-party payment processor and are never stored on our own servers.

    How We Use Your Information

    • Provide, maintain, and improve the Service: deliver the workflows and features you request, maintain your account, and continuously enhance your experience, including optimizing workflow performance and reliability.
    • Respond to your requests: address customer service inquiries, provide technical support, and resolve account-related issues.
    • Communicate with you: send service updates, product announcements, relevant educational content, and promotional materials (with your consent).
    • Analyze and monitor usage: understand how users interact with the platform, track performance, and make data-driven improvements.
    • Ensure security and compliance: protect against fraud, maintain platform security, comply with legal obligations, and prevent unauthorized access.

    Authentication and Authorized Data Access

    When you connect a third-party account (such as Google, Meta, Slack, or another supported platform), we access your basic profile information (email, name, profile photo URL) along with the specific data permitted by the OAuth scopes you approve during authorization — for example, advertising performance or analytics data.

    We store integration tokens (such as OAuth access and refresh tokens) in encrypted form on our cloud infrastructure. These tokens are used solely to maintain your authorized connections and can be deleted at any time by disconnecting the integration from your dashboard or requesting deletion.

    We do not access your Customer Data unless required for support (at your request), security purposes, or legal compliance.

    Revoking Third-Party Access

    • Google: manage app permissions at https://myaccount.google.com/permissions
    • Slack: click Sign Out on "5. Integrate Slack" in Settings → Integrations; this revokes the app's bot token with Slack and deletes it from our database.
    • Meta (Facebook, Instagram, Threads): manage business integrations in your Facebook settings under Business Integrations, or in Accounts Center under Connected Experiences.
    • Other connected platforms: you can revoke access through the respective platform's own settings, or disconnect any integration directly from your CognitiveUX.ai dashboard at any time.

    Google API Services User Data Policy

    CognitiveUX.ai's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

    When you connect Google services to CognitiveUX.ai, we request only the permissions needed to power your workflows and reporting: Google Ads, Gmail (read-only) and Google Drive (read-only). Google Ads access is described in "Google Ads" below. Gmail and Google Drive are accessed with read-only scopes only, as described in "Connected Workspace Apps" below.

    You control which Google services you connect. Google API data is used only to provide the features you configure and is not used to develop, improve, or train generalized AI/ML models. We do not allow third parties to use Google API data for their own purposes.

    Limited Use of Google User Data

    Google user data we receive through Google APIs, including Google Ads, Gmail and Google Drive data:

    • is used only to provide the user-facing features described in this policy and on our integration pages;
    • is not sold;
    • is not used for advertising;
    • is not transferred to others, except as needed to provide those features, for security purposes, or to comply with applicable law;
    • is not read by humans, except with your consent, for security purposes, or to comply with applicable law.

    Google Ads

    • What we access: the Google OAuth scope https://www.googleapis.com/auth/adwords.
    • What we read: campaign, ad group, ad, keyword, search term, asset, audience and conversion data and performance metrics.
    • What we change: CognitiveUX.ai makes changes to the ad account only when the user approves them.
    • Why: so your own AI agents, workflows and reports can analyse, audit and manage your advertising.
    • What we store and in what form: report data is copied daily into our data warehouse, separated per account and workspace. The last 90 days of history are copied once when a source is first set up.
    • Retention: stored report data is kept until you delete the data source, workspace or account, or request deletion as described under "Data Deletion" below.
    • How to disconnect: click Sign Out on the Google Ads tile in Settings → Integrations, or remove our app's access at https://myaccount.google.com/permissions (this also disconnects Gmail and Google Drive).

    Connected Workspace Apps: Slack, Gmail and Google Drive

    You can connect Slack, Gmail and Google Drive to your CognitiveUX.ai account so that your own AI agents and workflows can use content from them as context for your marketing analysis. Connections are made per account in the CognitiveUX AI dashboard (shown as Almond) under Settings → Integrations. What each workspace uses is chosen in Workspace Settings → Preferences → Integrations. Only an account manager can change these settings, and nothing is read from a connected app until that source is switched on for a workspace and the settings are saved.

    Slack

    • What we access: the CognitiveUX.ai app is installed in your Slack workspace as a bot through Slack's OAuth flow, with these scopes: channels:read and groups:read, to list channels so an account manager can choose them; channels:history and groups:history, to read messages and thread replies in the chosen channels only; and users:read, to show member display names instead of user IDs. Private channels can be read only after the bot has been invited to them.
    • What we read: channel names and IDs; messages and thread replies in the chosen channels; member display names; and the Slack workspace name and ID. Thread replies are included and bot messages are ignored by default; both can be changed per workspace. The app does not post to Slack, has no slash commands, does not read direct messages, and does not process events in real time.
    • Why: so your own AI agents and workflows can use your team's conversations in those channels as context for your marketing analysis.
    • What we store and in what form: one PDF per channel per day, plus a text (Markdown) copy.
    • How to disconnect: click Sign Out on "5. Integrate Slack" in Settings → Integrations. This revokes the bot token with Slack and deletes it from our database.

    Gmail

    • What we access: the Google OAuth scope https://www.googleapis.com/auth/gmail.readonly. Access is read-only; CognitiveUX.ai never sends, changes or deletes email.
    • What we read: only emails that match the filters set for the workspace (sender address or domain, recipient, words in the subject or body, excluded words, labels, with or without attachments, and newer than a set number of days). For those emails we read the headers, the body and their attachments.
    • Why: so your own AI agents and workflows can use the emails you select as context for your marketing analysis.
    • What we store and in what form: one PDF per day of matching emails, plus a text copy. Attachments are kept as separate files in their own format.
    • How to disconnect: click Sign Out on "4. Integrate Gmail" in Settings → Integrations. See "Revoking Google access" below.

    Google Drive

    • What we access: the Google OAuth scope https://www.googleapis.com/auth/drive.readonly. Access is read-only; CognitiveUX.ai never creates, changes or deletes files.
    • What we read: only files that match the filters set for the workspace (name contains or excludes, folders and optionally their subfolders, file type, owner, modified or created in the last set number of days, and whether to include files shared with you). Supported types are Google Docs, Sheets and Slides, PDF, Word, Excel, PowerPoint, CSV, plain text and images. Files over 50 MB are skipped.
    • Why: so your own AI agents and workflows can use the files you select as context for your marketing analysis.
    • What we store and in what form: a copy of each file in its own format (Google Docs, Sheets and Slides are exported as Word, Excel and PowerPoint), plus a text copy.
    • How to disconnect: click Sign Out on "3. Integrate Google Drive" in Settings → Integrations. See "Revoking Google access" below.

    Sync, Storage, Retention and Deletion

    • Sync: content is copied on the schedule each workspace sets, or when someone clicks "Sync now". When a source is first switched on, past content is copied once: the filter's own time window if it has one, otherwise the last 90 days.
    • Storage: copies are stored in private cloud storage, separated per account and workspace. OAuth tokens are stored server-side and are never sent to the browser.
    • Retention: each copy is deleted after a set number of days, counted from when it was copied. The default is 90 days, and it can be set per workspace from 1 to 3650 days under Workspace Settings → Preferences → Integrations → Data Retention. Information already added to the workspace's memory may be retained after the original file is deleted.
    • Disconnecting: signing out stops further reading. Copies already stored remain until the retention period ends or you ask us to delete them.
    • Deleting a workspace deletes its synced copies.
    • Deletion on request: to have stored copies deleted sooner, contact us at [email protected] with the subject line "Data Deletion Request", as described under "Data Deletion" below.
    • AI processing: when one of your agents uses this content, it is sent to the AI model provider that runs the agent, solely to produce results for you. See "AI Features" below.

    Revoking Google Access

    Gmail and Google Drive share one Google sign-in with our Google Ads connection. Signing out of Gmail or Google Drive deletes the token we store but does not revoke the Google grant, because revoking it would also disconnect Google Ads. To revoke access fully, remove our app's access at https://myaccount.google.com/permissions (this also disconnects Google Ads).

    Third-Party Integrations and Data Sharing

    Data Processing and Access

    We access and process data from your connected applications during workflow execution, authorized automation tasks, and when generating requested analytics and reports. Synced advertising data is stored and retained as described in "Google Ads" above, and content synced from Slack, Gmail and Google Drive is stored and retained as described in "Connected Workspace Apps" above (90 days by default). Execution logs are retained for a limited period based on your plan (7-30 days), with security and fraud-prevention logs retained for up to 90 days before permanent deletion where necessary to protect the Service.

    Integration Permissions and Security

    When connecting a third-party application, you will see a clear list of required permissions before authorization. You control which applications to connect and can revoke access at any time through your dashboard. All data transfers are protected using industry-standard encryption and OAuth 2.0 authentication where available. We never share access tokens between different user accounts.

    Data Flow Between Integrations

    • Cross-integration data flow: data moves between services only when required by the workflow steps you configure — you control which fields and outputs pass between steps.
    • Data exchange during execution: data is passed between integrations only while a workflow runs, and is recorded in execution logs as described above. Synced advertising data and content synced from Slack, Gmail and Google Drive are stored as described in "Google Ads" and "Connected Workspace Apps" above.
    • User-controlled sharing: nothing is shared automatically or by default — you explicitly configure what data flows from one step to another.
    • Secure transfer: all data transfers occur over encrypted channels and use OAuth 2.0 where applicable.

    AI Features

    CognitiveUX.ai includes optional AI-powered steps that users can add to workflows — for example, summarizing results, generating personalization content, or transforming workflow outputs. AI steps only run when explicitly added and configured by the user.

    CognitiveUX.ai does not use customer data to develop, improve, or train generalized AI/ML models. AI requests are processed only to generate the requested output. We do not permanently store customer data sent to AI services beyond execution logs and (where applicable) AI agent conversation history, both described above. Users can disable AI features at any time by removing AI steps from workflows.

    Content from Slack, Gmail and Google Drive is not used to develop, improve, or train generalized AI/ML models. It may be processed by AI model providers solely to produce results for the customer who connected it.

    User Consent and Agreement

    When registering for CognitiveUX.ai, you must actively acknowledge your understanding of how we collect and process your information, how we share data with integration partners, our privacy and security practices, and your rights and obligations under our Terms of Use.

    Your Opt-Out Options

    • Integration control: choose which third-party platforms to connect, and disconnect any integration at any time through your dashboard.
    • AI features: optional — remove AI steps from workflows or avoid AI agent features entirely.
    • Marketing communications: opt out at any time via the unsubscribe link or your account settings.
    • Cookies and tracking: manage preferences through the cookie banner or your browser settings.
    • Account closure: delete your account directly from Settings; deletion permanently removes your account and associated data (subject to legal retention requirements).

    Information Sharing and Disclosure

    We may share your information with third parties in specific circumstances necessary to operate CognitiveUX.ai securely and effectively:

    • Service providers: we work with cloud infrastructure, payment processing, email delivery, analytics, and AI providers who are contractually obligated to protect your information and use it only to provide services to us.
    • AI data sharing: when you use AI features, the data required for that step may be sent to the selected AI provider; AI steps run only when explicitly configured, and we do not use customer data to train generalized AI/ML models.
    • Compliance with law: we may share information in response to valid legal requests, court orders, or to protect against fraud or illegal activity.
    • Business transfers: if Digi Performance Technologies Private Limited is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction, with notice provided to you.
    • Your consent: we share information with third parties when you have given explicit consent, which you may revoke at any time.

    We do not sell, rent, or trade your personal information to third parties for monetary or other valuable consideration, and we do not share personal information for cross-context behavioral advertising.

    Government and Public Authority Requests

    We do not voluntarily provide Customer Personal Data to any government, law enforcement, or public authority. If we receive a legally binding request, we will review it for validity, seek to redirect the requesting authority to the customer where appropriate, notify the affected customer as soon as legally permitted, challenge requests we believe are unlawful or overbroad, and disclose only the minimum data legally required.

    Tracking Technologies

    Essential cookies are required for the Service to function (such as login sessions and security). Non-essential cookies (analytics and marketing) are used only where permitted by law or with your consent.

    • Essential cookies: required for login, session management, security, and preferences.
    • Analytics cookies: used to understand engagement and site performance; you can opt out using standard browser or analytics opt-out tools.
    • Marketing cookies and pixels: used, with consent where required, to measure campaign effectiveness and optimize content delivery.
    • Log files: our servers automatically collect IP addresses, browser type, ISP, timestamps, and page references to maintain security and improve performance.
    • Local storage: used to improve load times, store workflow configurations, and maintain preferences.

    Your Privacy Controls and Data Security

    Data Retention

    • General data: retained only as long as necessary to provide the Service and fulfil the purposes described in this policy; once no longer needed, data is securely deleted or de-identified.
    • Execution logs: available in your account according to your subscription plan (7-30 days).
    • Synced Google Ads report data: kept until you delete the data source, workspace or account, or request deletion. See "Google Ads" above.
    • Content synced from Slack, Gmail and Google Drive: deleted 90 days after it was copied by default; each workspace can set this from 1 to 3650 days. Information already added to a workspace's memory may be retained after the original file is deleted. See "Connected Workspace Apps" above.
    • Account data: retained while your account is active; removed according to our deletion schedule upon account deletion.

    Data Deletion

    You can delete your CognitiveUX.ai account and associated data at any time from your account Settings, provided you do not have an active subscription (cancel first). If you need assistance, contact us at [email protected] with the subject line "Data Deletion Request," and we will delete or anonymize your data within a reasonable timeframe, typically within 30 days.

    Security Measures

    We use industry-standard encryption and security protocols during transmission and storage, employ multiple layers of security controls, and regularly review our practices. No method of internet transmission or electronic storage is completely secure.

    Children's Privacy

    CognitiveUX.ai is not directed to children under 18, and we do not knowingly collect personal information from children.

    Your Rights

    Depending on your location, you may have the following rights regarding your personal data:

    For All Users

    • Right to Access — request a copy of the personal data we hold about you
    • Right to Rectification — request correction of inaccurate or incomplete data
    • Right to Deletion — request deletion of your personal data
    • Right to Data Portability — request an export of your data in a portable format
    • Right to Object — object to certain types of processing
    • Right to Restrict Processing — request that we limit how we use your data

    For Users in India (Digital Personal Data Protection Act, 2023)

    As an Indian entity, Digi Performance Technologies Private Limited processes personal data in accordance with India's Digital Personal Data Protection Act, 2023 ("DPDP Act"). Where you are a Data Principal under the DPDP Act, you have the right to:

    • Obtain a summary of the personal data we process about you and the processing activities undertaken
    • Request correction, completion, updating, or erasure of your personal data
    • Nominate another individual to exercise your rights in the event of death or incapacity
    • Withdraw consent at any time, as easily as it was given, without affecting the lawfulness of processing carried out before withdrawal
    • Raise a grievance with our designated grievance contact, and, if unresolved, escalate the matter to the Data Protection Board of India

    We process personal data under the DPDP Act on the basis of your consent, or where otherwise permitted for a "legitimate use" recognized under the Act (such as providing a service you have requested). We will notify you of the purpose and categories of personal data processed at or before the point of collection, in plain language, as required by the Act.

    For California Residents (CCPA/CPRA)

    • Right to Know — request details about the categories and specific pieces of personal information we collect
    • Right to Delete — request deletion of your personal information
    • Right to Opt-Out of Sale — we do not sell your personal information as defined under the CCPA
    • Right to Non-Discrimination — we will not discriminate against you for exercising your privacy rights

    For EEA/UK Residents

    If you are located in the European Economic Area or the United Kingdom, you have the right to lodge a complaint with your local data protection supervisory authority if you believe we have not handled your personal data in accordance with applicable law.

    To exercise any of these rights, contact us at [email protected]. We will respond within the timeframe required by applicable law.

    Data Processing Agreement

    A Data Processing Agreement (DPA) covering our processing of personal data on your behalf is available on request, and is incorporated by reference into our Terms of Use for customers on custom or enterprise plans. Contact [email protected] to request a copy.

    Legal Basis for Processing (EEA/UK Users)

    If you are located in the EEA or UK, we process your personal data based on the following legal grounds: (1) Contract — processing necessary to provide the Service you requested; (2) Legitimate Interests — including security, fraud prevention, and product improvement; (3) Consent — for marketing communications and non-essential cookies, which you may withdraw at any time; and (4) Legal Obligation — where required to comply with applicable law.

    International Data Transfers

    CognitiveUX.ai's infrastructure is hosted on servers located in the United States and India. Where personal data originating from the EEA, UK, Switzerland, or other jurisdictions with cross-border transfer restrictions is transferred to these locations, we rely on appropriate safeguards, which may include Standard Contractual Clauses or equivalent transfer mechanisms, as described in our Data Processing Agreement. We limit administrative access to authorized personnel through role-based access controls, least-privilege permissions, confidentiality obligations, and logging and monitoring where reasonably available.

    Data Breach Notification

    In the event of a data breach affecting your personal information, we will notify relevant supervisory or regulatory authorities within the timeframe required by applicable law (including, where the DPDP Act applies, notification to the Data Protection Board of India and affected Data Principals as prescribed), notify affected users without undue delay where required, provide details about the nature of the breach and the data affected, and offer guidance on protective steps you can take.

    App Specific Details

    Google Sheets Add-On

    What data are we requesting and why?

    We are requesting access to your google spreadsheets in order to allow you storing imported analytics data in your spreadsheet and create reports. When you install our Google Sheets Add-On we receive your email from Google Apps Script and use it to provide you support and send notifications. When you install our Google Sheets Add-On we receive your Google Sheet information, such as sheet url, which we use to import your analytics data into. You can uninstall our Add-On and all your information will be deleted. You can speedup this process by contacting us directly using this website.

    How do we collect this information?

    Through sign up forms at our website, after installation of any of our add-ons, through google analytics.

    Why do we store such information?

    We store this information in order to process your order, provide product download access, support services, manage your account, send information via newsletters, and post offers of other services or products we offer.

    What do we use your information for?

    Any of the information we collect from you may be used in one of the following ways:

    • To personalize your experience (your information helps us to better respond to your individual needs)
    • To improve our website (we continually strive to improve our website offerings based on the information and feedback we receive from you)
    • To improve customer service (your information helps us to more effectively respond to your customer service requests and support needs)
    • To process transactions. Your information, whether public or private, will not be sold, exchanged, transferred, or given to any other company for any reason whatsoever, without your consent, other than for the express purpose of delivering the purchased product or service requested.
    • To administer a contest, promotion, survey or other site feature
    • To send periodic emails. The email address you provide for order processing, may be used to send you information and updates pertaining to your order, in addition to receiving occasional company news, updates, related product or service information, etc.

    Note: If at any time you would like to unsubscribe from receiving future emails, we include detailed unsubscribe instructions at the bottom of each email.

    Who do we share your information with?

    We use Google Analytics to understand how our website or our Add-Ons are used. We DO NOT share information with any other external marketing sources.

    How can you request data deletion?

    Once you uninstall our app or you sign out of the app, our app can no longer access your account and data. All the earlier logs get automatically deleted from our system after 30 days. If you want to confirm data deletion or if you want data deletion to happen sooner, you can write to us at [email protected]. We will respond and action your request

    Privacy Policy Updates

    We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or by posting a notice on our website prior to the change becoming effective.

    Governing Law and Jurisdiction

    This Privacy Policy is governed by and construed in accordance with the laws of India. Any disputes arising from or relating to this Privacy Policy shall be subject to the exclusive jurisdiction of the courts of Bangalore, Karnataka, India, unless otherwise required by applicable local law (such as the GDPR for EU residents or the DPDP Act for matters properly before the Data Protection Board of India).

    Contact Us

    For questions about this Privacy Policy or our data practices, please contact us at [email protected].