This Privacy Policy explains how Coexa (“Coexa”, “we”, “us”), operated by Tecnoglare Infotech, collects, uses, stores, and protects information in connection with the Coexa mobile application, the Coexa web console, and related backend services (together, the “Service”). It applies to everyone who creates a Coexa account and uses the Service.
Coexa is a lead-capture and follow-up tool for trade-show and B2B sales professionals. By using the Service, you agree to the practices described in this policy.
1. Who we are
The Service is operated by Tecnoglare Infotech under the Coexa name. For any privacy question or request, contact us at info@tecnoglare.com.
2. Information we collect
Account information
You sign in with Google or with a one-time code sent to your email address. With Google, we receive your Google account’s email address, name, profile photo, and Google account identifier; with an email code, we receive the email address you enter. We use these to create and secure your account and to keep you signed in. We never receive or store your Google password.
Profile information
Details you add to your profile — such as your name, company, title, phone number, and email signature — so that the messages you send reflect you.
Lead information you capture
The core purpose of Coexa is to help you capture and follow up with the people you meet. When you use the Service you may provide information about them, including:
- Names, company names, job titles, email addresses, and phone numbers;
- Photographs of business cards you scan;
- Voice notes you record about a conversation, and their transcripts;
- Notes, lead details, stages, and the messages you draft or send.
If you choose a contact from your phone’s address book, only the one contact you pick is read. Coexa does not read or upload your address book.
Mail settings
If you set up your own mail server (SMTP) to send from your own address, we store the server details, your username and your mail password. The password is encrypted before it is stored, is used only to send the mail you ask Coexa to send, and is never shown again — not to you, not to your company, and not to our staff.
Purchase information
Credit packs are bought through Google Play Billing (and the Apple App Store where the app is offered there), which handles the payment. Coexa verifies each purchase with the store and keeps the product and order references, credit pack, amount, currency, purchase time and refund status, for delivery, accounting, tax and fraud prevention. We never receive your full payment-card number.
Device and technical information
When the app or your browser talks to our servers, our infrastructure records basic technical data such as IP address and request logs, for security, debugging and abuse prevention. These logs are kept for a short period. The optional fingerprint or face app lock is handled entirely by your phone’s operating system: Coexa never receives or stores biometric data.
3. How AI is used
To read business cards, transcribe and summarise voice notes, and draft suggested messages, Coexa sends the relevant image, audio or text to the Google Gemini API, which processes it on our behalf as a service provider. Only the content needed for that task is sent, from our server — never your sign-in details or passwords. We do not use your data to train AI models.
4. Google API Services — Limited Use
If you connect Gmail, Coexa asks Google only for permission to send email as you (the Gmail “send” scope). Coexa does not read your mailbox or your replies. Coexa’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Gmail data for advertising, we do not sell it, and we do not allow humans to read it except where required for security, to comply with the law, or with your explicit consent.
5. How we use information
- To operate, maintain, secure and improve the Service;
- To provide the AI features (card reading, transcription, summaries, message drafting);
- To send the emails you initiate and run the follow-up plans you set up;
- To deliver the credits you buy and keep the accounting and tax records the law requires;
- To respond to support requests and send the notifications you ask for;
- To detect, prevent and address fraud, abuse and security issues.
We do not show advertising and do not use your data for advertising.
6. How we share information
We do not sell your personal information or your leads. We share information only as needed to run the Service:
- Service providers that process data on our behalf: Google (sign-in, the Gemini API, Gmail sending, Google Play Billing), our cloud file storage provider (for card images and documents you upload), and our email delivery provider (when Coexa sends an email on your behalf or sends you a notification);
- Recipients you choose — when you send an email or open WhatsApp to a lead, that content goes to the recipient you selected;
- Your own integrations — if you configure the outbound API or webhooks to push leads to your CRM, that data goes where you direct it;
- Your company workspace — see “Workspaces and teams” below.
We may also disclose information if required by law, to respond to legal process, to enforce our terms, or to protect the rights, property or safety of Coexa, our users or the public.
7. Workspaces and teams
Every account has a personal workspace. Contacts you capture there are yours alone: no company you join, and none of its admins, can see them.
You can also create or join company workspaces. Contacts captured in a company workspace belong to that company. Depending on the roles and permissions the company sets, its admins and team members may see, export, reassign or message those contacts. If you leave a company, or it removes you, the contacts you captured there stay with the company.
Coexa support staff can open an account only to help with a support request or to keep the Service secure; that access is limited to authorised staff and recorded.
8. Storage, security, and retention
Account and lead data is stored in a PostgreSQL database on servers we operate; files you upload (business-card images, documents, company logos) are kept in cloud object storage; card images and documents are served only through short-lived links after your access has been checked. All communication with the Service uses HTTPS/TLS. Mail passwords are encrypted at rest. Sessions use signed tokens that expire after 30 days and end immediately on sign-out from all devices.
We keep your data for as long as your account is open. When you delete your account:
- Immediately — your account is closed, you are signed out on every device, and nobody can sign in to it again.
- Within 30 days — your profile, sign-in addresses, connected mailboxes and Gmail access, and everything in your personal workspace (contacts, notes, voice notes and transcripts, card images, documents, messages and follow-up plans) are permanently deleted. Your account record is reduced to an anonymous placeholder.
- Kept with the company — contacts you captured in a company workspace belong to that company and remain available to it.
- Kept as the law requires — purchase, invoice and tax records are retained for as long as tax and accounting law requires (up to 8 years in India), then deleted.
- Backups — copies in our backups are overwritten in the normal backup cycle, within 30 days.
The 30 days give you a short window to change your mind: email us within that time and we can usually restore the account. If you want deletion straight away, say so in your request.
9. Your rights
Depending on where you live — including under India’s Digital Personal Data Protection Act, 2023 and the EU/UK General Data Protection Regulation (GDPR) — you may have rights over your personal data, including the right to:
- Access the personal data we hold about you;
- Correct inaccurate or incomplete data;
- Erase your data;
- Restrict or object to certain processing;
- Port your data to another service (you can export your contacts to CSV from the app at any time);
- Withdraw consent at any time; and
- Complain to your local data-protection authority.
To delete your account: in the app, go to Settings → Delete account. Without the app, email info@tecnoglare.com from the email address you sign in with, or follow the steps on our account deletion page. What is deleted and when is set out in section 8.
For any other request, email info@tecnoglare.com from your sign-in address; we confirm requests with that address before acting on them, and respond within 30 days.
Because the leads you capture are data you control, requests from those individuals should generally be directed to you (or to your company); we will help you respond as your processor.
10. International transfers
Your information may be processed in countries other than your own — for example by Google’s API infrastructure or our cloud storage provider. Where the law requires it, we rely on appropriate safeguards for such transfers.
11. Children
The Service is intended for business use by adults and is not directed to anyone under the age of 18. We do not knowingly collect personal data from children.
12. Changes to this policy
We may update this policy from time to time. When we do, we will revise the “Last updated” date above, and significant changes will be communicated in the app. Your continued use of the Service after a change means you accept the updated policy.
13. Contact us
Questions about this policy or your data? Email info@tecnoglare.com.