Privacy policy

Effective October 22, 2026 · Last updated October 22, 2026 · Version 2026.10.1

Shlix AI and its product Shlix IBS are provided by Zerobyte Technologies Private Limited (“Shlix”, “we”, “us”), Plot No-318/991/5682, Krishnapuri, Malipada, Bhubaneswar, Khordha, Odisha 751003, India. Shlix IBS is software and back-office support for insurance agencies in the United States. This policy explains what personal information we collect, why, who helps us process it, where, how long we keep it and the choices you have. It covers this website, walkthrough bookings and the Shlix IBS service.

Privacy questions and requests: business@shlixai.io, or the contact form with the topic “Privacy or security”. Our grievance officer under India's Digital Personal Data Protection Act can be reached at the same address.

1. Two different roles

On this website, and when you book a walkthrough or contact us, we decide what is collected and why. We are the business responsible for that information.

In the service, we process information on behalf of the insurance agency that uses Shlix IBS (our customer), only on its instructions, as its service provider under our Data Processing Addendum. The agency decides which mailbox and systems to connect and how its team works, and its own privacy notice applies to its customers. If you are a client of an agency, please contact that agency about your information; we will help it respond.

2. Website visitors

• Visitor statistics: on the public pages we count visits with Vercel Web Analytics: the page, the referring site, the country, and the kind of device and browser, plus anonymous events such as which button was clicked. It sets no cookies and builds no profile of you. The signed-in app is not counted.
• Server logs: our hosting provider keeps standard request logs (such as IP address, browser type and time of request) for a short period to run and protect the site.

3. Contact requests and walkthrough bookings

• The contact form: your name, work email, optional phone number, your industry, your agency or company name, role, size, the systems you use, your monthly request volume, the topic and your message, and documents you attach where the form offers that. Attached files are kept in private storage that only our team can open.
• Where you came from: if you arrived from a link with campaign tags (such as utm_source), we save those tags and the page you first landed on with your request.
• Checks on what you enter: we check that your email's domain can receive mail by looking up its public mail records. No message is sent and nothing is shared to do this.
• Abuse protection: a one-way, keyed hash of your IP address and your browser's user-agent are stored with a request so we can limit repeated submissions. We cannot turn the hash back into the address.
• Walkthrough bookings: our booking button opens Calendly's own website in a new tab. When you book there, Calendly collects your name, email, time zone and any answers you give, and shares them with us; a calendar invitation and Google Meet link are then sent through Google. Calendly's website sets its own cookies, under Calendly's privacy policy. Walkthroughs use invented data only; we never ask for your customers' information to book or attend one.
• Phone numbers: we call only if you gave a number for that. We never use it for marketing calls or texts.

4. Agency data in the service

• Email: each email in the connected mailbox is read in memory to decide whether it is agency work. Email that is clearly personal is dropped there and then: nothing about it is stored, not the body, subject or sender, and it is not shown to the agency's team or to us; only a count is kept. Email the software cannot classify with confidence is shown to the agency owner only, as its sender and subject, so the owner can decide; that entry is deleted once the owner decides. Topics the owner marks as private are dropped unless the email clearly looks like work, in which case the owner decides.
• Agency work: for requests that are agency work, we keep what the work needs: the task, the details taken from the request (such as the insured, the certificate holder and policy references), attachments and text read from them, documents produced, notes, chat on the task and an audit trail of actions.
• Accounts: names, work email addresses and roles of the agency's team members, and records of sign-ins.
• Policy data: customer and policy details the agency provides or that are read from its agency management system to complete requests.
• Voicemail: if the agency turns on the phone channel, voicemails left on its number and the caller's number, to turn them into tasks.
• Support and operations work: where the agency orders Dedicated Operations Support, our staff work in the agency's own systems with access it grants, and see the information the agreed tasks need.

Information an agency holds about its customers is “nonpublic personal information” under the Gramm-Leach-Bliley Act and state insurance privacy and data-security laws. The agency is responsible for those duties; we support them as its service provider through our Data Processing Addendum.

5. How we use information

• To reply to contact requests and, if you asked, to arrange a walkthrough or your onboarding.
• To provide, support and secure the service, and to complete the work the agency asks of Shlix IBS and our staff.
• To keep the website and service secure, prevent abuse and meet legal obligations.
• To improve the service using measurements combined across customers so that no agency or person can be identified (for example, how many requests needed a person). We do not use one agency's data to serve another agency, and we do not use agency data to train AI models (see our AI use policy).
• To send you occasional emails about Shlix only if you are a business contact who asked us to, or after a conversation with you; every such email has an unsubscribe link and our postal address.

We do not sell personal information, and we do not “share” it for cross-context behavioral advertising. We do not use or disclose sensitive personal information for purposes other than those the law permits. We honor Global Privacy Control signals as a request to opt out of sale and sharing, although we do neither.

6. Who helps us

We share personal information only with service providers who process it for us under written contracts, as listed below; with the agency the information belongs to; when the law requires it; to protect our rights or anyone's safety; or with a buyer or successor of our business, which would be bound by this policy.

• Supabase: database, file storage and sign-in (United States (AWS us-east-1)).
• Vercel: website and application hosting; cookieless visitor statistics on the public pages (Global edge network; application functions in the United States).
• Anthropic: aI model provider: reading and classifying requests, through its commercial API (United States).
• Resend: sends the agency's replies and notifications by email, when the agency's mailbox cannot send them itself (United States).
• Groq: aI model provider used for demonstrations on sample data only (United States).
• Cloudflare: dNS and mail routing; Turnstile bot check on the sign-in page, when enabled (Global).
• Web3Forms: delivers website contact requests to our team's inbox (As set out in the provider's terms).
• Calendly: the booking calendar for walkthroughs on the website (United States).
• Google: calendar invitations and Google Meet for walkthroughs and support calls (United States and Google's other data center locations).

The full list, with the data each one handles, is on our sub-processor page. We tell agencies using the service before adding a provider that handles agency data. Systems an agency connects under its own contracts (Microsoft 365; The agency's management system; Twilio) are the agency's providers, not ours.

7. Where information is held and accessed (United States and India)

Agency data and website contact requests are stored in the United States. Zerobyte Technologies Private Limited is an Indian company, and our engineering, support and operations team works from India. When they need to look at information to provide support, carry out operations work an agency has ordered, or keep the service running, they access it remotely from India, under written confidentiality obligations and with access limited to what the task needs. We protect information the same way wherever it is accessed.

8. How long we keep information

• Contact requests, and any documents attached to them: up to 24 months after our last conversation, then deleted by a scheduled job.
• Walkthrough bookings: in Calendly and our calendar for as long as needed to hold the meeting and follow up, then on the same 24-month basis.
• Agency data: for as long as the agency uses Shlix IBS. When the agency leaves, we return it on request and delete it within 90 days, except where the law requires us to keep it longer. Backups held by our database provider expire on its own schedule.
• Clearly personal email in a connected mailbox: never stored. Uncertain email shown to the owner: deleted once the owner decides.
• Records of privacy requests: kept as our record of how we answered, holding a keyed hash of the requester's email rather than the address.

9. Security and incidents

Each agency's data is isolated in the database with row-level security, traffic is encrypted, data is encrypted at rest, credentials for connected systems are encrypted before storage, access is limited by role, and actions are recorded in an append-only audit trail. If we confirm a security incident affecting an agency's data, we tell the agency within 48 hours so it can meet its own notification duties. No system is perfectly secure; read what is in place and what is still planned on our security page and in the trust center.

10. Cookies and similar technologies

This website sets no advertising, retargeting or analytics cookies, so there is no cookie banner. Our visitor statistics are cookieless. The site may remember small choices in your browser's storage, such as dismissing the announcement bar. The signed-in app uses only the cookies needed to keep you signed in, and the bot check on the sign-in page may set a cookie that is strictly necessary for it to work. Booking a walkthrough takes you to Calendly's website in a new tab, which sets its own cookies; you can book by email instead through the contact form. If we ever add analytics or marketing cookies of our own, we will ask for your consent first.

11. Categories of personal information (for California and similar state laws)

In the last 12 months, as a business (not as an agency's service provider), we collected: identifiers (name, email, phone number, a hashed IP address); professional information (agency, role, size, systems used); internet activity on our site (pages visited, referrer, device type, without cookies); and the content of messages you send us. We collected them from you, your browser and Calendly, for the purposes in section 5, and disclosed them only to the providers in section 6 for business purposes. We have not sold or shared personal information, and we do not knowingly collect information of anyone under 16.

12. Your rights

United States. Depending on where you live, for example California (CCPA as amended by the CPRA), Colorado, Connecticut, Texas, Virginia, Oregon and other states with comprehensive privacy laws, you may have the right to know what personal information we hold about you, to get a copy, to correct it, to delete it, and to opt out of sale, sharing, targeted advertising or profiling (we do none of these). You may use an authorized agent. We will not discriminate against you for using your rights.

India. Under the Digital Personal Data Protection Act, 2023, you may ask for a summary of the personal data we process and who we have shared it with, its correction, completion, updating or erasure, withdraw consent where we rely on it, nominate someone to act for you, and raise a grievance with us. If you are not satisfied with our answer, you may complain to the Data Protection Board of India.

How to ask. Write to business@shlixai.io or use the contact form. We will confirm your identity using the details we already hold, acknowledge your request within 10 business days, and reply within 45 days (we may extend that once by up to 45 days where the law allows, and will tell you why). If we decline a request, you may appeal by replying to our decision; we will answer the appeal within 60 days, and if you are still not satisfied you may contact your state attorney general. For information an agency holds about you as its customer, contact the agency, and we will help it respond.

13. Children

Shlix AI is a business service for insurance agencies. It is not directed to children, and we do not knowingly collect information about anyone under 16. If you believe we have, tell us and we will delete it.

14. Changes

If we change this policy in a way that matters, we will update the dates at the top and tell agencies using the service at least 30 days before the change takes effect.

15. Contact

Zerobyte Technologies Private Limited, Plot No-318/991/5682, Krishnapuri, Malipada, Bhubaneswar, Khordha, Odisha 751003, India. Email business@shlixai.io, or use the contact form.