Privacy Policy

Effective date: January 1, 2026 Last updated: January 1, 2026

This Privacy Policy explains how VR Data Experts Inc., doing business as Bixora ("Bixora", "we", "us"), collects, uses, shares and protects personal information in connection with bixora.ai, the Bixora client portal, and our related services (the "Services"). It applies to:

• Visitors to our website;
• Customers and Users — businesses that use the Services and the people who use them on the business's behalf;
• Requesters — people who ask for access or contact us;
• Callers and Leads — people who call a Bixora tracking number or submit a form on a Customer's website.

If you are a Caller or Lead, the business you contacted (our Customer) decides why and how your information is collected. We process it on that business's behalf. Please read Section 8.

1. Who we are

Bixora is operated by VR Data Experts Inc., a company incorporated in Ontario, Canada. For privacy questions or requests, contact marketing@bixora.ai. Our Privacy Officer can be reached at the same address.

2. Information we collect

2.1 Information you give us

• Access requests and contact: name, work email, phone, company, website, industry, advertising spend range, platforms used, lead types, current call tracking, notes, and consent to be contacted.
• Account and profile: login email, password (hashed), name, business details (name, website, phone, industry, service areas, description, ideal customer, goals), team member details, notification preferences.
• Lead criteria: the words and rules you use to describe a real lead, topics to ignore, competitor names, target costs and values.
• Billing: plan, credit purchases, invoices and transaction history. Card details are collected and stored by our payment processor; we receive only a token, card brand and last four digits.
• Support: messages you send us and their content.

2.2 Information from your Connected Accounts (with your authorization)

• Advertising platforms (Google Ads, Meta, Microsoft Advertising): account identifiers, campaign, ad group, ad, keyword and search-term data, performance and spend data, conversion actions and settings, and the status of our partner access.
• Website: when you install our tracking script, we collect visitor session data on your site as described in 2.3.

2.3 Information collected through the Services on Customers' behalf

• Website visitors: page URL, referrer, click identifiers (for example GCLID), campaign parameters, device and browser type, approximate location from IP, timestamps, a first-party cookie or identifier that ties a session to a call or form, and form field values the visitor submits (which may include name, email, phone and message).
• Calls: caller phone number, called number, forward-to number, time, duration, ring and answer status, and — where recording is enabled by the Customer — the audio recording and a transcript.
• Derived information: the grade, reason, quality tier, intent labels, and outcomes assigned to each call or form; attribution to a campaign and keyword.

2.4 Information collected automatically

• Portal and website usage: log data (IP address, browser, device, pages viewed, actions taken, timestamps), diagnostic and error data, and analytics events. See our Cookie Policy.
• Email engagement: whether emails we send are delivered and opened.

2.5 Information from third parties

• AI assistants and search engines: when we check how a Customer's business appears in AI-generated answers, we send business names and questions to third-party AI services and receive their responses. This may incidentally include information about other businesses that appear in those answers.
• Public sources: business information from a Customer's website or public listings, used to set up and improve their account.

We do not knowingly collect information from anyone under 18, and the Services are not directed to them.

3. How we use information

We use personal information to:

• Provide the Services — create and manage accounts; connect ad accounts, websites and phone systems; provision and forward tracking numbers; record and transcribe calls where enabled; attribute calls and forms to advertising; grade calls and forms against the Customer's criteria; send Outcome Signals to the Customer's advertising platforms; run AI-answer visibility checks; generate dashboards, reports, recommendations, campaign and content drafts; and send service emails.
• Support and communicate — answer requests, review access applications, send onboarding, weekly and monthly reports, alerts, invoices and important notices.
• Bill — process payments, manage credits, prevent fraud, collect amounts owed.
• Secure and maintain — authenticate users, detect abuse, debug, monitor performance, back up data.
• Improve — analyze how the Services are used; refine grading, attribution and recommendations; develop new features. Where we use Customer Data to improve grading models or prompts, we do so in a way that does not identify individuals in outputs shown to other customers, and we use aggregated or de-identified data wherever practical.
• Market to businesses — send product news and offers to Customers and Requesters, with an unsubscribe option in every message. We do not sell or rent personal information, and we do not market to Callers or Leads.
• Comply with law — respond to lawful requests, enforce our terms, protect rights and safety.

Automated decision-making. Grades and quality tiers are generated automatically and may affect which leads a Customer follows up first and which outcomes are shared with an advertising platform. These are recommendations to the Customer, who can review, override and flag them. We do not make automated decisions that produce legal or similarly significant effects on individuals.

4. How we share information

We share personal information only as described here.

4.1 Service providers. Companies that process data for us under contract, limited to what they need to provide their service: hosting and database infrastructure, telephony (tracking numbers, call routing and recording), transcription, AI processing (grading, summaries, drafting and AI-answer checks), workflow automation, payment processing, transactional email, website analytics (only with cookie consent), and bot protection on public forms. Each is bound by written data-protection terms. Customers may request details of the providers relevant to their account by emailing marketing@bixora.ai.

4.2 Advertising platforms you connect. At a Customer's direction we send Outcome Signals and related identifiers (such as click IDs and conversion events) to Google, Meta or Microsoft. Their use of that data is governed by their own terms and privacy policies.

4.3 Within a Customer's account. Information about calls and leads is visible to the Customer and the Users it authorizes, including an agency acting for the Customer.

4.4 Legal and safety. To comply with law, subpoenas or lawful requests; to enforce our terms; to protect the rights, property or safety of Bixora, our customers or others; or to investigate fraud or security issues.

4.5 Business transfers. In a merger, acquisition, financing or sale of assets, personal information may be transferred to the successor, who will be bound by this Policy.

4.6 With consent. In any other case, with your consent.

We do not sell personal information, and we do not share it with third parties for their own direct marketing.

5. International transfers

We are based in Canada and store data primarily in the United States. Your information may be processed in Canada, the United States and other countries where our providers operate. Those countries may have different data protection laws. Where required, we use contractual safeguards such as standard contractual clauses and data processing agreements.

6. Retention

We keep personal information for as long as needed for the purposes above and as required by law:

Data	Typical retention
Access requests	24 months from submission, then deleted or anonymized
Account and profile data	For the life of the account, then deleted within 90 days of termination
Call recordings and transcripts	As configured by the Customer, by default 6 months; the Customer may shorten this or request deletion at any time
Call metadata, forms, grades and outcomes	For the life of the account, then deleted within 90 days of termination
Outcome Signal logs	For the life of the account plus 24 months (audit)
Billing records	7 years, as required by tax law
Website analytics	14 months
Backups	Rolled off on our normal backup cycle (up to 35 days)

De-identified or aggregated data may be kept indefinitely.

7. Security

We protect personal information with safeguards appropriate to its sensitivity, including encryption in transit and at rest, role-based access, per-customer data isolation, logging, secret management, and vendor due diligence. Access to recordings and transcripts is limited to the Customer's authorized Users and to Bixora staff who need it for support. No method of transmission or storage is completely secure. If a breach creates a real risk of significant harm, we will notify affected Customers and regulators as required by law.

8. If you called a tracking number or submitted a form

The business you contacted is responsible for the information you provided, including deciding whether calls are recorded. Bixora acts on that business's instructions. If you have questions about how your information is used, or want to access, correct or delete it, contact that business first. If you cannot reach them, contact marketing@bixora.ai and we will forward your request or help as the law requires.

9. Your rights

Depending on where you live, you may have the right to access the personal information we hold about you, to have it corrected, to have it deleted, to withdraw consent, to object to or restrict certain processing, to receive a copy in a portable format, and to complain to a privacy regulator.

• Canada (PIPEDA and provincial laws): you may request access to and correction of your information, and withdraw consent subject to legal and contractual restrictions. You may complain to the Office of the Privacy Commissioner of Canada.
• United States (including California): if applicable, you may have the right to know what we collect, to delete it, to correct it, and not to be discriminated against for exercising these rights. We do not sell or "share" personal information for cross-context behavioural advertising.
• EEA/UK: where GDPR/UK GDPR applies, our lawful bases are contract (providing the Services), legitimate interests (security, improvement, B2B marketing) and consent (cookies, marketing where required). You may lodge a complaint with your local authority.

To exercise a right, email marketing@bixora.ai. We may need to verify your identity. We respond within the time required by law, usually 30 days. If we deny a request, we will explain why.

10. Cookies and similar technologies

See our Cookie Policy for the cookies we use on bixora.ai and how to control them. Our tracking script placed on Customers' websites is described in Section 2.3; Customers are responsible for disclosing it in their own privacy notices.

11. Marketing communications

You can unsubscribe from marketing emails using the link in any message or by emailing marketing@bixora.ai. We will still send service messages needed to operate your account.

12. Changes to this Policy

We may update this Policy. We will post the new version with a new effective date and notify Customers of material changes by email or in the portal. Continued use after the effective date means you accept the updated Policy.

13. Contact

Privacy Officer, VR Data Experts Inc. (Bixora) Email: marketing@bixora.ai Mail: 1440 Sixth Line, Oakville, Ontario L6H 1X7, Canada