Privacy Policy

This Privacy Policy applies to MadAI, an AI-powered business communication platform developed and operated by MadHawks (hereinafter referred to as "we," "us," or "our"). MadAI is available at madai.madhawks.com.

By using MadAI — whether as a business client deploying the widget or as an end user interacting with it — you agree to the collection and use of information as described in this policy.

We collect the following categories of information:

Data collected through MadAI is used exclusively for the following purposes:

• Generating AI-powered responses to user queries in real time
• Routing conversations to the appropriate AI agent (sales, support, or operations)
• Providing the business client with analytics and intelligence dashboards
• Sending automated lead notifications and support ticket alerts to the business client
• Improving knowledge base accuracy and AI response quality over time
• Complying with legal obligations and responding to verified data deletion requests

We do not use your data for advertising, profiling, or sale to third parties. Ever.

All data is stored in a PostgreSQL database hosted on Railway, a SOC 2-compliant infrastructure provider. Data is encrypted at rest and in transit using industry-standard TLS/SSL protocols.

We do not store raw social media credentials. Platform access tokens provided by business clients are stored in our database solely to enable API communication with the connected platform.

We implement role-based access controls, and all dashboard access requires authentication via Clerk.

We share data only in the following limited circumstances:

• Anthropic (Claude API): Conversation content is sent to Anthropic's API solely for AI response generation. Anthropic's data handling is governed by their own privacy policy.
• Resend: Email addresses are used to send transactional emails (lead notifications, deletion confirmations) via Resend's API.
• Voyage AI: Text content of knowledge base documents is sent to Voyage AI for vector embedding generation.
• Railway: Hosts the MadAI application and its PostgreSQL database, where messages and connection tokens are stored.
• Upstash: Short-lived rate-limit counters keyed by sender or visitor identifiers, used to block spam and abuse.
• Sentry: Error reports used to keep the service running; request bodies, cookies and headers are stripped before sending.
• Clerk: Sign-in for business users of the dashboard (not their customers).
• Legal requirement: We may disclose data if required to do so by applicable law or valid legal process.

Requests from public authorities. Any request from a government or public authority for personal data is reviewed for legality before we act on it; we challenge requests that appear unlawful or overbroad; we disclose only the minimum data the request lawfully requires; and we keep a record of each request, our response and the legal basis. Where the law allows, we notify the affected business first.

We do not sell, rent, or trade your personal data to any third party for commercial purposes.

Conversation data and leads are retained as long as the business client's account is active. Upon account termination or a verified deletion request, personal data is deleted within 30 days. Anonymised aggregate metrics may be retained for up to 1 year.

When a merchant installs MadAI from the Shopify App Store, the merchant is the controller of their store’s and customers’ data and MadHawks processes it on their behalf. MadAI’s access is read-only: it never changes a store.

• Products and inventory: a copy of product names, prices, variants, stock and images, refreshed daily, so the assistant can recommend products.
• Store policies and help pages: the text of published policies and help pages (shipping, returns, FAQ), so the assistant can answer from them.
• Orders: looked up live when a shopper asks about an order, only after they give the order number and the email used at checkout. Order details are not stored; addresses, phone numbers and payment details are never shown in the chat.
• Orders placed after using the chat: the order number and total, to show the merchant revenue from the chat. Nothing else from the order is kept.
• Customers: a customer’s order count and last order status, looked up by email for the merchant’s inbox. Not stored.

Deletion. When Shopify sends a customer data erasure request, MadAI deletes that shopper’s contact details and their chat messages. 48 hours after a merchant uninstalls the app, Shopify asks MadAI to erase the store’s data, and MadAI deletes the synced products, imported pages, chat journey events, shopper contacts and chat messages for that store. Shopify customer data requests are answered by the merchant from the MadAI dashboard, which holds every conversation and lead.

End users have the right to request access to, correction of, or deletion of their personal data held by MadAI. To exercise these rights, submit a request via our Data Deletion Request page or contact us directly at the address below.

Business clients may also request a full data export or account deletion by contacting us at contact@madhawks.com.

This Privacy Policy is governed by and construed in accordance with the laws of India, including the Information Technology Act, 2000 and applicable rules thereunder. Any disputes arising in connection with this policy shall be subject to the exclusive jurisdiction of the courts in India.

For any privacy-related queries, requests, or concerns, please reach out to: