In short
- For your Pushix account we collect what we need to run it: your name, email, a protected password and basic security records.
- For the subscribers of your apps and websites, we act only on your instructions. Your own privacy policy is the one that applies to them.
- We do not sell personal data, show ads, or use analytics or advertising trackers.
- You can see, correct, export and delete your data. Questions go to our Grievance Officer.
1. About this policy
This policy explains how Pushix (“we”, “us”) handles personal data in connection with Pushix at pushix.in: our website, the dashboard, the API and our SDKs.
We play two different roles:
- For our customers and visitors — people who visit our website, create an account or join an organization — we decide why and how their data is used. We are the “data fiduciary” under India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the “controller” under the EU and UK General Data Protection Regulation (“GDPR”). This policy covers that data.
- For our customers’ subscribers — people who use our customers’ apps and websites — our customer decides why and how their data is used, and we process it on the customer’s behalf as a “data processor”. The customer’s own privacy policy applies to that data, and our Data Processing Addendum governs how we handle it. Section 3 describes it so you know what the Service does.
This policy is published under the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 and the IT Rules, 2021, and is written to meet the GDPR’s transparency requirements as well.
2. Information we collect about customers
| What | Details | Where it comes from |
|---|---|---|
| Account | Name, email address, password (stored only as a one-way hash), whether your email is confirmed, when you last signed in, and your account status. | You, when you sign up or edit your account |
| Organization and team | Organization name, team members and their roles, invitations (the invited email address and role), your plan and plan history. | You and your teammates |
| Sign-in sessions | For each signed-in session: the IP address, the browser’s user-agent string, and when it started, was last used and expires. | Your browser |
| Security records | Failed sign-in attempts and requests for sign-up, verification and password-reset emails (IP address, the email entered, time). An audit log of important actions — such as sign-ups, team changes, plan changes, app deletions and email changes — with the IP address and time. | Our servers, when you use the Service |
| What you set up | Apps and websites, delivery credentials (your Firebase service-account key and web push keys, both stored encrypted), notification content, templates, segments, automations and in-app messages. If they contain personal data, it is Customer Data (section 3). | You |
| Payments | Plan, amount, currency, billing period, payment status and the payment reference. Card, UPI and bank details are collected by the payment gateway, not by us. | You and the payment gateway (once online payments are available) |
| Messages to us | What you write when you email support or our Grievance Officer, and our replies. | You |
On our website we do not use advertising or social-media trackers, or analytics. Like any website, our hosting provider’s servers receive your IP address, browser details and the pages requested, and record them in server logs, which are used only for security and kept for a limited period (see section 7). The dashboard also loads fonts from Google Fonts (see section 5).
Your password is “sensitive personal data or information” under the 2011 Rules. We never store it in readable form and never ask you to send it to us.
3. Information we process for our customers
When a customer’s app or website uses our SDKs or API, Pushix stores the following about each subscribed phone, tablet or browser, on the customer’s behalf:
- Push address: the device push token, or for browsers the push endpoint and its encryption keys; the platform (Android, iOS or web) and whether the subscriber is currently subscribed.
- Device details: language, time-zone offset, app version, device model (for browsers, the browser name and version), operating system and SDK version; and, only if the app sends it, a two-letter country code.
- Activity: when the subscriber was created and last active, the number of sessions and time spent, the days the subscriber was active, which notifications were opened and which button was tapped, and which automated messages were sent to them. In-app message views and clicks are counted only in totals.
- What the customer adds: an external user ID (the customer’s own ID for the person), tags (key–value pairs such as “plan: gold”), a purchase total and badge count, and whether the device is a test device.
Pushix does not store subscribers’ IP addresses in its database, and does not collect precise location, contacts, advertising IDs, or names or email addresses — unless a customer chooses to put such information into an external user ID or a tag. On a website that uses our Web SDK, information is also kept in the visitor’s browser, as described in our Cookie Policy. If a website uses in-app messages or identifies its visitors, the Web SDK may create a record for a visitor who has not allowed notifications.
If you are a subscriber and want to see, correct or delete this data, please contact the app or website that sent you notifications: they control it. You can also stop notifications at any time in your device or browser settings. If you cannot reach them, contact us (see section 10) and we will pass your request on and help them respond.
4. How we use information and why
We use customer and visitor data only for the purposes below. The last column gives the legal basis under the GDPR; for India, see the paragraph after the table.
| Purpose | Data used | GDPR legal basis |
|---|---|---|
| Create and run your account and organization, sign you in, and provide the features you use | Account, organization, sessions, what you set up | Performing our contract with you |
| Send account emails: email confirmation, password resets and team invitations | Name, email address | Performing our contract |
| Keep the Service and accounts secure: stop password guessing and abuse, investigate incidents, keep an audit trail | Sessions, security records, audit log | Our legitimate interest in security, and legal obligations |
| Apply plan limits, arrange paid plans, invoice and keep accounts | Organization, plan and payment records | Performing our contract; legal obligations (tax and accounting) |
| Answer support requests and complaints | Messages to us, account data | Performing our contract; legal obligations (grievance redressal) |
| Tell you about important changes to the Service, our terms or your plan | Name, email address | Performing our contract; legal obligations |
| Enforce our terms and respond to lawful requests from courts and authorities | Any relevant data | Legal obligations; our legitimate interest in protecting our rights |
India. We collect and use your personal data with the consent you give when you create an account or join an organization, and for the “legitimate uses” the law allows, such as complying with a legal obligation. You can withdraw your consent by closing your account; this does not affect anything we did before, and we may then be unable to continue providing the Service to you.
We do not sell personal data, do not use it for advertising, and do not make decisions about you based solely on automated processing that have legal or similarly significant effects. We do not send marketing emails.
5. Who we share information with
We share personal data only as follows:
- Hosting provider — runs the servers and database on which Pushix operates and stores all data, including backups.
- Email provider — the email (SMTP) service we use to send account emails. It receives your name, email address and the email content.
- Payment gateway — once online payments are available, a payment gateway authorised by the Reserve Bank of India processes payments and receives the details you enter at checkout. It tells us the outcome and a payment reference.
- Google Fonts — our dashboard and administration panel load fonts from Google’s servers (fonts.googleapis.com and fonts.gstatic.com); the public website uses fonts stored on our own server. Your browser then sends Google your IP address and browser details, which Google handles as described in the Google Fonts FAQ and Google’s privacy policy.
- Delivery services — to deliver our customers’ notifications, we send push tokens and notification content to Google Firebase Cloud Messaging (which delivers to Android and, through the Apple Push Notification service, to iOS) and send encrypted notifications to the push service of the subscriber’s browser (run by Google, Mozilla, Apple or Microsoft). We do this on our customers’ instructions.
- Your organization — other members of an organization can see your name, email address and role, and the platform administrators who run Pushix can see account and organization details to provide support and keep the Service secure.
- Authorities and legal claims — when the law requires it, for example in response to a lawful order from a court or an authorised government agency, and to establish or defend legal claims.
- Business transfer — if the Service is sold or transferred, to the new owner, who will be bound by this policy. We will tell you beforehand.
Our service providers may use the data only to provide their services to us and must protect it.
6. Where information is processed
We are based in India. Personal data is stored on servers run by our hosting provider and may be processed in India and in the other countries where our service providers operate, including the United States (for Google, Apple, Microsoft and Mozilla).
When we transfer personal data from the European Economic Area, the United Kingdom or Switzerland to a country that does not have an adequacy decision — which currently includes India — we use the European Commission’s Standard Contractual Clauses (with the UK Addendum or the Swiss adaptations where needed), or another safeguard the law allows. Ask us for a copy. We will also follow any restrictions on transfers that the Government of India notifies under the DPDP Act.
7. How long we keep information
| Data | How long |
|---|---|
| Account and organization | While the account or organization exists. When it is deleted, it is removed from our live systems at once. |
| Sign-in sessions | Until you sign out or the session expires (by default after 14 days without use). Expired sessions are removed automatically. |
| Failed sign-ins and email-request records | Usually removed within 24 hours. |
| Confirmation and password-reset links | Valid for 3 days and 1 hour respectively; removed after they expire. |
| Audit log | As long as it is needed for security, fraud prevention and our legal obligations — and in any case for at least 180 days after an account is closed, as the IT Rules require for registration information. |
| Payment and invoice records | As long as tax and accounting law requires (generally up to 8 years). |
| Support and complaint emails | Up to 3 years after the matter is closed, unless needed longer for a legal claim. |
| Customer Data | Until the customer deletes it, or deletes the app or organization. Daily activity records of subscribers are deleted automatically after about 13 months. |
| Server logs | Up to 180 days, the period for which Indian cyber-security rules (the CERT-In directions) require such logs to be kept. |
| Backups | Overwritten within 30 days. |
If we have removed content or an account because of unlawful activity, the IT Rules require us to preserve the related records for 180 days, or longer if a court or authorised agency asks us to.
8. How we protect information
- Passwords are stored only as salted one-way hashes (bcrypt).
- Firebase service-account keys, web push private keys and our email password are encrypted in the database with AES-256-GCM.
- Sign-in sessions use a random token in a cookie that scripts cannot read; we store only a hash of the token. Changes in the dashboard require a separate anti-forgery token.
- Repeated failed sign-ins and repeated email requests are blocked for a while, and accounts can sign out all other sessions.
- Access inside an organization depends on the person’s role, and each app has its own API key, which can be replaced at any time.
- Web push notifications are encrypted end to end (RFC 8291), so browser push services cannot read their content.
- Our staff access personal data only when needed to provide support, keep the Service secure or comply with the law.
No system is perfectly secure. If a personal data breach affects you, we will tell you and the authorities as the law requires, including reporting cyber security incidents to CERT-In.
9. Your rights
In India
You can review the information you gave us and ask us to correct it, and you can withdraw your consent, as the 2011 Rules provide. Most details can be changed directly in your account settings.
The DPDP Act and the Digital Personal Data Protection Rules, 2025 are coming into force in phases: the rules on the Data Protection Board of India apply from 13 November 2025, and most duties of data fiduciaries and the rights of data principals are scheduled to apply from May 2027. From then you will have the right to obtain a summary of your personal data and how we process it, and the identities of those we have shared it with; to have it corrected, completed, updated and erased; to have your grievances addressed; and to nominate someone to exercise your rights if you die or become unable to. We already honour these requests today. If you are not satisfied with our response, you will be able to complain to the Data Protection Board of India once those provisions apply.
In the EU, the UK and Switzerland
If the GDPR or a similar law applies, you can ask for access to your data, its correction or deletion, restriction of its use, and a copy in a portable format; you can object to processing based on our legitimate interests; and you can complain to your local data protection authority (in the UK, the Information Commissioner’s Office).
In the United States
If you live in a US state with a consumer privacy law, such as California, you may have the right to know, access, correct and delete your personal information, and to opt out of its sale or its use for targeted advertising. We do not sell or share personal information for targeted advertising. We will not treat you differently for using your rights, and you may use an authorised agent.
10. How to make a request
To use any of these rights, email us at info@pushix.in, or contact our Grievance Officer, Sanjit Karmakar, at sanjit@pushix.in. Please write from the email address on your account, or tell us how to identify you, so we can confirm the request is yours. We may ask for more information to verify it.
We reply within 30 days. If a request is complex we may need longer where the law allows, and we will tell you why. Requests are free unless they are clearly unfounded or excessive.
You can also do much of this yourself: edit your name and email in your account settings, sign out other sessions, remove team members, and export or delete subscribers and apps in the dashboard.
Subscribers of our customers should first contact the app or website concerned. If you cannot, send us the name of the app or website and, if you know it, your subscriber ID, and we will pass your request on.
11. Cookies and browser storage
We use one cookie, only when you sign in, to keep you signed in. We also store a few preferences — such as light or dark mode, and the organization and app you last opened — in your browser. We do not use advertising cookies or analytics cookies. Details are in our Cookie Policy.
12. Children
Pushix is a service for businesses and is not meant for anyone under 18. We do not knowingly create accounts for children. If you believe a child has given us personal data, contact us and we will delete it. Customers whose apps or websites are used by children must meet the extra requirements of the law for children’s data, as our Acceptable Use Policy explains.
13. Changes to this policy
We may update this policy as the Service or the law changes. We will post the new version here with a new “Last updated” date and, if a change is significant, tell account holders by email or in the dashboard before it takes effect.
14. Contact and Grievance Officer
For privacy questions and requests, email us at info@pushix.in. For complaints, contact our Grievance Officer, Sanjit Karmakar, at sanjit@pushix.in. We acknowledge complaints within 24 hours and resolve them within the times listed on our Contact page.
Postal address: Pushix, Pipulbaria, Nadia, West bengal, India - 741152.
Last updated 30 October 2026.