1. Scope and CXRove's roles
This Notice describes how Cyber Infrastructure LLC handles personal information for the CXRove website and CXRove services. It does not describe another CIS product or activate an optional CXRove feature.
CXRove may act as a business or controller for account, website, billing, security, and direct support data. For customer-directed communications and content, CXRove is expected to act primarily as a processor or service provider, while the customer determines the purpose and lawful basis. Exact roles depend on the activated feature, contract, and law.
2. Categories of information
Depending on the website or service features a person or customer uses, CXRove may process the following categories. A category applies only where the relevant interaction or feature collects it.
- Account and organization data, such as names, business contact details, roles, authentication events, and preferences.
- Billing and transaction data, such as plan, credits, usage, invoices, tax location inputs, payment status, and provider references. CXRove should not receive full card credentials from Stripe-hosted payment surfaces.
- Communications and contact data, such as telephone numbers, caller identity, destination, consent and suppression evidence, call timing, routing, and delivery status.
- Call artifacts when separately enabled, such as recordings, transcripts, summaries, dispositions, and derived knowledge references. Recording and transcription are planned to be off by default.
- Customer content and instructions, such as knowledge, prompts, configurations, integrations, action requests, and support material.
- Technical, security, and usage data, such as IP address, device and browser information, audit events, API activity, diagnostics, rate-limit events, and abuse signals.
- Website choices, including necessary cookie state and optional analytics or consent choices only if those tools are later activated.
3. Purposes
- Provide, configure, secure, support, meter, and improve the authorized service.
- Route communications, perform customer instructions, and support human handoff under applicable controls.
- Authenticate users, administer organizations, prevent fraud and abuse, and investigate security incidents.
- Calculate charges and taxes, process payments, reconcile providers, and maintain financial records.
- Respond to support, privacy, legal, and regulatory requests.
- Meet legal obligations and enforce agreements without expanding processing beyond what is necessary.
4. Sources and choices
Information may come from customers and users, people they communicate with, configured integrations, communications and AI providers, payment and tax providers, security services, and the devices used to access CXRove.
Some account, billing, routing, security, and instruction data would be required to provide an activated service. Optional recording, transcription, analytics, and marketing processing must have separate controls and may remain unavailable.
5. Service providers and subprocessors
CXRove may disclose information to contracted providers only for approved purposes such as payments and tax, communications, AI processing, storage and delivery, transactional email, security, and infrastructure operations.
The linked subprocessor register distinguishes vendors authorized for planning from services actually activated. A planned row does not mean that data is sent to that provider.
7. Security boundary
CXRove is designed to use access controls, tenant isolation, environment separation, audit events, secure transport, secret handling, backup, recovery, and incident processes. This Notice does not claim an independent certification or suitability for a regulated use.
The final notice and DPA may describe only controls proved by current production configuration, testing, independent review where required, and signed release evidence. No system can guarantee absolute security.
8. Retention and deletion
CXRove plans to retain information only for the approved service, security, financial, legal, and customer-instruction purposes, then delete or de-identify it under a documented schedule. Different categories may require different periods.
No fixed retention promise is active here. The final schedule must identify the exact category, default period, customer controls, provider-copy handling, backups, legal holds, deletion verification, and exceptions supported by the live system and applicable law.
9. International processing and transfers
Providers and customers may operate in more than one country. The final register must state actual processing regions and the approved transfer mechanism for each activated data flow.
Publication of this Notice does not execute Standard Contractual Clauses, the UK Addendum, or another transfer agreement. Those modules apply only when completed and executed for the relevant parties and processing.
10. Privacy rights and requests
Depending on location and applicable law, including California privacy law where it applies, a person may have rights to know or access, correct, delete, restrict or object, obtain a portable copy, opt out of certain sale, sharing, targeted advertising, or profiling, limit certain sensitive-data uses, withdraw consent, or appeal a decision.
A privacy rights request may be sent to the accessible legal contact shown on this page. Before acting, CXRove may need to verify identity and authority, clarify scope, coordinate with the customer that controls the data, and apply lawful exceptions. Any legally required alternate methods and appeal route will be published with the applicable process.
11. Children
CXRove is planned as a business service and is not directed to children under 13. Accounts are proposed for adults acting for organizations.
Customers must not direct CXRove to collect children's information without an approved lawful use and required notices and consent. If CXRove learns that it collected children's information outside an approved process, it would investigate and delete or otherwise handle it as applicable law requires.
12. Changes and contact
An effective notice must state its version, effective date, prior version, approver, and material change record. Material changes would use the notice method approved for the affected relationship and law.
Privacy, data-protection, and rights questions may be sent to the accessible contact shown on this page. CXRove does not claim that a regulator-specific representative or data protection officer has been appointed unless a later notice identifies one.
Change record
Published the substantive notice covering categories, purposes, vendors, rights, transfers, children, and feature-specific processing boundaries.
This is the first published version; no prior operative version exists.