Privacy Policy

1. Who we are

Xaler is a verification and KYC API platform operated by Logiciel Tech (“Xaler”, “we”, “us”). We provide identity, bank, credit and business-verification APIs to businesses (“Customers”) who integrate them into their own products.

2. Our role in your data

For personal data submitted through our APIs about an end customer — a PAN, an Aadhaar reference, a bank account, a mobile number — our Customer is the data controller and Xaler acts as a data processor. We process that data only to perform the verification the Customer requested, and on their instructions.

For account data about the Customer themselves — company details, billing records, login credentials — Xaler is the controller.

3. What we collect

Account data

• Company name, address, GST number and contact details
• User names, email addresses and phone numbers
• API keys, wallet balance and billing history

Verification data

• Identifiers submitted in an API request (for example PAN, mobile number, bank account, GSTIN)
• The response returned by the underlying verification source
• Request and response records retained as call history

Technical data

• IP address, timestamp and endpoint for each API call
• Usage counters and error records used for billing and support

4. Why we process it

• To deliver the service — routing a verification request and returning the result.
• To bill accurately — recording which calls were chargeable and at what rate.
• To support and troubleshoot — investigating a failed or disputed call.
• To meet legal obligations — retaining records where law or a regulator requires it.
• To protect the platform — detecting abuse, fraud and misuse of API keys.

We do not sell personal data, and we do not use verification data for advertising.

5. Sharing

We share personal data only with:

• The verification source needed to answer a request (a bureau, a regulated data provider, or an Account Aggregator).
• Infrastructure providers who host our systems under contract.
• A regulator, court or law-enforcement authority where we are legally compelled.

6. Retention

Call history is available in your dashboard for 60 days. Older records are moved to encrypted archive storage and remain available on request while we are required to keep them. Billing and invoice records are retained for the period required by Indian tax law.

7. Security

• All traffic is encrypted in transit over TLS.
• API access is authenticated per key, and keys are scoped to the services you have enabled.
• Access to production data is limited to staff who need it, and console access is granted per section.
• Passwords are stored only as salted hashes, never in readable form.

8. Your rights

Under the Digital Personal Data Protection Act, 2023, an individual may ask for access to their personal data, correction of inaccurate data, or erasure where we are not required to keep it.

If you are an end customer of one of our Customers, please raise your request with that business first — they hold the relationship and instruct us. We will assist them in responding.

9. Changes

We will post any change to this policy on this page and update the date above. Material changes affecting Customers will also be notified by email.