Privacy Policy
What data Mikxx collects, who it's shared with, and your rights.
Last updated: 31 October 2026
This policy explains what personal data Mikxx IT Solutions, a sole proprietorship of Riyansh Ahlawat based in New Delhi ("Mikxx", "we") collects, why, who it is shared with, and your rights. It follows the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 and its rules.
There are two kinds of people whose data Mikxx handles:
- Account holders: people who sign up to build forms and apps. For their data Mikxx is the data fiduciary (controller).
- Respondents and customers: people who fill in a form, sign in to a mini app or pay a business through Mikxx. For that data the business that made the form is the data fiduciary, and Mikxx processes it on their behalf. Questions about it should go to that business first; we will help them answer.
What we collect
| Data | From whom | Why |
|---|---|---|
| Name, email, password (stored as a one-way hash), or your Google sign-in | Account holders | To create and secure your account |
| Workspace, team members and roles | Account holders | To run shared workspaces |
| Forms, apps, lists, agent chats | Account holders | To provide the Service |
| Payout details: UPI ID and display name; for Razorpay, business name, type, PAN, GST, address, mobile and bank account | Account holders who take payments | To pay you. Razorpay KYC details go straight to Razorpay; we keep only the ids it returns and your account status |
| Form answers, uploaded files, email used for app sign-in | Respondents and customers | To deliver the answers to the business that made the form |
| Payment records: amount, items, status, UPI reference or Razorpay payment ID | Customers | Receipts, reconciliation and tax records |
| IP address, browser, pages visited, timestamps | Everyone | Security, spam protection and fixing problems |
| Help requests, bug reports and feedback | Anyone who writes to us | To answer you |
| Connected app records: app name, the member and workspace it acts for, when it was approved, and its access tokens (stored only as hashes) | Account holders who connect an app such as ChatGPT | To let the app act for you, and to let you disconnect it |
| What you ask a connected app to save: form names, questions, themes and edits | Account holders who connect an app | To carry out your request |
We never collect or store card numbers, CVV, UPI PIN or netbanking passwords. Card and UPI payments through Razorpay are entered on Razorpay's own checkout.
Connected apps (ChatGPT, Claude and others)
If you connect an app such as ChatGPT to Mikxx, it signs in with OAuth; we never see or receive your ChatGPT password or your chats. You choose the workspace, and you can only give the app your own role, never more than an editor.
When you ask, Mikxx sends the app only what that request needs:
- Forms and apps: name, description, status, questions, theme, links and response count.
- Templates: Mikxx's public templates.
- Responses: the date, status and answers of a form's responses. Answers can include whatever respondents typed, such as names, emails and phone numbers. We do not send record ids, payment times or IP addresses.
The app receives this data under its own terms and privacy policy, for ChatGPT those of OpenAI and for Claude those of Anthropic. Mikxx does not read your conversation history. Mikxx's AI providers are not used for these requests, and connected apps have no tool to delete forms or responses.
Disconnect at any time in Settings → Developers → Connected apps, or in the app's own settings. Access stops at once in Mikxx. Data an app already received stays under that app's terms.
Businesses must not use forms to collect card numbers, health records, government ID numbers or passwords, and should not ask a connected app to read such answers.
Cookies
We use one essential cookie, mikxx_session, to keep you signed in. It is HttpOnly and expires
when your session ends or after its set lifetime. We also store small preferences (such as light
or dark theme) in your browser. Our visitor counts use no cookies and count a visitor once a day.
On Mikxx's own public pages (home, pricing, docs, templates, help, sign-in and sign-up) we use the
Meta Pixel, which sets Meta's _fbp cookie, to measure how people who see our posts and ads
on Facebook and Instagram find Mikxx. When you create an account we tell Meta it happened, with
your email address only as a one-way hash. The Pixel never runs inside your workspace or on any
form or app made with Mikxx, so respondents and customers are not tracked by it. Browsers that
send "Do Not Track" don't load it. We do not sell personal data. Forms that ask for a human check
use Cloudflare Turnstile, which may set its own cookie to tell people from bots. Form fonts are
served from Mikxx's own servers, never from Google.
Who we share data with
Only with service providers that help run Mikxx, under contracts that limit their use of it:
| Provider | What for |
|---|---|
| Razorpay Software Pvt Ltd | Processing payments, merchant KYC and payouts |
| Cloudflare | Hosting network, security and the human check |
| Our hosting provider (servers and database) | Storing and running the Service |
| Email delivery provider | Sign-in codes, receipts, confirmation and team emails |
| Sign-in with Google, if you choose it | |
| Meta Platforms | Measuring visits from Facebook and Instagram on our public pages, and sign-ups (hashed email) |
| Apps you connect, such as ChatGPT (OpenAI) or Claude (Anthropic) | Only when you connect one and ask: the form and response data listed under Connected apps |
| AI model providers (such as OpenRouter, Groq, Google Gemini, NVIDIA, Hugging Face, Ollama) | Writing agent answers and follow-up questions. They receive what you type and the form's structure, never respondents' contact details |
We also share data when the law requires it, to protect people from harm or fraud, or as part of a merger or sale of the business (with this policy still applying). We do not sell personal data. Some providers process data outside India; we only use providers with appropriate safeguards, and never transfer to a country the Government of India has restricted.
How long we keep it
- Account data: while your account is open, and up to 30 days after you delete it.
- Form responses: until the business that owns the form deletes them or its account.
- Payment and invoice records: 8 years, as Indian tax and accounting law requires.
- Security logs: up to 180 days.
- Connected app records: while connected, then up to 30 days after you disconnect or the connection expires. A connection expires 90 days after the app last renewed it. Access tokens last one hour.
Security
Passwords are hashed, connections are encrypted (HTTPS), sessions use secure random tokens, and access to production data is limited to people who need it. No system is perfectly secure; if a breach affects you we will tell you and the Data Protection Board as the law requires.
Your rights
You can ask to access, correct, update or erase your personal data, withdraw consent, and nominate someone to exercise your rights if you die or cannot. Most account data you can edit in Settings. For anything else, or to complain, write to our Grievance Officer below. If you are a respondent, contact the business that made the form; we will pass on requests sent to us. If you are not satisfied, you may complain to the Data Protection Board of India.
Children
Mikxx accounts are for people aged 18 or over. Businesses must not use Mikxx to collect data from children without verifiable parental consent as the law requires.
Changes
We will post any change here and update the date above; for significant changes we will also email account holders.
Contact and Grievance Officer
Riyansh Ahlawat, Grievance Officer, Mikxx IT Solutions, a sole proprietorship of Riyansh Ahlawat based in New Delhi, WZ-43, Begumpur, New Delhi 110086, [email protected]. You can also write from Help. We acknowledge within 48 hours and resolve within 30 days.