TRANXACT Privacy Statement

1. The short version

• On our websites, analytics and marketing cookies are off until you switch them on, and our server enforces a refusal. Forms you fill in reach our sales or partner team.
• In the TRANXACT services, the data you put in — your ledgers, employees, customers, patients, stock — is your data. We process it only to provide the service, on your instructions, under your agreement with us.
• Your data is not used to train AI models. AI features use the AI provider you configure, with your key. Identifiers are masked before a request leaves the service, and an administrator can switch any AI area off.
• We have no standing access to a tenant’s data. Support access needs your administrator’s approval, is time-limited, read-only by default and recorded.
• In the public cloud, every tenant has its own database. Private tenants and customer-managed deployments are fully separate installations, on the cloud provider and in the region the customer chooses.
• We do not sell personal information or use it for third-party advertising.
• To exercise your rights, write to info@tranxact.ai. If an organization you deal with uses TRANXACT, contact that organization first (section 20).

2. Who we are, and our two roles

TRANXACT® is a registered trademark and product of Pyroelectric Incorporated (“Pyroelectric”, “TRANXACT”, “we”, “us”). Like other enterprise software providers, we handle personal information in two distinct roles:

3. What this statement covers

• Part A: our public websites (including tranxact.ai, the configurator, whitepapers, Insights, the interactive demo and the ASK guide), our partner program and partner portal, and our sales, marketing, event and email communications;
• Part B: the TRANXACT services — the TRANXACT software and cloud services in each deployment model in section 10, with their mobile, voice and portal interfaces;
• Part C: provisions that apply to both.

Some features, customer contracts or country editions carry additional notices; where they do, they supplement this statement.

Part A — General

4. What we collect

We collect personal information in three ways: what you give us, what your browser sends when you visit, and — only if you allow it — analytics about how you use our sites.

4.1 Information you give us

Work email only. Our forms do not accept personal email addresses (Gmail, Outlook.com, Yahoo and similar). This keeps our contact with businesses, not individuals, and means we hold less personal data.

Please do not put sensitive information — health, financial account numbers, government identifiers of individuals — into free-text fields or support cases unless we ask for it. If a support case needs a sample of Customer Data, it is handled as Customer Data under Part B.

4.2 Information your browser sends

Our servers receive your IP address, browser and operating system (“user agent”), the page requested and the page you came from. Our hosting provider records these in short-lived operational logs used to keep the service running and secure. When you make a choice in the cookie banner, we keep a record of it — see section 7.

4.3 Analytics — only if you agree

If you accept analytics cookies, we record a row for each page you view. That row contains:

• the page address and title, and the page or campaign (UTM tags) that referred you;
• your IP address and an approximate location (country, region and city) derived from it by our hosting provider — never your precise location;
• your device type, browser and operating system, browser language, time zone and screen size;
• roughly how long the page held your attention;
• a random visitor identifier and a random session identifier generated in your browser.

With the same consent we also load Google Analytics, configured to anonymize IP addresses. Its tag is not loaded at all until you agree.

We use analytics to understand which pages are read, which sources send genuine interest and which organizations are evaluating TRANXACT, so our team can follow up appropriately. If you later submit a form, that enquiry may be connected to your earlier visits.

4.4 Partner referral links

If you arrive through a link shared by one of our partners, we record that the link was used — the time, the page, the referrer, your IP address and (if you have allowed analytics) your visitor identifier — so the partner can be credited for the introduction.

5. Partner portal

If your firm applies to, or takes part in, the TRANXACT partner program, we process the following to run the program and the agreement between us.

Registering a client’s details. When you register a deal or referral, you may give us information about people at another company. You confirm that you are allowed to share it with us for this purpose, and we use it only to manage that opportunity.

Public partner directory. Approved partners appear on the public Find a partner page. The listing shows the firm’s name, website, country, regions, industries and categories, and the name, work email and phone number of the firm’s primary partner contact, so prospective customers can reach them. If you are that contact and would rather not be listed by name, tell us and we will change it.

6. How we use it, and our legal bases

Where data-protection law requires a legal basis (for example the EU and UK GDPR), we rely on the ones below for the data in Part A, and for the operational data in section 12.

Where we rely on legitimate interests, we have weighed them against your rights and expectations, and you can object (see section 24). We do not sell personal information, rent it out, or use it for third-party advertising, and we do not use it for automated decisions that have legal or similarly significant effects on you.

7. Website cookies and storage

On our websites, cookies and similar technologies (local storage, session storage, IndexedDB) fall into three groups. Only the first is used before you choose.

Strictly necessary

These keep the site working, keep partners signed in, and remember your cookie choice so you are not asked on every page. They cannot be switched off, and they are not used to profile you.

Analytics — only if you agree

First-party page-view analytics and Google Analytics, as described in section 4.3.

Marketing — only if you agree

Connects a campaign click to a later enquiry. It is off unless you switch it on, and stays off if you reject non-essential cookies.

Our pages load fonts from Google Fonts, which means your browser sends your IP address to Google when it fetches them.

Refusing, and changing your mind

Choosing Reject non-essential is a real refusal, not a quieter form of consent. No analytics row is written, no Google tag is loaded, and no identifier is used for tracking. Our server independently checks the decision it holds for you before it stores anything, so a page cannot record a visit by claiming a consent you did not give.

You can change or withdraw your choice at any time using Cookie settings, here or in the footer of any page. Withdrawal takes effect immediately for anything collected afterwards. You can also block or delete cookies in your browser; if you block strictly necessary ones, parts of the site — notably partner sign-in — will not work.

We keep a record of each consent decision — including refusals — with its time, the page, your IP address and your browser string. That record is how we demonstrate that a refusal is being honored.

8. AI on our websites

ASK, the website guide, is rules-based. It is not a live AI model, and nothing you type into it is sent to an AI provider.

Partner certification exams are set and marked with the help of a third-party AI model. We send the provider the course material, the questions and your answers — not your name, email or firm. A result affects your firm’s tier in the program; if you disagree with a mark, a person at TRANXACT will review the exam and can change the result.

9. Who we share it with

Service providers

For the data in Part A, these companies process data on our behalf, under contracts that limit them to our instructions:

Our own systems

Enquiries, sign-ups, partner records, deals and support tickets are recorded in Pyroelectric’s own instance of TRANXACT, which we use to run our sales, customer and partner management, invoicing and support.

Partners

We may introduce your enquiry to an authorized TRANXACT partner in your region or industry. When we first offer it, the partner sees your company name, country, industry, a summary of the need and its estimated size. Your contact details are passed on only if the partner accepts, so they can contact you. Partners are bound by their agreement with us to use this information only for that opportunity.

Other cases

• Legal requirements — where we must, to comply with law, regulation, legal process or an enforceable government request (see also section 19).
• Protection — to protect the rights, property or safety of TRANXACT, our customers or the public, including to prevent fraud and abuse.
• Business transfers — if Pyroelectric is involved in a merger, acquisition, financing or sale of assets, personal information may transfer to the successor, which will be bound by this statement or tell you of any change.
• With your direction — anywhere else you ask us to.

Part B — TRANXACT Services

10. Deployment models

TRANXACT is offered in three ways. The privacy commitments in Part B apply to all three; what differs is who runs the infrastructure.

The customer chooses the cloud. TRANXACT can run on Google Cloud Platform (GCP), Microsoft Azure, Amazon Web Services (AWS), Alibaba Cloud, Huawei Cloud, or any other cloud provider available in the region of the customer’s choice. TRANXACT is technology-agnostic: the choice of provider and region is the customer’s. Providers are named here only as publicly known examples; see section 27.

In the customer-managed model, the customer is also responsible for the hosting, security configuration, backups and sub-processors it chooses. The product does not send Customer Data to Pyroelectric. License keys are checked offline.

11. Customer Data: we are the processor

Customer Data is the information a customer, its users or its systems put into the TRANXACT services: financial records, employee and payroll records, customer and supplier contacts, patients, students, inventory, documents, messages, call recordings, AI conversations, and anything else stored in a tenant. It is the customer’s, and the customer controls it.

For Customer Data, Pyroelectric:

• processes it only to provide the services the customer has subscribed to — including keeping them secure, preventing and fixing problems, and supporting the customer — and on the customer’s documented instructions;
• does not use it for advertising, for building marketing profiles, or for any purpose of our own, and does not sell it;
• does not use it to train AI models;
• keeps it logically separated from other customers’ data. Each public-cloud tenant has its own database, and a request with no tenant context is refused rather than served;
• requires the people and sub-processors who handle it to keep it confidential;
• helps the customer respond to people exercising their rights, to carry out data protection impact assessments, and to meet breach-notification duties;
• notifies the customer without undue delay after becoming aware of a personal data breach affecting its Customer Data;
• returns or deletes Customer Data at the end of the agreement, as set out in section 18.

The customer is responsible for having a lawful basis for the data it puts in, for giving its own employees, customers and other people the notices the law requires, and for how it configures the services — including which AI features, integrations and retention policies it switches on.

12. Data we process to operate the services

To run, secure, support and bill for the services, Pyroelectric processes some information as a controller, under Part A’s legal bases:

We use this information to provide, secure and bill for the services, to plan capacity, to provide support, and to meet legal obligations. We do not use it for advertising. The product includes no third-party analytics or advertising trackers.

13. AI features in the product

TRANXACT includes AI features: ASK, the AI operator that carries out tasks in plain language; drafting and summarizing; document and image reading; speech-to-text; AI-assisted voice calls; and others. They work as follows.

• Your provider, your key. AI features use the AI provider the customer configures (for example OpenAI, Google Gemini, Mistral, Groq, DeepSeek or DeepInfra), with the customer’s own key, under the customer’s own terms with that provider. With no provider configured, AI features are unavailable.
• Not used for training. Pyroelectric does not use Customer Data to train AI models. Whether an AI provider may retain or use API data is governed by the customer’s terms with that provider, which the customer should review.
• Identifiers are masked before a request leaves. Every AI request passes through a privacy firewall. It replaces email addresses, phone numbers, bank identifiers (IBAN and SWIFT), national identifiers (such as US Social Security numbers, Aadhaar, PAN and Saudi national ID or Iqama), dates of birth, IP addresses, street addresses, postcodes, and the names of people on file, with placeholders. The real values are restored only inside TRANXACT when an action runs. Payment card numbers are removed outright. The firewall does not redact the content of audio or images, and cannot recognize a name that is not yet on file.
• Administrators decide. AI is available by default in a new company. An administrator can set each area — including recruiting, compensation and employment decisions — to off, suggest only (a person decides), or allowed, and changes are audited.
• On the record. AI use is logged in the tenant: what was asked (after redaction), what was done, by whom. These logs are Customer Data, held in the customer’s database under the customer’s retention policy. The ASK conversation is also kept in the user’s browser.
• Speech. In most browsers, dictation is transcribed on the device. Where it is not, the audio is sent to the customer’s configured provider and is not kept by TRANXACT after transcription.
• AI voice calls. Outbound AI calls must open with a disclosure that the caller is an AI. They check the called person’s consent, do-not-call status and permitted calling hours. Cloning a voice requires a recorded consent from its owner.
• Automated decisions. Where the product scores or ranks people — for example ordering job applications — the customer decides whether that is used, and can require a person to make every decision. The customer is responsible for complying with laws on automated decision-making in employment and other areas.

14. Who can access Customer Data

• The customer’s own users, according to the roles and permissions the customer’s administrators assign.
• Pyroelectric operations staff have no standing access to a tenant’s data. To look into a problem, a staff member requests access with a stated reason. Nothing happens until the customer’s administrator approves it. Access is time-limited (at most 24 hours), read-only by default, and recorded.
• Impersonation for support inside a tenant requires approval by two people other than the requester and the person being viewed. It is time-limited, read-only by default, cannot be used on administrators, and every action taken is recorded.
• Accountants and advisors (Accountant Access): a customer can let its accounting firm in. The customer names the firm and issues the credential. Each session is short-lived, limited to the accounting area, read-only by default and recorded, and the customer’s consent is kept as a versioned record. The firm is responsible to the customer for how it uses that access.
• Partners who implement or support TRANXACT for a customer have the access the customer grants them.

15. Integrations and sub-processors

Sub-processors Pyroelectric uses

For the public cloud and for private tenants we operate, Pyroelectric uses infrastructure sub-processors to host and deliver the services — the cloud provider selected for that deployment, from among Google Cloud Platform (GCP), Microsoft Azure, Amazon Web Services (AWS), Alibaba Cloud, Huawei Cloud, or any other cloud provider available in the region of the customer’s choice — and an email delivery provider for system notifications. We impose data protection terms on each that are at least as protective as our commitments to customers. Customers can ask for the current list of sub-processors, and are told in advance of changes as their agreement provides.

Integrations the customer chooses

TRANXACT can connect to third-party services the customer chooses and configures, usually with the customer’s own account and credentials. Examples include:

• AI providers (section 13);
• email delivery (Microsoft 365, SMTP, SendGrid, Mailgun, Brevo, Postmark, Amazon SES and others) and marketing tools;
• telephony, SMS and messaging (for example Twilio, Zoom, Microsoft Teams, RingCentral, WhatsApp);
• social networks and review sites;
• maps and routing; file storage (Google Drive, OneDrive, SharePoint, Box, Dropbox);
• payments and card tokenization; bank feeds; tax authorities (for example e-invoicing with ZATCA in Saudi Arabia);
• payroll and HR systems; identity and employment verification (for example E-Verify, Aadhaar e-KYC, DigiLocker and Saudi government services);
• CRM, e-commerce and healthcare systems; contact-data enrichment.

When a customer switches on an integration, data flows to that third party under the customer’s own relationship with it. Such third parties are not Pyroelectric’s sub-processors, and their privacy practices are their own. The services named above are publicly known examples only; Pyroelectric does not endorse them, and naming them does not imply any relationship with them (see section 27).

16. Sensitive and regulated data

Customers can use TRANXACT to process data that the law treats as sensitive. The product includes specific protections for it, and the customer remains responsible for its lawful use.

• Government identifiers and bank details — such as Social Security numbers, PAN, Aadhaar, Iqama and bank account numbers — are encrypted field by field and shown masked.
• Payment cards. The card vault encrypts card numbers individually (AES-256-GCM envelope encryption) and keeps only the brand, last four digits and expiry in readable form. Security codes (CVV), PINs and magnetic-stripe data are refused and never stored. Deleting a card destroys its key. Customers can instead use a payment-provider tokenization option, so card numbers never reach TRANXACT. A customer that stores card numbers is responsible for its own PCI DSS compliance.
• Health information. Healthcare modules support clinical and claims standards, and patient communications respect each patient’s opt-out. A customer subject to HIPAA or similar laws should have the appropriate agreement (such as a business associate agreement) in place with Pyroelectric before storing protected health information.
• Employment data — recruiting, payroll, benefits, performance — and the AI controls for it are described in section 13.
• Voice and biometrics. Voice cloning requires its owner’s recorded consent. Passkey and device biometrics stay on the user’s device.
• Marketing to the customer’s contacts. Every marketing email carries a one-click unsubscribe. Unsubscribes, bounces and complaints are suppressed automatically. When contact data comes from an enrichment service, it is added only when a user accepts it, with the lawful basis recorded.

17. Cookies and storage in the product

The TRANXACT application uses only what it needs to work. It sets no advertising or third-party analytics cookies.

On a shared computer, always sign out; this clears the session from the browser. The application loads fonts from Google Fonts, which sends the browser’s IP address to Google.

18. Retention, export and deletion

• The customer sets retention. Customer Data is kept for as long as the customer keeps it in the service. Administrators can set retention policies that archive or delete records after a period. Legal holds stop deletion while they apply. Accounting ledgers are protected from routine purges.
• Export. Administrators can export a person’s records, a matter, or a whole company as a structured archive at any time — for example to answer an access or portability request. Passwords, secrets and card numbers are never included.
• Deleting individual records on request is done by the customer’s administrators, who can remove or anonymize records about a person.
• Backups are encrypted and kept for disaster recovery. Records deleted from the service age out of backups on the backup schedule.
• End of the agreement. When a subscription ends, the customer can export its data during the period its agreement allows. After that, we delete the tenant’s database and the Customer Data in it, except where the law requires us to keep something. Production tenants are protected against accidental deletion, so deletion follows a deliberate, recorded process.
• Data we hold as controller (section 12) is kept as described in section 22.

19. Requests from authorities

If a government or law-enforcement authority asks Pyroelectric for Customer Data, we will try to redirect the authority to the customer. We will notify the customer unless the law forbids it. We disclose Customer Data only when legally compelled to, and we will challenge requests that are overbroad or unlawful. We do not give any government direct or unfettered access to Customer Data, or our encryption keys.

20. If your employer or provider uses TRANXACT

If you are an employee, job applicant, customer, supplier, patient or student of an organization that uses TRANXACT, that organization decides what information about you is held and how it is used, and its privacy notice applies. To ask about your data or exercise your rights, please contact that organization. If you contact us, we will pass your request to them and help them respond.

Part C — Common provisions

21. Where data is stored, and international transfers

Our websites are hosted in the United States. Public-cloud tenants are hosted in the cloud provider and region recorded for the tenant. A private tenant is hosted in the cloud provider and region its customer chooses — for example Google Cloud Platform (GCP), Microsoft Azure, Amazon Web Services (AWS), Alibaba Cloud, Huawei Cloud, or any other cloud provider available in the region of the customer’s choice. A customer-managed deployment is wherever the customer chooses. Our support staff and service providers may process data in other countries.

Where we transfer personal information from the European Economic Area, the United Kingdom, Switzerland or another country that restricts transfers, we rely on an adequacy decision where one applies (including the EU–US Data Privacy Framework for certified recipients), or on the European Commission’s Standard Contractual Clauses and the UK Addendum, with supplementary measures where needed. For Customer Data, the transfer terms in the customer’s DPA apply. You can ask us for a copy of the relevant safeguards.

22. How long we keep our own data

When data is no longer needed, we delete it or anonymize it so it can no longer identify you.

23. Security

We protect personal information with administrative, technical and physical measures appropriate to the risk, including:

• Encryption in transit (HTTPS/TLS) and at rest by our hosting providers. On top of that, secrets, API keys, single sign-on credentials, bank details, national identifiers and card numbers are encrypted field by field.
• Strong sign-in: passwords stored only as salted one-way hashes; multi-factor authentication required by default in our cloud deployments; passkeys; single sign-on with SAML and OpenID Connect; and SCIM user provisioning.
• Session controls: configurable idle time-outs (60 minutes by default) and maximum session lengths, with an optional one-session-per-user rule.
• Isolation: a separate database per public-cloud tenant; dedicated installations for private tenants.
• Least privilege: no standing staff access to Customer Data; approved, time-limited, recorded access only (section 14).
• Audit trails: tamper-evident records of significant actions, including field-level change history and every action taken during support access.
• Privacy by design: the AI firewall (section 13), rate limiting, and minimizing what leaves a tenant.

No system is perfectly secure. If we become aware of a breach affecting personal information we control, we will notify you and the relevant authorities as the law requires. For Customer Data, we notify the customer as its agreement provides.

24. Your rights

Depending on where you live, you may have the right to:

• Access — know whether we hold personal information about you, and get a copy;
• Correction — have inaccurate or incomplete information fixed;
• Deletion — have it erased, where we do not need to keep it;
• Portability — receive it in a structured, machine-readable format;
• Restriction — ask us to limit how we use it while a concern is resolved;
• Objection — object to processing based on legitimate interests, and to direct marketing at any time;
• Withdraw consent — at any time, without affecting processing that happened before (use Cookie settings for website cookies);
• Human review — of a decision made by automated means;
• Complain — to your data-protection authority.

For data we control, write to info@tranxact.ai and say what you want. We may ask you to confirm your identity — usually by replying from the email address we hold. You may use an authorized agent; we may ask them for proof of authority. We respond within one month, or the shorter period your law requires. We will not treat you differently for exercising your rights. Partners can correct most of their own details, and remove passkeys and devices, from Security in the portal.

For Customer Data, please contact the organization that uses TRANXACT (section 20).

25. Region-specific information

European Economic Area, United Kingdom and Switzerland

Pyroelectric Incorporated is the controller of the data described in Part A and section 12, and a processor of Customer Data. The legal bases we rely on are in section 6. You may complain to the supervisory authority where you live or work, or where you think an infringement happened — in the UK, the Information Commissioner’s Office (ico.org.uk). We would appreciate the chance to address your concern first.

United States, including California

In the last 12 months, as a business, we have collected these categories of personal information, described in Part A and section 12:

• identifiers (name, email, phone, IP address, online identifiers);
• professional information (company, role and the business details on our forms);
• commercial information (configurations, subscriptions, quotes and deals);
• internet activity (page views, if you consent);
• approximate geolocation;
• account credentials.

We collect them from you, from your device, and from partners who register an opportunity. We use and disclose them for the business purposes in sections 6, 9 and 12.

We do not sell personal information and do not share it for cross-context behavioral advertising, and we have not done so in the last 12 months. We do not knowingly sell or share the personal information of anyone under 16. Sensitive personal information, such as account credentials, is used only for permitted purposes like signing you in, so no right to limit arises.

California residents, and residents of other states with comparable laws, have the rights to know, delete and correct, and not to be discriminated against. You can exercise them as in section 24. For Customer Data, we act as a service provider to our customers.

India

Under the Digital Personal Data Protection Act, 2023, Pyroelectric Incorporated is a data fiduciary for the data described in Part A and section 12, and a data processor of Customer Data. You may:

• access, correct, complete or erase your personal data;
• withdraw consent;
• nominate another person to act for you;
• raise a grievance with us at info@tranxact.ai.

If we do not resolve your grievance, you may approach the Data Protection Board of India.

Kingdom of Saudi Arabia

Under the Personal Data Protection Law, you have the right to be informed, to access and obtain a copy of your personal data, to correct it, and to request its destruction when it is no longer needed. Where personal data is transferred outside the Kingdom, we do so in accordance with that law and its regulations. You may raise a concern with us, and with the Saudi Data and AI Authority (SDAIA).

Other jurisdictions

If you live somewhere with equivalent rights — for example Canada, Australia, Brazil, the United Arab Emirates or Singapore — those rights apply in full, and you can exercise them the same way.

26. Children

Our websites, partner program and services are for businesses and the professionals who work in them. They are not directed at children, and we do not knowingly collect personal information from anyone under 16 for our own purposes. If you believe a child has given us information, contact us and we will delete it. Customers that use TRANXACT to process information about minors — for example patients or students — do so as controllers, and are responsible for any consents the law requires.

27. Third-party names and trademarks

TRANXACT® is a registered trademark of Pyroelectric Incorporated. All other product names, company names, logos, trademarks and copyrights mentioned in this statement or on our websites — including those of cloud providers (such as Google Cloud Platform, Microsoft Azure, Amazon Web Services, Alibaba Cloud and Huawei Cloud), AI providers, and email, telephony, payment, mapping, storage and other services — are the trademarks and copyrights of their respective owners, as announced by those owners and publicly available.

They are named only as publicly known examples, to help customers understand what TRANXACT can work with. Pyroelectric Incorporated does not claim, convey or imply any affiliation, partnership, sponsorship or endorsement with or by any of these companies, and assumes no relationship with them by naming them. TRANXACT is technology-agnostic. Customers choose their own providers and technologies, and any relationship with them is the customer’s.

28. Changes to this statement

We update this statement as our services, the law and our practices change. The version and effective date are at the top. If a change materially affects how we use personal information we already hold, we will announce it on this page before it takes effect. Where we have an active relationship with you, we will also tell you by email or in the service, and we will ask for consent again where the law requires. Changes to the website cookie policy prompt the cookie banner again. Changes affecting Customer Data are also made under the customer’s agreement.

Links to other websites — partners, cloud providers, social networks — are governed by their own privacy notices, not this one.

29. Contact us

Pyroelectric Incorporated (TRANXACT)
Privacy enquiries and rights requests: info@tranxact.ai
Partner program: partner@tranxact.ai
Sales: sales@tranxact.ai

Please put “Privacy” in the subject line so your message reaches the right person quickly.