Privacy notices by country
Our main privacy policy applies to everyone, wherever they are: it is the one place that says what we collect, how long we keep it, who processes it with us, and what we never see. Each section below adds what the law of one country asks us to tell you: the law, the regulator, the rights it gives you, how the fact that your data is processed in India is handled, and how to complain.
Effective 24 October 2026
Three things are true in every country. First, the content of a support session is end-to-end encrypted on the two devices, is never readable on our servers, and is never recorded by us. Second, everything we do keep is stored on our servers in Mumbai, India, rented from Hostinger International Ltd.; the only onward transfer is the audio of a recording you chose to make, sent to Google's Gemini API for its transcript and summary, which Google may process outside India, including in the United States. Our safeguards everywhere are the same: end-to-end encryption for sessions, TLS for everything else, passwords and API keys stored only in hashed form, restricted and logged server access, and data processing terms with Hostinger and Google (see Security). Third, we make no decisions about you by automated means that have legal or similarly significant effects, we do not sell personal data, and we send no marketing. Our contact for every privacy matter is Amit Goyal, Wild Cats Media, SCO-47, Second Floor, World Street, Sector-79, Faridabad, Haryana, India – 121014, through the contact form or support@acrossview.com. When we honour a deletion request, two things stay for a while: connection records, kept 180 days under India's CERT-In Directions, and the security log, as long as security requires.
People in the EU, EEA and UK, in Brazil and in Türkiye have their own, longer notices: GDPR, LGPD and KVKK.
1. Australia
The law. The Privacy Act 1988 and its Australian Privacy Principles (APPs). We are not established in Australia and may fall under the Act's small business exemption; we follow the APPs regardless. APP 1 asks for a clear policy on what we collect, why, how we hold it and how you can access and correct it: that is our main policy, with its data table.
Overseas disclosure (APP 8). We hold your data in India, and Google may process the audio of a recording you make in the United States. Neither recipient is bound by the APPs. Under APP 8.2(b) we tell you this before you use AcrossView, and by using it with this notice in front of you, you consent to the disclosure on that basis. We also take the reasonable steps APP 8.1 contemplates: the encryption, access controls and processor terms described above.
Your rights. Under APP 12 and APP 13 you can ask for access to your personal information and for it to be corrected; we answer within 30 days. You can also ask us to delete it.
Data breaches. Under the Notifiable Data Breaches scheme we will notify the Office of the Australian Information Commissioner (OAIC) and the people affected when a breach is likely to result in serious harm.
Automated decision-making. From 10 December 2026 privacy policies must disclose significant decisions made by automated means. We make none: session limits follow your plan, not a profile of you.
Complaints. Write to Amit Goyal first through the contact form. If we do not resolve it within 30 days you can complain to the OAIC at oaic.gov.au.
2. New Zealand
The law. The Privacy Act 2020 and its Information Privacy Principles (IPPs), which apply to an agency outside New Zealand that offers its service to people there. The main policy and its data table give the notice IPP 3 requires: what we collect, why, who holds it, and that giving it is voluntary (a support session or a whiteboard needs no account).
Disclosure outside New Zealand (IPP 12). Your data is held in India, and Google may process the audio of a recording in the United States. India is not a prescribed country under the Act and Google is not bound by New Zealand law. IPP 12 allows the disclosure where you authorise it after being expressly told that the recipient may not be required to protect your information with comparable safeguards. This paragraph tells you that, and by using AcrossView with it in front of you, you authorise the disclosure. The encryption, access controls and processor terms described above apply.
Your rights. IPP 6 gives you access to your personal information and IPP 7 the right to ask for its correction; we answer within 20 working days. You can also ask us to delete it.
Privacy breaches. If a breach is likely to cause serious harm, we will notify the Office of the Privacy Commissioner and the people affected as soon as practicable, as Part 6 of the Act requires.
Complaints. Write to Amit Goyal first through the contact form. You may complain at any time to the Office of the Privacy Commissioner at privacy.org.nz, and from there to the Human Rights Review Tribunal.
3. Singapore
The law. The Personal Data Protection Act 2012 (PDPA), which applies to organisations outside Singapore that collect personal data of people in Singapore. Our Data Protection Officer under section 11(3) is Amit Goyal, Wild Cats Media, reachable through the contact form or support@acrossview.com.
Consent and purpose limitation. We collect, use and disclose personal data only for the purposes in the data table of the main policy, which we tell you about before or when we collect it. Most of it is needed to provide the service you asked for; the AI transcript of a recording, a connected calendar and messaging us on WhatsApp are optional and rest on your consent, which you can withdraw (section 16) by deleting the recording, disconnecting the calendar, or telling us.
Transfer limitation (section 26). Your data is held in India, and Google may process the audio of a recording in the United States. We tell you so here and rely on your consent to use the service on that basis, and on contractual terms with Hostinger and Google that bind them to protect the data to a comparable standard, with the encryption and access controls described above.
Your rights. Access and correction (sections 21 and 22), answered within 30 days; withdrawal of consent; deletion on request. The Do Not Call provisions are not relevant: we never telemarket.
Data breaches. Where a breach is likely to cause significant harm or is of significant scale, we will notify the Personal Data Protection Commission (PDPC) within three calendar days of assessing it as notifiable, and the people affected.
Complaints. Write to our DPO first. You may also complain to the PDPC at pdpc.gov.sg.
4. Malaysia
The law. The Personal Data Protection Act 2010 (PDPA), as amended by the Personal Data Protection (Amendment) Act 2024, whose provisions on data protection officers, breach notification and data portability have been in force since 1 June 2025. The Act binds data users established in Malaysia or using equipment there; we are neither, so it may not strictly apply to us. We follow it anyway. Our Data Protection Officer is Amit Goyal, Wild Cats Media, reachable through the contact form or support@acrossview.com.
Notice and choice. The main policy and its data table are the written notice section 7 requires: what we collect, why, to whom it is disclosed, and that most of it is needed for the service while the AI transcript, a connected calendar and WhatsApp are optional.
Transfer outside Malaysia (section 129). Your data is held in India, and Google may process the audio of a recording in the United States. We have not assessed those destinations as having substantially similar law; we rely on your consent, given by using AcrossView with this notice in front of you, and on the transfer being necessary to perform the service you asked for, with the encryption, access controls and processor terms described above.
Your rights. Access and correction (sections 30 and 34), answered within 21 days; withdrawal of consent (section 38); preventing processing likely to cause damage or distress (section 42); and data portability (section 43A), supplied as JSON. Deletion on request.
Breaches and complaints. We will notify the Personal Data Protection Commissioner, Jabatan Perlindungan Data Peribadi (JPDP), of a breach causing or likely to cause significant harm within 72 hours, and the people affected without delay. Complaints go to our DPO first, then to the Commissioner at pdp.gov.my.
5. South Africa
The law. The Protection of Personal Information Act 4 of 2013 (POPIA). It binds responsible parties domiciled in South Africa or using automated means there; we are domiciled in India and process your data there, so POPIA may not strictly apply to us. We follow it anyway. Our Information Officer is Amit Goyal, Wild Cats Media, reachable through the contact form or support@acrossview.com. He is not registered with the Information Regulator, since we are not a South African responsible party, but he handles every request from South Africa.
Notification (section 18). The main policy and its data table tell you what we collect, why, and who receives it.
Transborder flows (section 72). Your data is held in India, and Google may process the audio of a recording in the United States. Section 72 allows a transfer where the recipient is bound by a law or agreement giving substantially similar protection, or where you consent. We rely on your consent, given by using AcrossView with this notice in front of you, and on our processor terms with Hostinger and Google, which bind them to protect the data and pass the same duties on.
Your rights (section 5). To access your data (section 23) and have it corrected or deleted (section 24), answered within 30 days; to object to processing on legitimate-interest grounds (section 11(3)); not to be subject to a solely automated decision (section 71), of which we make none; and to complain.
Security compromises (section 22). We will notify the Information Regulator and the people affected as soon as reasonably possible after discovering that personal data has been accessed by an unauthorised person.
Complaints. Write to our Information Officer first. You may also complain to the Information Regulator at inforegulator.org.za.
6. United States
The law. There is no comprehensive federal privacy law. California residents have rights under the CCPA as amended by the CPRA, and residents of a growing number of other states have similar ones. We are below most of these laws' size thresholds and not established in the United States, but honour the rights below for any US resident.
What we do not do. We do not sell personal information and do not share it for cross-context behavioural advertising, so no "Do Not Sell or Share My Personal Information" link is needed and none appears. We use no sensitive personal information beyond what providing the service requires, so no "Limit the Use" link is needed either. Because we never sell or share, a Global Privacy Control signal changes nothing: every visitor is treated as opted out already.
Your rights. To know what personal information we have collected about you, from where, why, and with whom it was shared (see the main policy's data table and processor list); to delete it; to correct it; to opt out of sale or sharing, already the case; and not to be discriminated against for asking. Send requests to Amit Goyal through the contact form or support@acrossview.com; we verify them against your account email and answer within 45 days. An authorised agent may act for you.
Where your data is. Our servers are in India, and Google may process the audio of a recording in the United States, under the safeguards described above.
Children (COPPA). AcrossView is not directed at children under 13 and we do not knowingly collect personal information from them; tell us if you believe one has, and we will delete it.
Complaints. Write to us first. Your state attorney general or, in California, the California Privacy Protection Agency, takes complaints.
7. United Arab Emirates
The law. Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL), overseen by the UAE Data Office, applies to controllers outside the UAE that process the data of people in the UAE. When this notice was written the PDPL's executive regulations were still being finalised; we will update this section when they are issued. The DIFC and ADGM have their own laws for companies based there; we are in neither. The main policy and its data table are the information Article 13 requires.
Cross-border transfer (Articles 22 and 23). Your data is held in India, and Google may process the audio of a recording in the United States. Article 22 permits transfers to countries the Data Office recognises as adequate; neither has been so recognised. Article 23 permits transfers without that recognition under a contract binding the recipient to the PDPL's standards, with your express consent after being told the transfer is international, or where necessary for a contract with you. We rely on all three: our processor terms, your consent given by using AcrossView with this notice in front of you, and the necessity of providing the service you asked for.
Your rights (Articles 13 to 18). To be informed; to access and receive a copy of your data; to have it corrected or erased; to restrict or object to processing; to portability, supplied as JSON; and not to be subject to automated decisions with legal effect, of which we make none. Amit Goyal answers within 30 days through the contact form or support@acrossview.com.
Breaches and complaints. We will notify the UAE Data Office and the people affected of a breach that threatens their privacy within the time the regulations set. Complaints go to us first, then to the UAE Data Office.
8. Saudi Arabia
The law. The Personal Data Protection Law (PDPL), issued by Royal Decree M/19 of 2021 and amended in 2023, fully enforceable since 14 September 2024, overseen by the Saudi Data and Artificial Intelligence Authority (SDAIA). It applies to any entity outside the Kingdom that processes the personal data of people living in it, so it applies to us. The main policy and its data table are the privacy notice Article 12 requires.
Transfer outside the Kingdom. Your data is held in India, and Google may process the audio of a recording in the United States. Under Article 29 and the Data Transfer Regulations, a transfer may rest on an adequacy assessment, on appropriate safeguards such as standard contractual clauses, or, for transfers that are not large-scale, on your consent or on necessity to perform a contract with you. We transfer with your consent, given at the point of use with this notice in front of you, and as needed to provide the service you requested, with the encryption, access controls and processor terms described above. We have not yet adopted SDAIA's standard contractual clauses in our own contracts and will do so before promoting AcrossView in the Kingdom.
Your rights (Article 4). To be informed of the legal basis and purpose of processing; to access your data and obtain a copy in a readable format; to have it corrected, completed or updated; and to have it destroyed when it is no longer needed. Amit Goyal answers within 30 days through the contact form or support@acrossview.com.
Breaches and complaints. We will notify SDAIA of a breach within 72 hours of learning of it, and the people affected without undue delay where it may harm them. Complaints go to us first, then to SDAIA at sdaia.gov.sa.
9. Kuwait
The law. Kuwait has no comprehensive personal-data law yet. The Communication and Information Technology Regulatory Authority's Data Privacy Protection Regulation (Decision No. 26 of 2024) applies to telecommunications and ICT licensees in Kuwait; we are not a CITRA licensee, so it does not bind us directly, but we meet its core expectations: a published policy, consent for optional uses, security measures, and deletion when data is no longer needed. Law No. 63 of 2015 on Combating Information Technology Crimes makes unauthorised access to systems and data a crime, which is one reason we keep connection records and work with police on valid requests when someone misuses AcrossView.
What we give you. Kuwait residents have every right in our main policy: a summary of the data we hold about you and who it was shared with, correction, erasure, and a complaint to us. On request we also honour GDPR-style rights: a full copy of your data, restriction, portability as JSON, objection to processing based on our legitimate interests, and withdrawal of consent for optional things such as the AI transcript of a recording. Amit Goyal answers within 30 days through the contact form or support@acrossview.com.
Where your data is. Our servers are in India, and Google may process the audio of a recording in the United States, under the safeguards described above. We make no automated decisions with legal effect and send no marketing.
Complaints. Write to us first; we acknowledge within 24 hours. For matters within CITRA's remit you may also contact CITRA at citra.gov.kw. If a comprehensive law is enacted, we will update this section.
10. Qatar
The law. Law No. 13 of 2016 on Personal Data Privacy Protection, supervised by the Compliance and Data Protection department of the National Cyber Governance and Assurance Affairs (NCGAA) at the National Cyber Security Agency. The main policy and its data table give the information Article 9 requires before processing. Processing rests on your consent, given by using AcrossView with this notice in front of you, and on the necessity of providing the service you asked for; the AI transcript of a recording, a connected calendar and WhatsApp are optional. The Qatar Financial Centre has its own rules for firms based there; we are not one.
Where your data is. Our servers are in India, and Google may process the audio of a recording in the United States. Article 15 forbids a transfer abroad that would breach the Law or cause serious harm to you; we take the precautions the Law expects, the encryption, access controls and processor terms described above.
Your rights. To access your personal data and receive a copy; to have it corrected; to have it erased when it is no longer needed for the purpose it was collected for; to withdraw your consent at any time; and to object to processing that is unnecessary, excessive or discriminatory. Amit Goyal answers within 30 days through the contact form or support@acrossview.com.
Breaches and complaints. If a breach is likely to cause serious harm to your data or privacy, we will notify the Compliance and Data Protection department and you without delay. Complaints go to us first, then to that department at ncsa.gov.qa.
If we change these notices we will update the date at the top; significant changes will be announced on this website before they take effect.