SUBPROCESSORS & AI DATA USE NOTICE
This Subprocessors & AI Data Use Notice (“Notice”) explains how XploroTech Solutions Private Limited (“XploroTech”, “we”, “us”, or “our”) uses approved service providers in connection with VENTA Xploro POS, VENTA Admin, VENTA Insights, VENTA Captain, Xploro AI, related applications, APIs, integrations, support services, and future VENTA-branded services.
This Notice should be read together with the Master Service Agreement, Data Processing Addendum, Privacy Notice, Xploro AI Addendum, and Data Retention & Customer Exit Policy.
1. Purpose of This Notice
XploroTech uses certain third-party providers to host, operate, secure, support, monitor, improve, and deliver VENTA and Xploro AI.
A “Subprocessor” is a third party engaged by XploroTech that may process Customer Data or Personal Data on behalf of XploroTech and its Customers while delivering the Services.
This Notice identifies the categories of providers used by XploroTech, the purpose for which they may process data, and the types of information they may receive.
2. Data Categories
Depending on the relevant Service and feature, a Subprocessor may process one or more of the following:
a. account, contact, billing, and subscription information;
b. customer, guest, reservation, order, invoice, payment-reference, loyalty, membership, inventory, supplier, and operational data;
c. employee, user, outlet, access-permission, login, audit, device, and activity information;
d. technical logs, crash reports, error details, diagnostic information, and security records;
e. support tickets, attachments, screenshots, communication records, and training information;
f. AI prompts, queries, report requests, schemas, metadata, code fragments, logs, AI outputs, and AI usage records; and
g. aggregated or de-identified service-usage and performance information.
XploroTech does not require users to submit passwords, OTPs, PINs, full payment-card numbers, CVV details, private keys, API secrets, or similar authentication information through ordinary VENTA or Xploro AI workflows.
3. General Data Use Commitments
3.1 XploroTech uses Subprocessors only where reasonably necessary to provide, secure, support, maintain, and improve the Services.
3.2 XploroTech requires relevant Subprocessors to be bound by contractual or legal obligations appropriate to the services they provide, including confidentiality, security, and data-processing commitments where applicable.
3.3 XploroTech will not sell Customer Data.
3.4 Unless the Customer separately opts in through a written agreement or expressly enabled product setting, XploroTech will not use Customer Data, AI Inputs, AI Outputs, source code, schemas, support logs, or other Customer-specific information to train a general-purpose AI model.
3.5 XploroTech may use aggregated and de-identified information that does not reasonably identify a Customer or individual for security, quality assurance, analytics, capacity planning, benchmarking, product improvement, and research.
3.6 Subprocessor processing locations, retention periods, and provider-specific controls may vary depending on the applicable service, account configuration, selected region, technical architecture, and legal requirements.
4. Current Subprocessors and Service Providers
The following table identifies the current categories of approved Subprocessors and service providers used by XploroTech.
| Provider / Service | Purpose | Data That May Be Processed | Processing Location | Data Use and Retention |
|---|---|---|---|---|
| OpenAI, L.L.C. (API Platform) | AI model inference, natural-language analysis, report generation, summarisation, classification, code assistance, troubleshooting, and related AI functions where enabled or routed through OpenAI. | Authorised AI Inputs, selected report data, schema details, logs, code fragments, support information, and AI Outputs. | as configured | Processed under XploroTech’s applicable account, API configuration, provider terms, and retention settings. Do not state a specific retention period unless verified from your actual account configuration. |
| Anthropic, PBC (API) | AI model inference, natural-language analysis, report generation, summarisation, classification, code assistance, troubleshooting, and related AI functions where enabled or routed through Anthropic. | Authorised AI Inputs, selected report data, schema details, logs, code fragments, support information, and AI Outputs. | as configured | Processed under XploroTech’s applicable account, API configuration, provider terms, and retention settings. Do not state a specific retention period unless verified from your actual account configuration. |
| Contabo GmbH | Application hosting, virtual servers, databases, file storage, networking, backup, disaster recovery, and infrastructure security. | Customer Data, Personal Data, application data, transaction data, logs, backups, and technical records. | India, Germany and/or United States, depending on the Customer deployment, backup and disaster-recovery configuration. | Used for hosting and infrastructure operations. Retained according to XploroTech configuration, backup schedules, and applicable contractual requirements. |
| Walkover Web Solutions Pvt. Ltd | Transactional SMS, WhatsApp, text and service notifications; OTPs where enabled; invoice notices, support updates and customer messaging initiated by the Customer. | Contact details, message content, delivery status, and communication metadata. | As described in the provider’s applicable privacy policy, data-processing terms and account configuration. | Used only for authorised communications and service delivery. |
| Razorpay Software Private Limited | subscription invoices, online subscription payments, refunds, payment references.. | Billing contact details, invoice details, payment-reference information, transaction status, and bank/payment metadata. | As described in the provider’s applicable privacy policy, data-processing terms and account configuration. | Used for subscription and billing operations. XploroTech should not store sensitive payment-authentication data unless expressly designed and compliant to do so. |
| Pine Labs | in-store payment-terminal or payment-integration data, only if VENTA actually integrates with Pine Labs. | Billing contact details, invoice details, payment-reference information, transaction status, and bank/payment metadata. | As described in the provider’s applicable privacy policy, data-processing terms and account configuration. | Used for subscription and billing operations. XploroTech should not store sensitive payment-authentication data unless expressly designed and compliant to do so. |
5. AI Provider Routing and Data Use
5.1 XploroTech may use one or more Approved AI Providers depending on:
a. the AI feature being used;
b. model capability;
c. performance and availability;
d. security and safety requirements;
e. regional or hosting configuration;
f. service cost and capacity;
g. data-protection requirements; and
h. technical compatibility.
5.2 XploroTech may route an AI request to an XploroTech-hosted model, OpenAI, Anthropic, or another approved AI Provider listed in this Notice.
5.3 XploroTech may change model versions, routing logic, provider selection, safety systems, retrieval systems, and technical architecture without changing the core purpose of the AI Service.
5.4 AI Providers may process AI Inputs and AI Outputs for service delivery, security, abuse prevention, quality assurance, legal compliance, and other purposes permitted by XploroTech’s agreement and configuration with that provider.
5.5 XploroTech will use reasonable efforts to minimise the data sent to AI Providers and to apply access controls, tenant boundaries, data filtering, redaction, masking, or other safeguards where technically appropriate.
5.6 AI Outputs may be inaccurate, incomplete, outdated, biased, or unsuitable for a particular purpose. Users must independently review and validate AI Outputs before reliance, implementation, filing, publication, or deployment.
6. Direct Customer Integrations
6.1 Certain Services may connect with third-party platforms selected or authorised directly by the Customer, including payment gateways, delivery aggregators, accounting platforms, communication tools, hardware systems, loyalty providers, marketplaces, and external APIs.
6.2 A third party directly selected, contracted, and controlled by the Customer may not be an XploroTech Subprocessor.
6.3 The Customer is responsible for reviewing the terms, privacy notices, data practices, and security arrangements of direct third-party integrations.
6.4 XploroTech is not responsible for the privacy practices, availability, functionality, pricing, retention, security, or changes of direct third-party services, except to the extent directly caused by XploroTech’s breach of its agreement with the Customer.
7. Changes to Subprocessors
7.1 XploroTech may add, remove, replace, or change Subprocessors where reasonably necessary to provide, secure, support, improve, or operate the Services.
7.2 Where reasonably practicable, XploroTech will update this Notice before a material new Subprocessor begins processing Customer Personal Data.
7.3 For material changes, XploroTech may provide notice through this page, the VENTA Legal Centre, email, dashboard notice, app notice, or another reasonable electronic method.
7.4 If the Customer has a reasonable data-protection objection to a material new Subprocessor, the Customer must notify XploroTech in writing within fifteen (15) days after the relevant notice.
7.5 XploroTech and the Customer will work in good faith to address a reasonable objection. If the objection cannot reasonably be resolved, XploroTech may discontinue the affected feature or Service for that Customer, and the Customer may terminate the affected Service in accordance with the Master Service Agreement and applicable commercial terms.
8. Data Transfers and Retention
8.1 Customer Data may be processed in India and in other countries or territories where XploroTech, its Subprocessors, cloud providers, backup providers, support providers, or AI Providers operate.
8.2 XploroTech will take reasonable steps to ensure that international processing is carried out in accordance with applicable law and appropriate contractual, technical, and organisational safeguards.
8.3 Retention of Customer Data, Personal Data, AI Inputs, AI Outputs, logs, backups, and support records is governed by the Privacy Notice, Data Processing Addendum, Xploro AI Addendum, and Data Retention & Customer Exit Policy.
8.4 XploroTech may retain information where necessary for legal compliance, tax, security, audit, fraud prevention, backup, disaster recovery, dispute resolution, enforcement of agreements, or other lawful business purposes.
9. Contact
For questions about Subprocessors, AI Providers, data processing, or this Notice, contact:
Privacy / Grievance Contact: xploro@xplorotech.com
Security Incident Reporting: xploro@xplorotech.com
AI Support: xplorocare@xplorotech.com
Legal Notices: xploro@xplorotech.com
VENTA Legal Centre: https://www.venta-pos.com/legal
