Privacy Policy

StratVeda Technologies Private Limited (StratVeda, we, us) is a company incorporated in India with CIN U62099PN2025PTC245353 and its registered office at Celesta Neo, Flat No. 104, Spine Road, near Chikhali, Haveli, Pune, Maharashtra 411062, India. You can contact us at hello@stratvedatech.com.

This policy covers personal data processed through (a) the StratVeda OS application, including the Workspace, AI Agents, Evidence Library, billing and support, and (b) the StratVeda OS marketing pages, contact form and newsletter sign-up (together, the Service).

This policy does not cover (a) StratVeda's corporate website at stratvedatech.com to the extent it is operated separately from the StratVeda OS pages, (b) consulting, advisory or other professional services provided under a separate engagement, which are covered by the privacy terms in that engagement, or (c) third-party websites and services that we link to, such as identity providers and Razorpay, which have their own policies.

StratVeda as Data Fiduciary or controller. We decide why and how personal data is processed, and are the Data Fiduciary under India's Digital Personal Data Protection Act, 2023 (DPDP Act) and the controller under the EU and UK General Data Protection Regulation (GDPR), for: Account and authentication data; Company Profile details that identify you; billing records; communications with us; newsletter subscriptions; and technical, security and activity data.

StratVeda as Data Processor or processor. Customer Content may contain personal data about people other than you, such as your employees, customers or suppliers. Where our Customer is an organisation, we process that personal data on the Customer's behalf and on its documented instructions, under the StratVeda OS Data Processing Agreement. The Customer is the Data Fiduciary or controller for that personal data and is responsible for giving notices and obtaining any consents required. Individuals whose data appears in Customer Content should contact the relevant Customer first; we will assist the Customer as the Data Processing Agreement requires.

Where an individual uses the Service for their own business without an organisation behind them, we act as Data Fiduciary for their own personal data and for the Customer Content they submit, and this policy applies to it in full.

We collect the following categories of personal data:

We do not ask for and do not need sensitive personal data such as health, biometric, financial-account or government-identity information. You should not include it in Customer Content (see clause 13).

If you do not provide Account or Company Profile data that we mark as required, we cannot provide the Service. Other information is optional.

We use personal data for the following purposes. The legal bases listed apply where the GDPR applies; clause 5 explains the position under Indian law.

We do not use personal data for advertising, we do not sell personal data, and we do not share it for cross-context behavioural advertising.

Under the DPDP Act, we process personal data on the basis of your consent, given through this notice when you create an Account, submit information or subscribe to the newsletter, or for a legitimate use permitted by section 7 of the DPDP Act, such as compliance with law.

Your consent is limited to the purposes described in this policy. You may withdraw consent at any time, as easily as you gave it, by writing to hello@stratvedatech.com or, where available, by using the controls in the Service. Withdrawal does not affect processing carried out before it, and we may be unable to continue providing the Service if consent needed to provide it is withdrawn.

The DPDP Rules, 2025 were published on 14 November 2025 and come into force in phases. Most obligations of Data Fiduciaries, including the notice, security, breach-intimation and Data Principal rights provisions, apply from 14 May 2027. Until then, the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 continue to apply to the extent they remain in force. This policy is designed to meet both regimes.

Where we support it, you may consent through a registered Consent Manager once Consent Managers are operational under the DPDP Rules.

To run interviews, analyse files and prepare Decision Briefs, we send relevant Company Profile details, decision content, extracted text from Customer Files and earlier conversation turns to the AI Agents. The AI Agents run on Microsoft Azure AI Foundry agent services operated on our behalf. The underlying AI models are supplied by OpenAI and made available to us through Microsoft Azure.

We share only the information needed for the task. Contact details such as your email address and phone number are not sent to the AI Agents for interviews.

No training. We do not use your Customer Content or Output to train, fine-tune or otherwise improve AI models, and we use AI Providers whose terms for our use of their services do not permit them to use your Customer Content to train their models.

Your Customer Content is used only within your own Workspace and is not shown to other customers.

Output is generated automatically and may be wrong. Each Decision Brief shows its evidence and Decision Confidence Score so that you can review it. You make the final decision.

We do not make decisions about you that produce legal or similarly significant effects based solely on automated processing. The Service supports your business decisions; it does not make decisions about individuals.

We share personal data only with the following recipients:

Our processors act only on our documented instructions under written contracts that require confidentiality and reasonable security safeguards. A current list of subprocessors is maintained in Schedule 3 of the Data Processing Agreement. A copy is available on request from hello@stratvedatech.com.

Service data is hosted on Microsoft Azure. Personal data may be processed in India and in other countries where our service providers, including Microsoft and our AI Providers, operate. Where we transfer personal data across borders, we do so with the safeguards described in this clause.

Under the DPDP Act, we may transfer personal data outside India except to countries or territories that the Government of India restricts by notification, and subject to any requirements the Government specifies.

Where the GDPR applies and personal data is transferred outside the UK or the European Economic Area, we rely on an adequacy decision, or on the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, together with supplementary measures where needed. You may request a copy of the relevant safeguards by writing to us.

We keep personal data only for as long as needed for the purposes in this policy, unless a longer period is required by law:

When retention ends, we delete or irreversibly anonymise personal data, unless further retention is required by law or for the establishment, exercise or defence of legal claims.

We use technical and organisational measures appropriate to the risk, including:

1. (a)encryption of data in transit using TLS;
2. (b)application-level authenticated encryption (AES-256-GCM) of Customer Files, extracted text and personal-data fields before they are stored, with each value bound to its record so that it cannot be swapped or altered unnoticed;
3. (c)keyed hashing (HMAC-SHA-256) so that records can be looked up without storing the underlying value in readable form;
4. (d)passwords hashed with Argon2id and session tokens stored only as hashes;
5. (e)session cookies that are HTTP-only, sent only over HTTPS and restricted with SameSite protection;
6. (f)encryption keys held separately from data in a managed key vault;
7. (g)validation of uploaded files against their declared type, size and structure limits;
8. (h)rate limiting, security headers and access controls on the application;
9. (i)access to production systems limited to personnel who need it for their role; and
10. (j)activity and security logging retained for 365 days.

We do not currently claim any third-party security certification.

No method of transmission or storage is completely secure. You are responsible for keeping your credentials secure and for the content you upload.

If we become aware of a personal-data breach, we will contain it, assess its likely impact and take remedial steps.

Where the DPDP Act applies, we will inform affected Data Principals without delay, in plain language, describing the breach, its likely consequences, the measures taken and the steps you can take, with a contact for questions. We will intimate the Data Protection Board of India without delay and provide a detailed report within 72 hours of becoming aware of the breach, or any longer period the Board allows.

Where the GDPR applies, we will notify the competent supervisory authority within 72 hours where required, and affected individuals without undue delay where the breach is likely to result in a high risk to them.

Where we act as a Data Processor for a Customer, we will notify the Customer as set out in the Data Processing Agreement so that the Customer can meet its own obligations.

We will also report cyber-security incidents to CERT-In where required by its directions.

The StratVeda OS application uses strictly necessary first-party cookies to sign you in and protect the sign-in process. On the website pages, and only if you accept them in the cookie banner, we use Google Analytics and Microsoft Clarity cookies to understand how the website is used, including heatmaps and recordings of how pages are used, with anything typed into forms masked. In the application, and only if you accept them in its own cookie banner, we use Microsoft Clarity to see where people click and scroll; all text and numbers on screen and anything you type are masked, so your business content is never sent to it. You can withdraw either consent at any time with the Cookie settings link. We do not use advertising or cross-site tracking cookies, and the Service does not store personal data in browser local storage. Identity providers and Razorpay may set their own cookies on their own pages when you use them.

The StratVeda OS Cookie Policy lists each cookie, its purpose and duration. If we introduce non-essential cookies, we will update the Cookie Policy and ask for consent before setting them where the law requires.

The Service is for business use by adults. It is not directed at anyone under 18, and we do not knowingly collect personal data of children. If we learn that we have done so without verifiable parental consent where required, we will delete it.

You must not upload sensitive information that the Service does not need, including health records, biometric data, government identity numbers, payment card or bank credentials, passwords, or children's personal data. If such information is uploaded, we will process it only as necessary to provide the Service and you are responsible for having a lawful basis to share it.

Depending on where you are, you have the following rights:

These rights are subject to legal exceptions, for example where we must keep data to comply with law. Where we process data as a Data Processor for a Customer, we will pass your request to that Customer.

You can view and update much of your information in the Service. Your Company Profile and onboarding answers can be edited from the Company profile page. In Settings you can download a copy of your data (a ZIP file of your profile, interview answers, Decision Briefs, orders and uploaded Customer Files) and delete your Account. For any other request, email hello@stratvedatech.com or the Grievance Officer from the address associated with your Account.

We may need to verify your identity before acting on a request. An authorised agent or nominee may make a request on your behalf with evidence of authority.

We aim to respond within 30 days. Where the law allows a longer period, we will tell you if we need it, and we will in any event respond within the maximum period permitted by applicable law (including 90 days under the DPDP Rules, one month extendable by two further months under the GDPR, and 45 days extendable once by 45 days under the California law).

If we refuse a request, we will explain why and how you can escalate it or complain to a regulator.

Grievance Officer: Shubham Hol, Chief Executive Officer, shubham.hol@stratvedatech.com, StratVeda Technologies Private Limited, Celesta Neo, Flat No. 104, Spine Road, near Chikhali, Haveli, Pune, Maharashtra 411062, India.

We will acknowledge a grievance promptly and aim to resolve it within 30 days of receipt, or within any shorter period required by law. If you are not satisfied with our response, you may complain to the Data Protection Board of India once it is accepting complaints, or to your local data protection authority.

General privacy questions: hello@stratvedatech.com.

EU and UK representative: We have not appointed a representative in the EU or UK, as we do not currently offer or market the Service in those regions. We will update this policy if we appoint one.

India. StratVeda is not currently notified as a Significant Data Fiduciary. If we are notified, we will appoint a Data Protection Officer based in India and update this policy.

EU and UK. Our legal bases are listed in clause 4. Where we rely on legitimate interests, you may object, and we will stop unless we have compelling legitimate grounds. Whether the GDPR applies depends on whether we offer the Service to, or monitor, people in the EU or UK. StratVeda OS is offered and marketed primarily to businesses in India, and we do not currently target people in the EU or UK. Where the GDPR nevertheless applies to our processing, the rights in clause 14 apply.

California. In the last 12 months we collected the categories of personal information described in clause 3, which correspond to identifiers, customer records, commercial information, internet or other electronic network activity, professional or employment-related information, and account log-in credentials. We collected them from the sources and for the purposes described in clauses 3 and 4, and disclosed them for business purposes to the categories of recipients in clause 7. We do not sell or share personal information, and we do not use or disclose sensitive personal information for purposes that would give rise to a right to limit.

EU AI Act. The AI Agents interact with you directly, and we tell you that you are interacting with an AI system. The Service is intended for business decision support and is not designed for any use listed as high-risk in Annex III of the EU AI Act.

We will publish any change to this policy with a new version number and effective date.

If a change materially affects how we use your personal data, we will notify you by email or in the Service at least 15 days before it takes effect and, where required, ask for your consent.