Privacy Notice

1. Data Controller and Contact

TRUSTGRID.AI is the data controller in respect of personal data collected via our website and for our own marketing and operational purposes. Where an enterprise customer uses our Services to process personal data of its employees, customers or suppliers, that customer may be the data controller and TRUSTGRID.AI may act as a data processor pursuant to the applicable agreement.

For any queries regarding this Notice or to exercise applicable rights, contact:

2. Categories of Personal Data Processed

We may process the following categories of personal data:

• Identity and contact data, such as name, email address, telephone number, company name and job title.
• Account and transactional data, such as login credentials and billing information processed through third-party payment processors.
• Communications data, including correspondence, support requests, enquiries and feedback.
• Usage and technical data, including IP address, device identifiers, browser type, pages visited, session data, cookies and similar technologies.
• Service-related data uploaded or inputted by customers into the Platforms, which may include personal data of third parties.
• In limited cases, sensitive or special-category personal data only where expressly provided by the data principal and processed on a lawful basis under applicable law.

We do not intentionally collect personal data of children under 18 years of age.

3. Purposes of Processing and Lawful Bases

We process personal data for purposes including:

• Providing, maintaining and supporting the Services.
• Account administration, billing and customer support.
• Improving Services, product performance and user experience.
• Security, fraud prevention, abuse detection and access control.
• Analytics and service performance measurement.
• Non-intrusive marketing and communications where permitted by law.
• Marketing communications, optional cookies and optional AI model improvement where consent is required and obtained.
• Compliance with legal, regulatory, tax, accounting and reporting obligations.
• Establishing, exercising or defending legal claims.

Where applicable, processing may rely on performance of a contract, consent, legitimate uses/interests, compliance with legal obligations, or another lawful basis recognised by applicable law.

4. Disclosure of Personal Data

We do not sell personal data.

We may disclose personal data:

• To processors and sub-processors providing hosting, analytics, payment, communication, security and related services under appropriate contractual protections.
• To professional advisers, auditors and consultants subject to confidentiality obligations.
• Where required by law, regulation, court order or valid legal process.
• In connection with a merger, acquisition, financing, restructuring or sale of assets, subject to appropriate safeguards.
• With the data principal’s consent or as otherwise permitted by applicable law.

A current list of material sub-processors may be made available upon reasonable request, subject to confidentiality and security considerations.

5. International Transfers

Personal data may be transferred to and processed in jurisdictions outside the data principal’s country of residence, including India and other countries where TRUSTGRID.AI or its service providers operate.

Where required by applicable law, including for transfers from the EEA or UK, we implement appropriate safeguards such as Standard Contractual Clauses or other recognised transfer mechanisms.

Where data is transferred to third parties, TRUSTGRID.AI seeks to use reasonable contractual, organisational and technical safeguards appropriate to the nature of the processing.

6. Data Security

We implement reasonable and appropriate technical and organisational measures designed to protect personal data, including, where appropriate:

• Encryption in transit and at rest.
• Access controls and authentication mechanisms.
• Multi-factor authentication where supported.
• Monitoring and security controls.
• Regular security assessments and reviews.
• Measures designed to prevent unauthorised access, disclosure, alteration or destruction.

7. Retention

We retain personal data only for as long as reasonably necessary to fulfil the purposes for which it was collected, comply with legal, accounting or reporting obligations, resolve disputes, enforce agreements, or establish, exercise or defend legal claims.

When personal data is no longer required, it will be securely deleted, anonymised or otherwise handled in accordance with applicable law and our retention procedures.

8. Data Principal Rights

Subject to applicable law, individuals may have rights including:

• Access to personal data.
• Correction and completion of inaccurate or incomplete data.
• Erasure/deletion where legally applicable.
• Withdrawal of consent where processing is based on consent.
• Data portability where applicable.
• Restriction of or objection to certain processing where applicable.
• Rights relating to sale or sharing of personal information under applicable CCPA/CPRA requirements.
• The right to lodge a complaint with a competent supervisory authority or the Data Protection Board of India, where applicable.

Requests may be submitted to compliance@trustgrid.ai.

We may verify the identity and authority of a requester and may refuse or limit requests where permitted by applicable law, including requests that are manifestly unfounded, excessive or repetitive.

9. Cookies and Similar Technologies

We may use strictly necessary cookies and, where applicable, analytics, performance, functionality and other similar technologies.

Where consent is required, we will seek consent before using non-essential cookies or similar technologies.

Users may manage cookie preferences through our cookie-management mechanisms where available and through browser settings.

10. Children's Data

Our Services are not directed to individuals under 18 years of age.

We do not knowingly process children's personal data except where permitted and appropriately authorised under applicable law. If we become aware that personal data has been collected from a child in circumstances where it should not have been collected, we will take reasonable steps to delete it or otherwise handle it as required by applicable law.

11. Personal Data Breach

We maintain processes intended to detect, assess, respond to and, where legally required, notify relevant authorities and affected individuals regarding personal data breaches.

Any notification will be made within the timeframes and through the channels required by applicable law.

TRUSTGRID.AI shall not be liable for delays caused by circumstances beyond its reasonable control, provided that we continue to take legally required and reasonably practicable steps.

12. AI-Specific Disclaimers and Safe Harbours

13. Third-Party Services, Links and Content

Our Services and website may contain links to, or integrations with, third-party websites, applications, payment providers, analytics services, cloud infrastructure, blockchain networks, IoT platforms and other services.

TRUSTGRID.AI does not control third-party privacy practices, content, security or availability and is not responsible for third-party processing.

Users should review the applicable privacy notices and terms of third-party providers before using their services.

14. Limitation of Liability and General Disclaimers

To the fullest extent permitted by applicable law:

• TRUSTGRID.AI, its directors, officers, employees, agents and affiliates shall not be liable for indirect, incidental, special, consequential, punitive or exemplary damages arising from or relating to this Notice or the processing of personal data.
• Subject to mandatory law and applicable contractual terms, TRUSTGRID.AI's aggregate liability arising from or relating to this Notice or data processing shall not exceed the fees actually paid by the relevant customer to TRUSTGRID.AI during the twelve (12) months preceding the event giving rise to the claim, or INR 1,00,000, whichever is lower.
• Nothing in this Notice excludes liability that cannot lawfully be excluded or limited.
• This Notice is primarily provided for transparency regarding privacy and data processing and does not by itself create contractual rights beyond those provided by applicable law or incorporated contractual documents.
• TRUSTGRID.AI shall not be liable for acts or omissions undertaken in good faith to comply with applicable law, regulatory guidance or lawful directions of competent authorities, except to the extent liability cannot legally be excluded.
• TRUSTGRID.AI shall not be responsible for failures or delays caused by events beyond its reasonable control, including natural disasters, war, terrorism, civil disturbances, government action, fire, flood, accidents, pandemics, strikes, shortages, telecommunications failures, cloud infrastructure failures or Internet outages.

15. Changes to this Notice

We may update this Privacy Notice from time to time.

Material changes may be communicated by posting the revised Notice on our website and, where appropriate, by email, in-product notification or another reasonable method.

The “Last Updated” date at the top of this Notice indicates when it was most recently revised.

16. Governing Law and Jurisdiction

This Notice is governed by the laws of India.

Subject to mandatory data protection and consumer rights, disputes arising out of or in connection with this Notice shall be subject to the jurisdiction of the competent courts in Bengaluru, Karnataka.

17. Severability and Related Documents

If any provision of this Notice is held to be invalid or unenforceable, the remaining provisions will continue to apply to the fullest extent permitted by law.

This Notice should be read together with applicable Terms of Service, Data Processing Agreements, Cookie Notice, consent mechanisms and other contractual or legal documents governing the Services.