Privacy Policy

1. IDENTITY & CONTACT OF THE DATA FIDUCIARY

Saminus Private Limited ("Saminus AI", "we", "us", "our") is the Data Fiduciary as defined under Section 2(i) of the Digital Personal Data Protection Act, 2023, in respect of the personal data of its registered Users, Agency Owners, and reseller Partners. Our registered address is:

Where Saminus AI deploys its AI Chatbot, QR codes, or review widgets on behalf of its Users (Agency Owners / Business Owners) for their own end-customers, Saminus AI operates as a Data Processor on behalf of the User, who is themselves the Data Fiduciary in that context. See Section 5 for detailed chatbot-specific provisions.

2. DUAL ROLE UNDER THE DPDP ACT, 2023

3. PERSONAL DATA WE COLLECT (AS DATA FIDUCIARY)

The following categories of personal data are collected from registered Users during account creation, subscription, and platform usage:

Category	Specific Data Points	Purpose	Legal Basis
Identity & Contact	Full Name, Business Name, Mobile Number, Email Address	Account creation, service delivery, billing communication	Consent (DPDP Act, Sec. 6)
Business & Tax Data	GST Number, Business Address, PAN (if required for invoicing)	Invoice generation, GST compliance, legal obligations	Legal Obligation (Sec. 7 DPDP Act)
Payment & Billing	Subscription plan, transaction IDs, payment gateway references	Payment processing, refund handling, fraud prevention	Contract performance; we do NOT store full card data
System & Technical	IP Address, Browser Type, Operating System, Session Logs, API usage logs	Security monitoring, abuse prevention, rate-limiting, debugging	Legitimate interest (Sec. 7(e) DPDP Act)
Usage Analytics	Pages visited, features used, QR scans generated, chatbot interactions	Service improvement, feature development, support	Consent

We do NOT collect sensitive personal data such as biometric data, health records, caste/religion, sexual orientation, or financial passwords from our registered Users.

4. CONSENT MECHANISM (DPDP ACT, 2023 — SECTION 6)

In compliance with Section 6 of the DPDP Act, 2023, Saminus AI obtains explicit, informed, and specific consent from Data Principals (Users) before processing their personal data. The consent mechanism operates as follows:

• Registration Consent: During account registration, the User accepts this Privacy Policy and the Terms of Service via a positive affirmative action (checkbox or click-through), which constitutes valid consent under the DPDP Act.
• Withdrawal of Consent: Users have the right to withdraw consent at any time by submitting a written request to our Grievance Officer. Withdrawal of consent may result in inability to continue the Service. Data deletion post-withdrawal shall be completed within 30 days.
• Consent Records: Consent timestamps and IP addresses are securely logged for audit and compliance purposes.

5. AI CHATBOT DEPLOYMENT — DATA PROCESSOR PROVISIONS & USER LIABILITY

The following provisions govern the data processing relationship in Chatbot deployment scenarios:

• User as Data Fiduciary: The Client/Agency Owner who deploys the Chatbot bears full legal responsibility under the DPDP Act, 2023 for obtaining lawful consent from their end-customers before any personal data is collected via the Chatbot interface.
• Sensitive Data Prohibition: The Chatbot is strictly NOT designed or authorized to collect Sensitive Personal Data including credit card numbers, CVV codes, Aadhaar numbers, OTPs, banking credentials, health data, or passwords. Any User who configures or allows their Chatbot to solicit such sensitive information from end-customers does so in direct violation of these Terms and assumes full criminal and civil liability for any consequences arising therefrom.
• Zero Liability for Chatbot-Collected Data: Saminus Private Limited bears absolutely no liability for the nature, content, or sensitivity of data voluntarily submitted by end-customers into the Chatbot interface, for any breach, misuse, or regulatory action relating to data collected by the Chatbot on the User's deployment, or for the adequacy of any consent mechanism deployed by the User on their end-customer-facing interface.
• Data Residency: Chatbot conversation logs are stored in encrypted form on Indian servers and are accessible only to the User who deployed the respective Chatbot instance. Saminus AI does not access, analyze, or monetize individual chatbot conversation transcripts.
• Data Processing Agreement (DPA): By accepting these Terms, the User enters into a standard Data Processing Agreement with Saminus Private Limited. If a specific written DPA is required for enterprise compliance, please contact info@saminusai.com.

6. HOW WE USE YOUR PERSONAL DATA

Saminus Private Limited processes personal data exclusively for the following documented, legitimate purposes:

• Providing, maintaining, and improving the Platform and its features.
• Processing subscription payments, issuing GST-compliant tax invoices, and managing refunds.
• Communicating service updates, security alerts, and product notifications (transactional emails).
• Detecting, investigating, and preventing fraudulent transactions, unauthorized access, and abuse of the Platform.
• Complying with legal obligations under applicable Indian law, including responding to lawful government requests and court orders.
• Conducting internal analytics and business intelligence to improve service quality (using anonymized/aggregated data only).

We will NEVER sell, rent, or trade your personal data to third-party marketers or advertisers.

7. DATA SHARING & THIRD-PARTY DISCLOSURE

Personal data may be shared with the following categories of entities strictly on a need-to-know, contractually protected basis:

• Payment Gateways: Razorpay and PhonePe, for the purpose of processing subscription payments. These entities are subject to RBI regulations and PCI-DSS compliance. We do not store full payment card details.
• Cloud Infrastructure Providers: Server and storage providers hosting the Platform. These providers process data only on our instructions and are bound by data processing agreements.
• Email Service Providers: For sending transactional emails (invoices, OTPs, system notifications).
• Law Enforcement & Government Agencies: When required by a lawful court order, government directive, or legal process under Indian law. In such cases, data will be disclosed only to the extent legally required.
• Professional Advisors: Lawyers, auditors, and accountants, subject to professional confidentiality obligations.

We do not transfer personal data outside the territory of India without appropriate safeguards and, where required, prior explicit consent, in accordance with Section 16 of the DPDP Act, 2023 and any subsequent cross-border data transfer rules notified by the Central Government.

8. DATA SECURITY & ZERO LIABILITY FOR EXTERNAL BREACHES

Saminus Private Limited employs robust, industry-standard technical and organizational security measures including:

• 256-bit SSL/TLS encryption for all data in transit.
• AES-256 encryption for sensitive data at rest.
• Multi-factor authentication (MFA) for administrative access layers.
• Regular automated vulnerability scanning and penetration testing.
• Strict access controls, least-privilege access policies, and audit logging for all data access events.
• Firewall protection, intrusion detection systems, and DDoS mitigation infrastructure.

Notwithstanding the above security measures, the User expressly acknowledges and agrees that:

• No security system is impenetrable. The Company shall not be liable for any data breach, unauthorized access, or data loss caused by sophisticated zero-day exploits, state-sponsored cyberattacks, or advanced persistent threats (APTs) that bypass commercially reasonable security measures.
• The Company shall not be liable for breaches originating from the User's own negligence, including weak passwords, credential sharing, phishing attacks targeting the User's own devices, or compromise of the User's local computing environment.
• The Company shall not be liable for security incidents at third-party service providers (payment gateways, cloud providers) that are outside the Company's direct control.
• In the event of a data breach affecting Users' personal data, the Company shall notify affected Data Principals in accordance with the DPDP Act, 2023 and report the incident to the Data Protection Board of India as required by law.

9. YOUR RIGHTS AS A DATA PRINCIPAL (DPDP ACT, 2023)

As a Data Principal under the DPDP Act, 2023, you have the following rights with respect to your personal data processed by Saminus Private Limited:

Right	Description	How to Exercise
Right to Access (Sec. 11)	Obtain a summary of personal data being processed and processing activities.	Written request to Grievance Officer
Right to Correction (Sec. 12)	Request correction of inaccurate, incomplete, or outdated personal data.	In-platform profile settings or Grievance Officer
Right to Erasure (Sec. 12)	Request deletion of personal data where it is no longer necessary for the stated purpose, subject to legal retention obligations.	Written request to Grievance Officer
Right to Grievance Redressal (Sec. 13)	Lodge a complaint regarding data handling practices; receive timely response.	Grievance Officer (details in Section 11)
Right to Nominate (Sec. 14)	Nominate another individual to exercise rights in the event of death or incapacitation.	Written request to Grievance Officer
Right to Withdraw Consent	Withdraw consent previously given; may result in service discontinuation.	Written request to Grievance Officer

All rights-related requests shall be acknowledged within 48 hours and addressed within 30 days of receipt. Requests may be subject to identity verification to prevent fraudulent access.

10. DATA RETENTION & DELETION POLICY

In accordance with the Digital Personal Data Protection (DPDP) Act, 2023, and applicable Indian laws, Saminus Private Limited retains personal data only for as long as necessary to fulfill the stated purposes or for statutory compliance:

10.1. Account Deletion & Cascading Deletion

When you permanently delete your account, or if your account is terminated due to a terms violation, an automated cascading deletion of your operational data is executed. Your dynamic QR codes, mini-website configurations, smart chat widget settings, custom branding (white-label settings), chatbot training data, and short URLs will be permanently and irreversibly erased from our active servers within 30 days. This process is completely irreversible.

10.2. Mandatory Data Retention (Legal & Financial Compliance)

To comply with the Information Technology Act, 2000, taxation laws (Companies Act, 2013 and CGST Act, 2017), and to prevent fraud, financial manipulation, or cyber abuse, we explicitly reserve the right to retain specific categories of data, which are securely orphaned (detached) from your personal profile identifier to maintain strict privacy:

• Financial & Invoice Records: Retained for 8 years in compliance with Section 36 of the CGST Act, 2017, the Companies Act, 2013, and tax audit mandates.
• Business Interactions: End-user interactions, including landing page enquiries, restaurant orders, and submitted review feedback, are retained indefinitely as anonymized/aggregated analytics to preserve the historical transaction and performance statistics of the Platform.
• Abuse & Compliance Logs: Reports of abuse, terms of service violations, and compliance logs are retained to protect our infrastructure, secure our servers, and cooperate with official law enforcement audits.

10.3. System Logs & Automated Pruning (CERT-In Compliance)

Our infrastructure employs automated data lifecycle management to ensure platform speed and security:

• Short-Term Logs: Raw operational analytics, including QR scan IPs, landing page visits, and rate-limit logs, are aggregated for your dashboard and permanently purged from active raw logs within 30 days.
• Security & Audit Logs: In strict compliance with the Indian Computer Emergency Response Team (CERT-In) guidelines, all system audit logs, administrative actions, and critical security events are mandatorily retained for a period of 180 days. After this period, these logs are moved to encrypted offline cold storage and securely removed from active databases.

10.4. Law Enforcement Hold

Notwithstanding the automated deletion schedules mentioned above, Saminus Private Limited will suspend the deletion of any data—including operational data and logs—if it is required for an ongoing legal dispute, fraud investigation, or under a valid subpoena or warrant from relevant Indian law enforcement and regulatory authorities.

11. COOKIES & TRACKING TECHNOLOGIES

The Platform uses the following categories of cookies and client-side storage technologies:

• Strictly Necessary Cookies: Session management, authentication tokens, CSRF protection tokens. Cannot be disabled without affecting Platform functionality.
• Performance Cookies: Anonymous page load analytics to optimize Platform speed and performance. No personally identifiable data is linked.
• Preference Cookies: Saving user interface preferences (e.g., language, sidebar state).

We do not use third-party advertising cookies, Facebook Pixel, or cross-site tracking technologies on the authenticated Platform dashboard. You may manage cookie preferences via your browser settings.

12. CHILDREN'S DATA

The Saminus AI Platform is a professional B2B SaaS service intended exclusively for registered business entities and individuals who are at least 18 years of age. The Platform does not knowingly collect any personal data from individuals below 18 years of age. In the context of the DPDP Act, 2023, Saminus AI does not process personal data of children and does not require Verifiable Parental Consent (VPC) for its direct B2B user base.

If a User discovers that personal data of a minor has been inadvertently submitted through the Platform, they must immediately notify the Grievance Officer. Such data shall be promptly deleted.

13. CHANGES TO THIS PRIVACY POLICY

Saminus Private Limited reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable law, or business operations. Material changes will be communicated to registered Users via email notification at least 7 days before the changes take effect. The "Last Updated" date at the top of this document will always reflect the most current version. Continued use of the Platform following such notification constitutes acceptance of the revised Privacy Policy.

14. GRIEVANCE OFFICER (IT ACT RULES, 2021 & DPDP ACT, 2023)

In accordance with Rule 5(9) of the Information Technology (Reasonable Security Practices) Rules, 2011, and the grievance redressal provisions of the DPDP Act, 2023, the Company has designated a Grievance Officer to address all data privacy-related concerns:

If the complaint is not resolved to your satisfaction by the Grievance Officer, you may escalate the matter to the Data Protection Board of India, as established under Section 18 of the DPDP Act, 2023, once the Board is constituted and operational.

15. GOVERNING LAW & JURISDICTION

This Privacy Policy is governed by and construed in accordance with the laws of the Republic of India, including the Digital Personal Data Protection Act, 2023; the Information Technology Act, 2000 and Rules thereunder; and all other applicable Indian statutes.

Any dispute arising out of or relating to this Privacy Policy shall be subject to the exclusive jurisdiction of the competent courts in Hisar, Haryana, India. In the event of a conflict between this Privacy Policy and applicable law, the applicable law shall prevail.

16. ADDENDUM: WhatsApp Business API & Meta Data Handling

In accordance with Meta's developer and Tech Provider specifications for the integration of the WhatsApp Business API, the following additional clauses govern Saminus AI's role in processing WhatsApp-related communications data:

• Data Collection via WhatsApp: As a Meta Tech Provider, Saminus AI facilitates WhatsApp messaging. We may process customer phone numbers, WhatsApp profile names, and messaging logs solely on behalf of our merchants to deliver this service.
• Strict Data Usage: Data processed through the WhatsApp Business API is used exclusively for routing, processing, and delivering customer communications on behalf of our merchants. Saminus AI does not sell, rent, share, or use this communication content or contact data for any secondary purposes, advertising, or direct profiling.
• Data Security & Storage: All data processed under the WhatsApp Business API is handled with industry-standard encryption in transit (HTTPS/WSS) and at rest (AES-256). Backups and server infrastructure are securely maintained under strict compliance protocols.
• Data Portability and Deletion: Merchants and their end-users retain the right to request deletion or export of their communications logs. Deletion requests are processed in accordance with our cascading data deletion policies (retaining records only as required by law).

---

This Privacy Policy was last reviewed and certified by the Legal and Compliance Department of Saminus Private Limited on June 03, 2026. If you have any questions about this Policy that are not addressed above, please contact us at info@saminusai.com.