Privacy Policy

1. Scope of this Privacy Policy

• All individuals and business users who access or use the Gnanalytica Platform or website
• All personal data processed by Gnanalytica in the course of providing its Services
• All data processed where Gnanalytica acts on behalf of its business clients

Gnanalytica is a business-to-business (B2B) software platform. This means that in most cases, we process data on behalf of our clients, who use our Platform for their own business purposes.

To provide our Services efficiently, we rely on trusted third-party technology partners, including cloud infrastructure providers and artificial intelligence service providers. In certain cases, we may use third-party AI services to generate insights, analytics, or outputs based on the data provided by our clients. These partners act as sub-processors and process data strictly on our instructions and under appropriate contractual, confidentiality, and security safeguards.

2. Our role and your role

For the purposes of applicable data protection laws, including the Digital Personal Data Protection Act, 2023:

• Our clients (i.e., the businesses that subscribe to and use our Platform) act as Data Controllers / Data Fiduciaries
• Gnanalytica acts as a Data Processor

In simple terms, this means:

• Our clients decide what personal data is collected and why
• Gnanalytica processes that data only to provide the Services
• Gnanalytica does not independently decide how or why personal data should be used

3. What personal data we collect

We may collect and process different types of information depending on how you use our Platform.

4. How we collect personal data

We collect personal data in the following ways:

• When you create an account or register on our Platform
• When you log in and use the Services (including via Google Sign-In)
• When you communicate with us via email, chat, or support channels
• When you participate in product demos, onboarding, or training sessions
• Automatically through cookies, logs, and similar technologies

Some information is collected automatically to ensure security, improve performance, and understand how users interact with the Platform.

5. How we use your personal data

We use personal data only for legitimate business purposes, including:

• Providing, operating, and maintaining the Platform
• Enabling AI-based processing and insights
• Managing user accounts and access control
• Responding to support requests and queries
• Improving our features, performance, and user experience
• Ensuring platform security and preventing fraud
• Complying with legal and regulatory obligations
• Sending service-related communications
• Sending marketing communications (where consent has been given)

We do not sell personal data and do not use personal data for unrelated commercial purposes.

6. Legal basis for processing

We process personal data on one or more of the following legal grounds:

• Performance of a contract (to provide the Services you have subscribed to)
• Consent (for marketing communications and optional features)
• Legitimate interests (such as security, analytics, and service improvement)
• Compliance with legal obligations

7. Use of artificial intelligence

Our Platform may use artificial intelligence and machine learning technologies to analyse data and generate insights or recommendations.

These systems:

• Operate based on data provided by our clients
• Are designed to support business decisions and automation
• Do not replace professional or human judgment

AI outputs are intended to be advisory in nature, and users are responsible for validating and verifying any outputs before relying on them.

8. Communications

We may contact you for different types of communications such as:

9. Sharing of personal data

We may share personal data with:

We do not sell or rent personal data to third parties.

10. International data transfers

Some of our systems may store or process data on servers located outside India. When this happens, we ensure appropriate technical and contractual safeguards are in place to protect your data in accordance with applicable laws.

11. Data security

We take data security seriously and implement reasonable technical and organisational measures, including:

• Encryption of data in transit and at rest
• Secure cloud infrastructure
• Access controls and authentication mechanisms
• Monitoring and logging of system activity

While we follow industry best practices, no system can guarantee absolute security.

12. Data retention

We retain personal data only for as long as necessary to:

• Provide the Services
• Meet legal or regulatory requirements
• Resolve disputes
• Enforce our agreements

When data is no longer required, it is deleted or anonymised.

13. Your rights and data deletion

You have the right to:

• Request access to your personal data
• Request correction of inaccurate data
• Request deletion of your data
• Withdraw consent for marketing communications

Upon receiving a valid deletion request, we will delete or anonymise your data within a reasonable period, unless we are legally required to retain it.

14. Cookies and tracking

Cookies are used by us to track content usage and traffic on the Website. We use cookies and similar technologies to keep you logged in, improve security, analyse usage patterns, and enhance user experience.

You can control cookies through your browser settings.

15. Third-party links

Our Platform may contain links to third-party websites or services. We are not responsible for their privacy practices or content.

16. Google API Services

Our Platform uses Google API Services for user authentication (sign-in). Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

• We only request the minimum OAuth scopes necessary for authentication: your basic profile information (openid, email, and profile)
• We do not request access to Google Drive, Google Docs, Gmail, or any other sensitive Google services
• Data received from Google APIs is used solely for authenticating your identity and creating or linking your account on our Platform
• We do not transfer Google user data to third parties except as necessary to provide or improve our Services
• We do not use Google user data for serving advertisements
• We do not allow humans to read Google user data unless we have your affirmative agreement, it is necessary for security purposes, or it is required by law

17. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you via email, the Platform, or our website.

Continued use of the Platform after such updates constitutes acceptance of the revised Policy.