Privacy policy

This Privacy Policy applies to all individuals and entities who access or use the Website, including visitors, registered users, subscribers, business partners, and any other person who interacts with the Website or the Services offered by Jolto.ai. It governs the collection, use, processing, storage, disclosure and protection of Data and User Content collected through the Website, APIs, artificial intelligence tools, customer support channels, and any other services provided by Jolto.ai. By accessing or using the Website, you acknowledge that you have read, understood and agreed to the terms of this Privacy Policy.

The Services are intended for and available only to persons who are eighteen (18) years of age or older and who are competent to enter into a binding contract under the Indian Contract Act, 1872. By accessing or using the Website, you represent and warrant that you meet these requirements. The Company does not knowingly permit persons who do not meet these requirements to create an account or use the Services, except where the Website is used by a Child in accordance with Section 13 (Children’s Privacy) and applicable law.

This Privacy Policy has been prepared in accordance with the applicable laws of India governing privacy, data protection, electronic records and information security, including the Digital Personal Data Protection Act, 2023, the rules, regulations, notifications and directions issued thereunder from time to time, the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, to the extent applicable, the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, where applicable, the directions and advisories issued by the Indian Computer Emergency Response Team (CERT-In), and all other applicable laws, regulations and governmental directions relating to data protection, cybersecurity and electronic communications.

This document is an electronic record in terms of the Information Technology Act, 2000 and rules thereunder as applicable and the amended provisions pertaining to electronic records in various statutes as amended by the Information Technology Act, 2000. This electronic record is generated by a computer system and does not require any physical or digital signatures.

This document is published in accordance with the provisions of Rule 3(1) of the Information Technology (Intermediaries Guidelines) Rules, 2011, which requires publishing the rules and regulations, privacy policy and Terms of Use for access or usage of the Website.

For the purposes of this Privacy Policy, the following terms shall have the meanings set out below. Terms not defined here shall have the meaning ascribed to them under applicable law, including the Digital Personal Data Protection Act, 2023.

“Data”

means any information relating to you that is collected, received, stored, processed or otherwise handled by the Company through the Website, whether provided by you directly, collected automatically, generated, or received from third parties, and includes Personal Data and Sensitive Personal Data.

“Personal Data”

means any data about an individual who is identifiable by or in relation to such data, as defined under the Digital Personal Data Protection Act, 2023.

“Sensitive Personal Data or Information”

means such categories of personal information as defined under the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, including passwords, financial information such as bank account, card or payment instrument details, and other categories specified thereunder, to the extent applicable.

“Data Principal”

means the individual to whom the Personal Data relates, being the user of the Website.

“Data Fiduciary”

means Jolto.ai, which alone or in conjunction with others determines the purpose and means of processing of Personal Data.

“Processing”

means any operation or set of operations performed on Data, whether or not by automated means, including collection, recording, organisation, structuring, storage, adaptation, retrieval, use, disclosure, dissemination, restriction, erasure or destruction.

“Services”

means the products, features, tools, artificial intelligence functionalities, APIs and services made available by the Company through the Website.

“Cookies”

means small text files and similar technologies placed on your device to enable, secure and improve your use of the Website, as further described in this Privacy Policy and our Cookies Policy.

“Google User Data”

means any information the Company accesses, receives or processes from your Google account or from Google APIs when you sign in with Google or connect Google services to the Website, in accordance with the permissions (scopes) you grant.

“Child”

means an individual who has not completed eighteen (18) years of age.

“User Content”

means any information, data, prompts, text, images, photographs, videos, audio recordings, documents, files, designs, graphics, logos, metadata, instructions, comments, feedback, or any other content uploaded, submitted, transmitted, stored, created or otherwise provided by a user through the Website for the purpose of accessing or using the Services, including the generation of AI-based outputs.

To provide, maintain, improve and secure the Services offered through the Website, the Company may collect, receive, generate, store and process various information collected from the users. The information collected depends on the manner in which the Website is accessed, the Services used, and the interactions between the user and the Company. The categories of information that may be collected include the following:

4.1Information you provide us directly

The Company may collect information that you voluntarily provide while creating an account, subscribing to the Services, contacting us, making payments, or otherwise interacting with the Website. Such information may include, without limitation:

• full name
• username
• email address
• names and other information associated with your account when you log in or access the Services, through single sign-on (SSO) or Google
• mobile or telephone number
• residential or business address
• profile information
• account credentials
• information collected through Statsig Analytics
• information collected through Google Analytics
• session recording and interaction information
• billing and payment information
• registration details, company registration details, tax identification numbers or other business-related information, where applicable
• organisation or company name
• any other information voluntarily submitted by you while using the Website

Where you make payments through the Website, your payment and card details are collected and processed by third-party payment service providers and payment gateways that are compliant with the Payment Card Industry Data Security Standard (PCI-DSS) and other applicable requirements. The Company does not store your complete card number, CVV or other full payment-instrument details on its own systems, and receives only limited transaction and billing information necessary to process and record your payments.

4.2User Content

The Website enables users to upload, submit, store and process content for generating AI-based outputs. In connection with the Services, the Company may collect and process User Content, including but not limited to:

• prompts and instructions
• text
• images and photographs
• audio recordings
• videos
• documents
• graphics, illustrations, logos and design assets
• comments and feedback
• creative assets
• any other content uploaded or generated through the Website

User Content is processed solely for providing the Services requested by the user, improving the functionality of the Website, complying with applicable legal obligations, and for such other purposes as described in this Privacy Policy. The categories of User Content collected and processed may vary from time to time based on the features and functionalities of the Services, subject to applicable law.

4.3Information collected automatically

When you access or use the Website, certain technical and usage-related information may be collected automatically through cookies, log files, application programming interfaces (APIs), analytics tools and similar technologies. Such information may include:

• Internet Protocol (IP) address
• browser type and version
• operating system
• device identifiers
• browser language
• date and time of access
• session identifiers
• referring and exit URLs
• pages visited
• interaction with Website features
• performance metrics
• API usage information
• other technical information necessary for the operation, maintenance and security of the Website

4.4Information we receive from third-party applications or services

We may receive information about you from third parties or Jolto.ai affiliates. For example, if you access the Service through a third-party connection or log-in (such as Google, LinkedIn, Instagram, or other social networking platforms), or by “following,” “liking,” adding the Jolto.ai application, or linking your account to the Website, that third party may provide us with certain information regarding your use of its service. Such information may include, but is not limited to, the user ID associated with your account, an access token required to access that service, any information you have authorized the third party to share with us, and any information you have made publicly available in connection with that service.

You are responsible for reviewing and, if necessary, adjusting your privacy settings on third-party websites and services before linking or connecting them to the Website. You may also unlink your third-party account from the Service by adjusting your settings on the relevant third-party service. If you choose to unlink your account, we will no longer receive information collected about you in connection with that service.

Additionally, if you elect to integrate the Website with third-party applications to incorporate elements into your designs, enhance media, streamline workflows, or share content to social media, we may receive data from such applications (and, in some cases, disclose data to them). If you communicate with us via social media channels, including but not limited to LinkedIn, Instagram, or other similar platforms, and choose to share your user-generated content with us, we may receive information such as videos you have created, photographs, your account name, and any comments or feedback you provide regarding Jolto.ai.

If you prefer not to have your information used for this purpose, you can opt out at any time by emailing us at rishabh@jolto.ai.

4.5Cookies and similar technologies

When you visit or use the Service, Jolto.ai and our third-party partners may create online identifiers and collect information through the use of cookies and similar technologies (“Cookies”). Cookies are small text files that uniquely identify your browser and enable us to provide functionality such as faster log-ins, enhanced navigation, remembering your preferences, and generally improving your user experience. Cookies also transmit information to us about how you interact with the Service (for example, the pages you view, the links you click, and other actions you take), and allow us and our business partners to measure and analyse your usage of the Service over time, measure traffic and usage trends, and evaluate the effectiveness of the Service.

You may control or reset your Cookies through your web browser settings, which allows you to customise your preferences, refuse all Cookies, or receive a notification when a Cookie is being sent. Please note, however, that certain features of the Service may not function properly if Cookies are disabled. You may also opt out of certain analytics tracking; for example, you can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on available at https://tools.google.com/dlpage/gaoptout. For more information about how we use Cookies and related technologies, and how you can manage them, please refer to our Cookies Policy.

4.6Log file information

When you access or use the Service, certain log file information is automatically reported by your browser or mobile device. Our servers record this information as part of their standard operations. These server logs may include details such as your web requests, browser type, referring and exit pages and URLs, the number of clicks, how you interact with links on the Service, domain names, landing pages, pages viewed, and other similar information. This information is generally collected in an anonymous form and is used to monitor, analyse, and improve the performance, security, and overall functionality of the Service.

The Company processes your Personal Data on lawful grounds recognised under the Digital Personal Data Protection Act, 2023 and other applicable laws. Depending on the context, the Company relies on one or more of the following bases: (i) your consent, given through a clear affirmative action; (ii) certain legitimate uses permitted under applicable law, including where you have voluntarily provided your Personal Data and have not indicated that you do not consent to its use; (iii) the performance of a contract or the provision of the Services requested by you; and (iv) compliance with the Company’s legal obligations.

Where processing is based on your consent, the Company will, at or before the time of collection, provide you with an itemised notice describing the Personal Data being collected and the purpose for which it is to be processed, the manner in which you may exercise your rights, and the manner in which you may make a complaint to the Data Protection Board of India. Your consent shall be limited to such Personal Data as is necessary for the specified purpose. You have the right to access the contents of such notice, and this Privacy Policy, in English or in any language specified in the Eighth Schedule to the Constitution of India.

You may withdraw your consent at any time, with effect for the future, by using the account settings available on the Website or by contacting the Grievance Officer at the details provided in this Privacy Policy. The withdrawal of consent shall not affect the lawfulness of processing carried out prior to such withdrawal. Where you withdraw consent, the Company may be unable to continue providing certain features or Services that depend on the relevant processing.

We use the information we collect about you for the purposes set out in this Privacy Policy:

6.1Providing you with the Service

We use information collected about you to deliver and operate the Service. This includes enabling you to log in securely, operating and maintaining the Website, providing you with access to your designs, and processing and billing transactions you make through the Service. We also use information collected automatically to remember your preferences and activity, so that you do not need to re-enter the same information during your current visit or upon returning to the Service in the future.

6.2Service improvement

We use information collected about you to enhance and improve the Service and the overall user experience. This includes monitoring and analysing aggregate metrics such as the total number of visitors, traffic patterns, and demographic trends. Such information helps us better understand how the Service is used, identify opportunities to improve functionality, and ensure that the Website continues to meet the needs of our users.

From time to time, the Company may review User Content where reasonably necessary to respond to customer support requests, investigate technical issues, identify security incidents, detect misuse of the Website, comply with applicable law, or improve the functionality, safety and reliability of the Services.

6.3Analysis of user activity and data for service customization and AI training

We may analyse your activity on the Service, including your User Content, media uploads, and related account data, in order to provide, customize, and enhance the Service. This analysis also supports the training and development of our algorithms, models, and AI-powered products and services through machine learning. By doing so, we aim to continually improve the quality, accuracy, and functionality of the Service.

We may, from time to time, record your usage of the Platform for the purposes of training, modifying, and improving our services (“Usage Records”). Usage Records are collected on a discretionary and non-systematic basis; not all usage sessions are recorded, and the selection of which sessions are retained is randomized and not determined by us on a case-by-case basis. Usage Records are retained for a maximum period of 30 days from the date of collection, following which they are automatically and permanently deleted from our systems.

Usage Records are used solely for internal training and development purposes and will not be used for any other purpose without your consent. You acknowledge and agree that you shall not be entitled to request a copy of any Usage Records collected.

Notwithstanding anything to the contrary in this section, the Company does not use Google User Data, and does not permit others to use Google User Data, to develop, train, or improve generalized or non-personalized artificial intelligence or machine learning models. Any training, modelling or machine-learning activity described in this Privacy Policy expressly excludes Google User Data obtained through Google APIs, the use of which is governed solely by Section 8 (Use of Google User Data and Third-Party API Services).

6.4Personalization and customization of the Service

We use and combine the information you provide to us, the information we collect automatically, and information we receive from other sources (including data obtained both on and off the Service). We may also combine this information with aggregated behavioural data from other users. This enables us to ensure that your use of the Service is tailored to your needs and preferences.

6.5To communicate with you about the Service

We use your contact information to get in touch with you and to send communications about critical elements of the Service. For example, we may send you emails about technical issues, security alerts or administrative matters. We may also communicate with you regarding updates to this Privacy Policy, Terms of Use, account verification, billing matters, subscription renewals, product updates and other service-related communications.

Where permitted under applicable law and, where required, with your consent, we may also send you promotional or marketing communications about our products, features, offers and events. You may opt out of such marketing communications at any time by using the “unsubscribe” link included in the relevant communication or by contacting us at rishabh@jolto.ai. Opting out of marketing communications will not affect your receipt of essential service-related, transactional or administrative communications, which are necessary for your use of the Services.

6.6Customer support

We use information collected about you, including information within your account, information you provide to our customer support team, and information about your interactions with the Service, to identify, investigate, and resolve technical issues you may experience. This information also enables us to repair, maintain, and improve the Service for all users of Jolto.ai. By analysing reported issues and user interactions, we can enhance the stability, security, and overall functionality of the Website, ensuring a reliable and consistent experience.

6.7For matters that you have specifically consented to

From time to time, Jolto.ai may request your consent to use your information for particular purposes beyond those described in this Privacy Policy. Where you provide such consent, we will use your information solely for the agreed purpose. You retain the right to withdraw your consent at any time. If you choose to withdraw consent, we will cease using your information for that specific purpose, without affecting the lawfulness of any processing carried out prior to your withdrawal.

6.8Compliance with legal obligations

Jolto.ai may process your information where necessary to comply with applicable laws, regulations, judicial orders, governmental requests, statutory obligations, tax requirements, law enforcement requests, or any other legal process applicable to the Company.

6.9Research and analytics

Jolto.ai may process information in an aggregated form to conduct internal research, analyse usage trends, evaluate Website performance, improve AI models, develop new features and enhance the quality and reliability of the Services. Wherever reasonably practicable, such information shall be aggregated or de-identified before being used for research, analytics or service improvement purposes.

6.10Automated processing and AI-generated outputs

The Services rely on automated processing, algorithms and artificial intelligence and machine-learning models to generate outputs from your prompts, User Content and instructions. Such automated processing is used to operate and provide the features of the Service and does not, by itself, result in any decision that produces legal or similarly significant effects concerning you. AI-generated outputs are produced by automated systems, may contain inaccuracies or errors, and should not be relied upon as professional, legal, financial or other specialised advice. You are responsible for reviewing and verifying any AI-generated output before relying on or using it. Where the Company undertakes any processing that produces a decision having a legal or similarly significant effect on you, it will do so only in accordance with applicable law and, where required, will provide you with appropriate information regarding such processing.

7.1How we share your information

We may share your information with Jolto.ai affiliates and trusted third-party service providers for the purposes of delivering the Service to you, facilitating Jolto.ai’s legitimate business interests, or where you have provided consent. These parties are carefully vetted and will only be granted access to your information to the extent reasonably necessary for the specific purpose for which Jolto.ai has engaged them. We require that such parties comply with applicable laws and maintain security, privacy, and data retention practices consistent with our own policies, to the extent necessary for them to perform business, operational, or technology support functions on our behalf.

Some of the parties with whom Jolto.ai may share your personal information assist Jolto.ai with functions such as:

• billing
• customer support and customer management
• email services
• hosting and storage
• data analytics and predictive analytics
• security and Service delivery
• other service providers

The Company’s key third-party service providers and sub-processors currently include Google (for authentication, Google Sign-In and Google Analytics), Statsig (for product analytics), the Company’s cloud hosting and storage providers, and its third-party payment gateway and billing providers. The identity of such service providers may change from time to time as the Services evolve, and the Company will ensure that any such provider is engaged under appropriate contractual, security and data-protection obligations.

7.2Sharing in connection with a merger, acquisition or reorganization

Jolto.ai may share, sell, or transfer your information to third parties in connection with, or in contemplation of (including as part of the due diligence process), any merger, acquisition, reorganization, financing, sale of assets, bankruptcy, or insolvency event involving Jolto.ai or any portion of our Website, services, or business operations. Information such as customer names, email addresses, User Content, and other user information related to the Website may be among the assets shared, sold, or otherwise transferred in these types of transactions. If such a transaction occurs, you will be notified via email and/or a notice on the Website, and we will provide notice of any material changes to the way your data is handled under this Privacy Policy.

7.3Disclosure pursuant to applicable law

The Company may disclose your information where such disclosure is necessary to:

• comply with applicable laws, regulations, judicial orders, governmental directions or requests from competent authorities
• comply with any legal process, warrant or investigation
• protect or enforce the Company’s legal rights
• investigate or prevent fraud, cyber incidents, security threats or unlawful activities; or
• comply with obligations under the Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000 and any other applicable laws.

The Company does not sell your Personal Data, and does not share Google User Data except as described in Section 8 of this Privacy Policy.

Where you choose to sign in to, register with, or connect the Website using Google (including Google Sign-In and OAuth), or where the Services integrate with Google APIs, the Company may access, receive and process certain information from your Google account (“Google User Data”). Depending on the permissions (scopes) you grant at the time of authorization, Google User Data may include your name, email address, profile information, profile picture, language preference and unique Google account identifier, together with any additional data covered by the specific scope you authorise.

The Company’s access to, and use, storage and sharing of, information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• we use Google User Data solely to provide and improve user-facing features that are prominent in the Website’s user interface, and for the purposes for which you granted access;
• we do not use Google User Data for serving advertisements, including personalized, retargeted or interest-based advertising;
• we do not sell, rent, or transfer Google User Data to third parties such as advertising platforms, data brokers, or information resellers;
• we do not use Google User Data to determine credit-worthiness or for lending purposes;
• we do not use, and do not transfer to others for use, Google User Data to develop, train, or improve generalized or non-personalized artificial intelligence or machine learning models; and
• we limit human access to Google User Data except (i) with your affirmative consent to view specific data, (ii) where necessary for security purposes such as investigating abuse, (iii) to comply with applicable law, or (iv) where the data has been aggregated and anonymized and is used for internal operations in accordance with applicable privacy and other laws.

We retain Google User Data only for as long as necessary to provide the Services and for the purposes described above, or as required by applicable law, after which it is deleted or anonymized. You may review and revoke the Company’s access to your Google account at any time through your Google Account settings at https://myaccount.google.com/permissions. Revoking access may limit or disable certain features of the Services that depend on the relevant Google integration.

For more information regarding Google’s requirements, please refer to the Google API Services User Data Policy available at https://developers.google.com/terms/api-services-user-data-policy.

The Company retains your Personal Data, profile information and User Content for as long as your account remains active and for such further period as is necessary to fulfil the purposes described in this Privacy Policy, to provide the Services, to comply with the Company’s legal, regulatory, accounting or tax obligations, to resolve disputes, and to enforce the Company’s agreements and legal rights.

In accordance with the Digital Personal Data Protection Act, 2023, the Company will erase your Personal Data, or cause it to be erased, where you withdraw your consent or as soon as it is reasonable to assume that the purpose for which the Personal Data was collected is no longer being served by its retention, unless retention is necessary for compliance with any applicable law. Following termination or deactivation of your user account, the Company will retain your profile information and User Content only for so long as is necessary for such purposes or as required by law, and will thereafter delete, erase or anonymize it. You may at any time make an express request for deletion of your User Content, which the Company will give effect to subject to any legal or regulatory obligation that requires it to retain such information for a specified period.

The Company respects your privacy and is committed to enabling you to exercise your rights in relation to your Data in accordance with applicable laws, including the Digital Personal Data Protection Act, 2023. Subject to applicable law and verification of your identity, you may exercise the following rights by contacting the Company through the details provided in this Privacy Policy:

Right to access

You may request information regarding the Data processed by the Company, including the categories of Data collected, the purposes for which such Data is processed, and the categories of third parties with whom such Data has been shared, to the extent required or permitted under applicable law.

Right to correction and updating

You may request the correction, completion or updating of any Data that is inaccurate, incomplete or outdated. Where practicable, you may also update certain information directly through your account settings on the Website.

Right to erasure

You may request the deletion or erasure of your Data where such Data is no longer necessary for the purposes for which it was collected, where you withdraw your consent, or where such deletion is otherwise required under applicable law.

Right to withdraw consent

Where the processing of your Data is based on your consent, you may withdraw such consent at any time by using the available account settings or by contacting the Company. Withdrawal of consent shall not affect the lawfulness of any processing carried out prior to such withdrawal and may affect your ability to access certain features or Services provided through the Website.

Right to grievance redressal

You have the right to a readily available means of grievance redressal in respect of any act or omission of the Company regarding the processing of your Data, by contacting the Grievance Officer named in this Privacy Policy.

Right to nominate

You have the right to nominate any other individual who shall, in the event of your death or incapacity, exercise your rights under the Digital Personal Data Protection Act, 2023 in relation to your Data.

The Company may retain certain information where required to comply with legal obligations, resolve disputes, enforce its legal rights, prevent fraud, maintain security, or for any other purpose permitted or required under applicable law. If you are not satisfied with the manner in which the Company has addressed your concern, you may register a complaint with the Data Protection Board of India in accordance with the Digital Personal Data Protection Act, 2023.

In addition to your rights, the Digital Personal Data Protection Act, 2023 places certain duties on you as a Data Principal. In particular, you shall: (i) comply with the provisions of all applicable laws while exercising your rights under this Privacy Policy; (ii) not impersonate another person while providing your Personal Data for a specified purpose; (iii) not suppress any material information while providing your Personal Data for any document, unique identifier, proof of identity or proof of address issued by the State or any of its instrumentalities; (iv) not register a false or frivolous grievance or complaint with the Company or the Data Protection Board of India; and (v) furnish only such information as is verifiably authentic while exercising your right to correction or erasure. You acknowledge that a breach of these duties may attract the consequences provided under applicable law.

The Company is committed to protecting the confidentiality, integrity and availability of the Data and User Content processed through the Website. The Company implements appropriate technical, organisational and administrative safeguards designed to protect information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, unauthorised access or other unlawful processing. These measures include, where appropriate, encryption of data in transit and at rest, access controls and authentication requirements, network and application security controls, and regular review of our security practices.

Users are responsible for maintaining the confidentiality of their account credentials and for ensuring that their devices, passwords and authentication methods are adequately protected. Users should immediately notify the Company of any suspected unauthorised access to their account or any security incident affecting their use of the Website.

In the event of an actual or suspected Data breach, the Company shall take appropriate measures to investigate, contain and mitigate the impact of the incident. Where required under applicable law, the Company shall notify the appropriate governmental authorities, including the Indian Computer Emergency Response Team (CERT-In) and the Data Protection Board of India, and affected users in accordance with applicable legal requirements.

While the Company employs commercially reasonable security measures to protect Data, no method of transmission over the internet or electronic storage is completely secure. Accordingly, the Company cannot guarantee the absolute security of information transmitted through or stored on the Website. Users acknowledge that they provide information and use the Website at their own risk.

The Company is committed to protecting the privacy of children and processes the Data of children in accordance with applicable law. The Website is not intended to knowingly collect or process the Data of children in violation of applicable legal requirements.

Where the Company becomes aware that the Website is being used by a child, the Company shall process such Data only in accordance with applicable law and, where required, upon obtaining verifiable consent from the child’s parent or lawful guardian. Where required under applicable law, the Company shall obtain verifiable consent from the parent or lawful guardian before processing the Data of a child. The Company reserves the right to request additional information or documentation for the purpose of verifying such consent.

The Company shall not knowingly undertake any processing of a child’s Data that is prohibited under applicable law, including any tracking or behavioural monitoring of children or targeted advertising directed at children, or any processing that is likely to cause any detrimental effect on the well-being of a child, or any other processing prohibited under the Digital Personal Data Protection Act, 2023, or any rules made thereunder. If the Company becomes aware that Data has been collected from a child without the consent required under applicable law, the Company may suspend or terminate the relevant account and take reasonable steps to delete such Data, unless its retention is required by law.

Where the Company processes the Personal Data of a person with disability who has a lawful guardian, the Company shall, in accordance with the Digital Personal Data Protection Act, 2023, process such Personal Data only after obtaining the verifiable consent of the lawful guardian, in the manner prescribed under applicable law. The Company reserves the right to request additional information or documentation for the purpose of verifying such guardianship and consent.

The Services are intended primarily for users in India, and by using the Services you consent to the processing of your Data in India and in the jurisdictions described below. The Company’s database and frontend infrastructure are hosted in Singapore, while all other components of the Services are hosted in India.

Third-party services used by the Company, including Google Analytics and Statsig, may store or process data outside India.

Where it becomes necessary to transfer, store or process Data outside India for the provision of the Services or through authorized third-party service providers, the Company shall ensure that such transfers are carried out in accordance with applicable law, including the Digital Personal Data Protection Act, 2023, and any applicable rules, regulations or governmental directions issued from time to time.

The Company shall implement appropriate contractual, technical and organizational safeguards to ensure that Data transferred outside India receives a level of protection substantially equivalent to that provided under applicable law.

The Company reserves the right to modify, update or amend this Privacy Policy from time to time to reflect changes in applicable laws, regulatory requirements, business practices, technological developments or the Services offered through the Website.

Any revised Privacy Policy shall be published on the Website and shall become effective from the date specified therein, unless otherwise stated. Where required under applicable law or where the changes materially affect the manner in which Data is processed, the Company may notify users through email, in-application notifications, or other reasonable means.

Your continued access to or use of the Website following the publication of any revised Privacy Policy shall constitute your acknowledgement of such changes, except where your express consent is required under applicable law.

The Company has appointed a Grievance Officer for addressing questions, concerns, complaints or requests relating to this Privacy Policy or the processing of Data. Any grievance, complaint or request may be submitted to the Grievance Officer through the following contact details:

Grievance Officer

Rishabh Kumar Chaudhary

Designation

Chief Technology Officer

Email

rishabh@jolto.ai

Registered office

280, Delmia Circle, Dollars Layout, JP Nagar, Bangalore - 560068

The Grievance Officer shall acknowledge every grievance within a reasonable period and, in any event, in accordance with the timelines prescribed under applicable law (including, where the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 apply, acknowledgement within twenty-four (24) hours and disposal of the grievance within fifteen (15) days of receipt), and shall endeavour to resolve the grievance within such time. If you are not satisfied with the resolution provided, you may escalate your complaint to the Data Protection Board of India in accordance with the Digital Personal Data Protection Act, 2023.

This Privacy Policy shall be governed by and construed in accordance with the laws of India. Any dispute arising out of or relating to this Privacy Policy shall be subject to the exclusive jurisdiction of the courts at Bengaluru, Karnataka.