Privacy Policy

Effective date: 22 June 2026

For the purposes of the Digital Personal Data Protection Act, 2023 (“DPDP Act”), the Data Fiduciary is Advay Labs Private Limited (CIN: TO BE INSERTED — Corporate Identification Number), registered office: TO BE INSERTED — registered office address, India. This policy explains how we process the personal data of a Data Principal (the individual to whom the data relates).

Account information (name, work email, organisation, role); platform usage logs (job inputs, validation outputs, time and quota usage, IP address, user agent); communication content (enquiry forms, controlled-review materials); and billing information for paid tiers, processed by our payment partner. We collect only what is required to operate the platform and the controlled-review workflow.

We process personal data for specified, lawful purposes: to deliver the platform; to enforce quotas and rate limits; to provide audit logs for institutional and partner review; to communicate about the service; to issue tax invoices and meet legal, accounting and contractual obligations; and to protect the platform against abuse. Where the DPDP Act requires consent, we obtain it through a clear affirmative action and process data only for the purpose for which consent was given. Certain processing relies on legitimate uses permitted under the Act (for example, where you have voluntarily provided data for a purpose, or to comply with law).

Under the DPDP Act, you have the right to:

• access a summary of the personal data we process about you and the processing activities;
• correction, completion, updating and erasure of your personal data;
• grievance redressal through the mechanism in section 8 below;
• nominate another individual to exercise your rights in the event of death or incapacity; and
• withdraw consent at any time, as easily as it was given (withdrawal does not affect processing done before withdrawal).

To exercise any right, write to privacy@advaylabs.com. We may need to verify your identity before acting on a request.

Authorised Advay personnel under role-scoped access controls; Data Processors engaged under contract (for example, hosting, payment processing and email delivery) who act only on our instructions; institutional administrators for their own tenant’s data only; and counterparties only where you authorise disclosure (for example, through a diligence-room invitation). We do not sell personal data. We may disclose data where required by law or to establish, exercise or defend legal claims.

We retain personal data while your account is active and for a limited period afterwards to support audit, tax and compliance obligations, after which it is deleted or anonymised. You can request deletion of your account; some records may be retained where law requires.

We apply reasonable security practices consistent with the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 and the DPDP Act: encryption in transit and at rest where applicable, role-scoped access, multi-factor authentication, audit logging of sensitive operations and restricted environments for partner-specific material. No system is perfectly secure; in the event of a personal data breach we will notify the Data Protection Board of India and affected Data Principals as required by law.

Data-protection questions and grievances may be addressed to our contact for data protection, TO BE INSERTED — Data Protection Contact, at privacy@advaylabs.com, or to our Grievance Officer, TO BE INSERTED — Grievance Officer name, at grievance@advaylabs.com (phone: TO BE INSERTED — contact number). We acknowledge within 48 hours and aim to resolve within one month. If you remain dissatisfied, you may approach the Data Protection Board of India.

The platform is intended for professional and institutional use and is not directed at children. We do not knowingly process the personal data of a child (under 18) without verifiable parental consent as required by the DPDP Act.

We may update this policy. Material changes will be communicated to registered users; the effective date above reflects the current version.

© 2026 Advay Labs Private Limited. Effective 22 June 2026.