Privacy Policy

Welcome to BHARATX GENAI PRIVATE LIMITED ("BharatX", "Company", "we", "our" or "us"). BharatX is an AI-enabled technology company providing online taxation, accounting, finance, regulatory compliance, legal compliance, business intelligence and related software-as-a-service ("SaaS") solutions through its website, mobile applications, iOS, APIs, integrations, conversational AI interfaces, document processing systems and other digital platforms (collectively, the "Platform").

This Privacy Policy explains how we collect, receive, access, use, analyse, store, process, disclose, transfer, retain and otherwise handle Personal Data relating to individuals who access or use our Platform.

We recognise that information uploaded to our Platform frequently includes highly confidential financial, taxation, accounting, legal and business information. Accordingly, protecting privacy, maintaining confidentiality and implementing appropriate security safeguards form an integral part of our business operations.

This Privacy Policy has been prepared to comply with applicable laws of India governing privacy, information security and personal data protection, including, to the extent applicable: The Digital Personal Data Protection Act, 2023 ("DPDP Act"), The Information Technology Act, 2000, The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, to the extent they continue to apply; The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, where applicable and other applicable laws governing privacy, cybersecurity, taxation and electronic records.

This Privacy Policy should be read together with the Company's Terms of Use, Master Services Agreement (where applicable), Data Processing Agreement, Cookie Policy and any product-specific privacy notices issued by BharatX from time to time. In the event of any inconsistency, the provisions of the applicable customer agreement shall prevail to the extent permitted under Applicable Law.

Where any provision of applicable law imposes higher standards than this Privacy Policy, such legal requirements shall prevail.

Scope of this Privacy Policy

This Privacy Policy applies to all Personal Data processed by BharatX in connection with our website, web application, Android application, iOS application, APIs, browser extensions, AI-powered chat assistants, document intelligence tools, OCR services, tax automation tools, accounting automation tools, GST compliance tools, income-tax compliance tools, notice management system, workflow automation tools, WhatsApp integrations, email integrations, customer support systems, payment systems, marketing communications, and all other services provided by BharatX.

This Policy applies irrespective of whether the Platform is accessed through desktop devices, laptops, mobile devices, tablets or any other electronic device.

Who this Policy Applies To

This Privacy Policy applies to the registered users, subscribers, chartered accountants, company secretaries, cost accountants, advocates, tax practitioners, accountants, payroll professionals, businesses, LLPs, companies, proprietorships, partnerships, employees of customer organisations, authorised users, API users, trial users, prospective customers, visitors to our website, individuals whose Personal Data is uploaded by our customers, vendors interacting with the Platform and any other individual whose Personal Data is processed by BharatX.

Our Role Under Applicable Data Protection Laws

Depending upon the nature of processing, BharatX may act either as a Data Fiduciary or as a Data Processor.

BharatX as a Data Fiduciary

BharatX acts as a Data Fiduciary when determining the purpose and means of processing Personal Data relating to account creation, user registration, identity verification, subscription management, billing, payment processing, customer support, fraud prevention, information security, platform administration, marketing communications where consent has been obtained, legal compliance, product improvement based on aggregated or anonymised information, platform analytics, user authentication, platform security monitoring and other activities for which BharatX independently determines the purposes of processing.

In these situations, BharatX determines why Personal Data is processed and how such processing is carried out.

BharatX as a Data Processor

BharatX acts as a Data Processor when customers upload or otherwise submit Personal Data relating to third parties for processing through the Platform. Examples include GST returns, Income Tax Returns, client documents, invoices, purchase registers, sales registers, payroll information and similar customer-controlled content.

In such cases:

• The customer remains the Data Fiduciary
• BharatX processes such data solely in accordance with the customer's documented instructions
• BharatX does not independently determine the purposes of processing except where required by law or expressly disclosed in this Privacy Policy
• BharatX implements appropriate technical and organisational safeguards to protect such information

Where BharatX processes Customer Data strictly on documented instructions from the Customer, BharatX shall act solely as a Data Processor and the Customer shall remain responsible for compliance with obligations imposed upon a Data Fiduciary under the DPDP Act, including providing privacy notices, obtaining valid consent where required, responding to Data Principal requests and ensuring the legality of the Personal Data uploaded to the Platform.

Change of Capacity

Certain processing activities may involve BharatX acting in different capacities for different categories of information. For example:

• customer account information is processed by BharatX as a Data Fiduciary
• uploaded client records are generally processed by BharatX as a Data Processor
• anonymised analytics generated from usage patterns may be processed by BharatX as a Data Fiduciary
• information retained for compliance with applicable laws may be processed by BharatX as a Data Fiduciary

Where BharatX changes the capacity in which it processes Personal Data, such processing shall always be carried out in accordance with applicable law and this Privacy Policy.

Definitions

For the purposes of this Privacy Policy:

"Personal Data" means any data about an individual who is identifiable by or in relation to such data, whether directly or indirectly, and shall have the meaning assigned under the DPDP Act, as amended from time to time. Certain categories of Personal Data, including financial records, taxation records, government-issued identifiers, authentication credentials and confidential business information, may require enhanced technical and organisational safeguards. References to such information in this Privacy Policy do not create a separate legal category unless recognised under Applicable Law.

"Data Principal" means the individual to whom the Personal Data relates.

"Data Fiduciary" means the person who alone or together with others determines the purpose and means of processing Personal Data.

"Data Processor" means any person who processes Personal Data on behalf of a Data Fiduciary.

"Processing" includes collection, recording, organisation, storage, adaptation, retrieval, consultation, use, analysis, transmission, disclosure, sharing, alignment, combination, indexing, AI-assisted processing, anonymisation, pseudonymisation, restriction, deletion, destruction, or any other operation performed on Personal Data by automated or non-automated means.

"AI Services" means the artificial intelligence, machine learning, large language models, OCR systems, document intelligence systems, semantic search, retrieval-augmented generation (RAG), natural language processing, predictive analytics, recommendation engines and related technologies made available through the Platform.

"Customer Data" means all information uploaded, transmitted or otherwise made available by customers through the Platform, including Personal Data relating to third parties.

"Applicable Law" means all statutes, rules, regulations, notifications, directions, judicial decisions and governmental requirements applicable to BharatX or the processing of Personal Data.

Categories of Personal Data We Process

The categories of Personal Data processed by BharatX vary depending upon the nature of the Services used, the features accessed by the User, the permissions granted by the User, the integrations enabled by the User and the information voluntarily submitted through the Platform. BharatX collects only such Personal Data as is reasonably necessary for providing, maintaining, improving and securing the Services or as otherwise permitted or required under Applicable Law. Users are requested not to upload Personal Data that is unnecessary for the requested Services. Where uploaded documents contain information unrelated to the requested Services, BharatX may nevertheless process such information solely because it forms part of the document submitted by the User.

The categories of information processed include, but are not limited to, the following.

Account Registration Information

When you create or administer an account on the Platform, we may collect full name, business name, organisation name, designation, email address, mobile number, office telephone number, registered office address, correspondence address, profile photograph, username, account preferences, preferred language, time-zone, subscription details, account verification information, user identification numbers, referral information, customer identification information, login credentials, authentication information and any additional information voluntarily provided during registration.

Business Information

Where the Platform is used by businesses, firms or professionals, we may process legal name of the entity, constitution of business, Corporate Identification Number (CIN), LLP Identification Number (LLPIN), GSTIN, PAN, TAN, Professional Tax Registration, Import Export Code, MSME Registration, UDYAM Registration, registered office, branch office details, authorised representatives, directors, partners, designated partners, proprietors, beneficial ownership information voluntarily submitted, bank account details necessary for payment processing, authorised signatory information, digital signature certificate details where integrated, compliance registrations and other information required for providing taxation and compliance services.

Financial and Taxation Information

Depending upon the Services utilised, BharatX may process taxation and financial information including GST returns, GSTR-1, GSTR-3B, GSTR-9, GSTR-9C, GST reconciliation reports, GST notices, GST registration documents, GST ledgers, electronic cash ledger, electronic credit ledger, electronic liability ledger, Income Tax Returns, ITR acknowledgements, computation of income, tax audit reports, Form 26AS, AIS, TIS, TDS returns, TCS returns, challans, notices issued under tax laws, replies to notices, assessment orders, appellate orders, tax opinions, tax calculations, tax planning documents, tax payment information, withholding tax information, refund information, advance tax details, self-assessment tax information and other taxation records uploaded by Users.

Such information is processed solely for providing the requested Services and in accordance with the instructions of the relevant User.

Accounting and Financial Records

Users may upload accounting information including trial balances, balance sheets, profit and loss accounts, cash flow statements, ledgers, journals, purchase registers, sales registers, fixed asset registers, inventory statements, invoices, debit notes, credit notes, receipts, vouchers, bank statements, reconciliation statements, accounting software exports, payroll reports, financial projections, management reports, audit working papers and related accounting records.

Identity Documents

Where voluntarily uploaded or required for providing a specific Service, we may process copies of PAN Card, Aadhaar Card, Passport, Driving Licence, Voter Identification Card, Digital Signature Certificates, Director Identification Numbers, Professional Membership Certificates, registration certificates, licences, authorisation letters, powers of attorney, board resolutions and other supporting documents. Where Aadhaar information is voluntarily submitted, BharatX processes such information solely for the specific purpose for which it was uploaded and does not use it for profiling or unrelated purposes.

Client Information Uploaded by Professional Users

Chartered Accountants, Company Secretaries, Cost Accountants, Advocates and other professionals may upload Personal Data relating to their own clients. Such information may include names, addresses, contact details, tax identifiers, financial records, employee information, invoices, statutory filings, contracts, litigation records, accounting records, payroll data, notices, replies, supporting documents, correspondence and other information necessary for providing professional services. In respect of such information, the uploading User represents that they possess all necessary authority, permissions and legal basis required for such processing.

AI Interaction Data

When Users interact with BharatX's AI Services, we may process prompts, questions, instructions, uploaded documents, generated responses, edits, feedback, corrections, conversation history, workflow selections, search queries, generated reports, summaries, extracted data, annotations, user ratings and related interaction metadata. Such information is processed for generating responses requested by the User, improving service quality using anonymised or aggregated information where appropriate, ensuring system security, troubleshooting technical issues and complying with Applicable Law. BharatX does not use Customer Data or uploaded confidential documents to train publicly available general-purpose AI models without the User's explicit consent.

Device and Technical Information

When the Platform is accessed, we may automatically collect technical information including IP address, browser type, browser version, operating system, device type, device identifiers, language settings, screen resolution, session duration, date and time of access, crash logs, diagnostic information, application version, authentication logs, API requests, security logs, cookies, network information, approximate geographic location derived from IP address and other technical information necessary for security and service delivery. We do not intentionally collect precise GPS location unless expressly required for a specific feature and separately consented to by the User.

Communications

Where Users communicate with BharatX, we may process emails, support tickets, chatbot conversations, telephone recordings where notified, WhatsApp messages, SMS communications, in-app messages, survey responses, customer feedback, product reviews, complaint records, grievance submissions and other correspondence.

Payment Information

Where Users purchase paid subscriptions, BharatX may process billing address, GSTIN, invoice details, subscription information, payment reference numbers, transaction identifiers, payment status, refund information and billing history. Payment card information, UPI credentials, net banking credentials and similar payment instruments are processed directly by authorised payment gateway providers in accordance with their respective privacy policies. BharatX does not store complete card numbers, CVV values or internet banking credentials.

Information Received from Third-Party Integrations

Where authorised by the User, BharatX may receive information from third-party systems, including GST Network (GSTN), GST Suvidha Providers (GSPs), accounting software, ERP systems, banking integrations, payment service providers, e-invoicing platforms, e-way bill systems, cloud storage providers, email platforms, calendar applications, communication platforms, identity providers and other integrations enabled by the User. Such information shall be processed solely for the purposes authorised by the User and in accordance with Applicable Law.

Information We Do Not Intentionally Collect

Unless specifically required for a Service requested by the User, BharatX does not intentionally collect or process biometric identifiers, facial recognition templates, fingerprints, iris scans, continuous background location data, device contact lists, call logs, SMS contents, photographs stored on the User's device unrelated to the Services, microphone recordings outside active use of voice-enabled features or camera access outside active document capture initiated by the User. The Platform requests device permissions only when necessary to enable a particular functionality, and Users may refuse or revoke such permissions at any time through their device settings, although doing so may affect the availability of certain features.

Accuracy of Information

Users are responsible for ensuring that the Personal Data provided to BharatX is accurate, complete, lawful and up to date. Where Users upload Personal Data relating to another individual, the User represents and warrants that they have the legal authority, appropriate notice and, where required, valid consent or other lawful basis to disclose such Personal Data to BharatX for processing in accordance with this Privacy Policy and the applicable agreement governing the Service.

Purposes for Which We Process Personal Data

BharatX processes Personal Data only for specified, lawful and legitimate purposes connected with the provision, operation, improvement, security and administration of the Platform. We process Personal Data only to the extent reasonably necessary for such purposes and in accordance with Applicable Law. BharatX shall treat Customer Data as confidential information and shall not access, use or disclose such information except:

• As necessary to provide the Services
• As instructed by the Customer
• As required by the Applicable Law
• As otherwise expressly permitted under the applicable customer agreement

The purposes for which Personal Data may be processed include, but are not limited to, the following.

Creation and Administration of User Accounts

We process Personal Data to create user accounts, authenticate users, verify identity, enable secure login, administer subscriptions, manage user profiles, assign user permissions, maintain organisational accounts, facilitate password recovery, verify email addresses and mobile numbers, provide account-related notifications, maintain audit trails relating to account activities and administer customer relationships.

Providing the Services

Personal Data is processed for providing the Services requested by Users, including AI-powered taxation assistance, GST compliance, income tax compliance, TDS compliance, accounting assistance, book-keeping automation, preparation of reports, document review, document extraction, OCR services, reconciliation, notice management, return preparation, workflow management, regulatory compliance assistance, legal compliance assistance, dashboard generation, analytics, automated calculations, business intelligence, document storage, retrieval of historical records and other Services available through the Platform.

AI-Powered Processing

Where Users utilise AI-enabled Services, BharatX processes Personal Data for understanding user prompts, analysing uploaded documents, extracting structured information, classifying documents, identifying tax-related information, generating summaries, preparing draft replies, generating reports, identifying inconsistencies, highlighting potential compliance issues, answering user queries, performing semantic search, generating recommendations, comparing documents, organising records, facilitating intelligent search across uploaded documents and providing other AI-assisted functionalities requested by the User. The processing carried out by our AI systems is intended solely to provide the requested Services and is not intended to replace professional judgement.

Taxation and Regulatory Compliance Services

Where specifically requested by Users, BharatX may process Personal Data for preparation of GST returns, reconciliation of GST data, preparation of tax computations, preparation of income tax returns, drafting replies to notices, generation of compliance calendars, preparation of statutory reports, compliance tracking, filing support, document validation, statutory reminders, compliance monitoring, regulatory reporting and related taxation and compliance activities. Users remain solely responsible for reviewing all filings before submission to any governmental authority.

Integration with Government Systems

Where authorised by Users, BharatX may process Personal Data to facilitate interaction with government platforms, including GSTN, GST Suvidha Providers, e-Invoice systems, e-Way Bill systems, MCA services, income tax systems and other statutory portals integrated into the Platform. Such processing is carried out only pursuant to the User's express instructions and subject to the permissions granted by the User.

Customer Support

Personal Data is processed to respond to customer enquiries, resolve technical issues, investigate complaints, provide troubleshooting, provide implementation assistance, respond to support requests, monitor service quality, improve customer experience and maintain customer relationship records. Support interactions may be monitored or recorded where permitted by Applicable Law for quality assurance, training and dispute resolution purposes.

Platform Security

We process Personal Data to maintain the confidentiality, integrity and availability of the Platform. This includes processing for authentication, access management, fraud detection, suspicious activity detection, malware prevention, vulnerability detection, security monitoring, abuse prevention, account protection, unauthorised access prevention, investigation of security incidents, cybersecurity compliance, risk management and protection of Users and the Platform.

Compliance with Legal Obligations

Personal Data may be processed where necessary to comply with Applicable Law, including obligations relating to taxation, accounting, statutory record maintenance, anti-fraud requirements, court orders, lawful governmental requests, law enforcement investigations, judicial proceedings, regulatory inspections, audits, legal reporting obligations, compliance with contractual commitments and protection of legal rights.

Payment Processing and Subscription Management

We process Personal Data for processing subscription payments, generating invoices, issuing GST-compliant tax invoices, processing refunds, maintaining billing records, managing renewals, subscription upgrades, subscription downgrades, payment verification, fraud prevention relating to financial transactions and accounting purposes. Financial payment credentials are processed by authorised payment service providers and not by BharatX except to the extent necessary for transaction confirmation.

Communications

Personal Data is processed to communicate with users regarding account administration, security alerts, product updates, transaction confirmations, service notifications, subscription renewals, customer support, system maintenance, changes to legal documents, regulatory notices, compliance reminders, product announcements, webinars, educational content and other communications relevant to the Services. Marketing communications shall be sent only where permitted under Applicable Law or where the user has provided the necessary consent.

Platform Improvement

We continually seek to improve our Platform. Accordingly, Personal Data may be processed to improve existing Services, develop new features, identify technical issues, analyse feature usage, improve response quality, optimise workflows, improve accessibility, evaluate system performance, conduct internal research, perform quality assurance and enhance overall user experience. Where reasonably practicable, BharatX uses anonymised, aggregated or de-identified information for such purposes.

Product Analytics

We may analyse information relating to feature usage, navigation patterns, user journeys, performance metrics, session duration, error logs, crash reports, API performance, search behaviour, and system utilisation. Such analytics assist in improving Platform reliability, usability and security. Analytics information is generally processed in aggregated form and is not intended to identify individual Users unless necessary for security, fraud prevention or technical troubleshooting.

Quality Assurance

To improve the quality, accuracy and reliability of our AI Services, BharatX may process interaction data for identifying system errors, correcting extraction failures, improving document parsing, evaluating response quality, identifying hallucinations, reducing inaccurate outputs, improving workflow efficiency, validating AI performance and maintaining service quality. Unless expressly agreed by the User, Customer Data and confidential uploaded documents shall not be used to train publicly available general-purpose artificial intelligence models. Internal evaluation of AI performance shall, wherever reasonably practicable, utilise anonymised, de-identified or synthetic datasets.

Fraud Prevention and Abuse Detection

Personal Data may be processed to prevent identity theft, detect fraudulent transactions, prevent misuse of subscriptions, investigate suspicious activities, identify spam, prevent automated attacks, detect credential stuffing, enforce usage policies, identify malicious uploads and maintain the security and integrity of the Platform.

Business Administration

Personal Data may also be processed for legitimate business administration purposes including internal audits, financial reporting, insurance, corporate governance, mergers, acquisitions, business restructuring, investment due diligence, legal risk management, dispute resolution and enforcement of contractual rights. Such processing shall always be subject to appropriate safeguards and Applicable Law.

Legal Basis for Processing

BharatX processes Personal Data only where a valid legal basis exists under Applicable Law. Depending upon the circumstances, such legal basis may include the consent of the Data Principal, performance of a contract with the User, compliance with statutory obligations, compliance with judicial or regulatory directions, protection of legal rights, prevention and detection of fraud, responding to emergencies affecting life or health where legally permissible, processing for employment-related purposes where applicable, legitimate uses recognised under the DPDP Act and any other lawful basis recognised under Applicable Law.

Where consent is relied upon, BharatX shall provide clear notice regarding the nature and purpose of processing, and Users may withdraw such consent in accordance with Applicable Law. Withdrawal of consent shall not affect the lawfulness of processing undertaken prior to such withdrawal and may affect the availability of certain Services where such processing is necessary for their provision.

Data Minimisation

BharatX is committed to the principle of data minimisation. We endeavour to collect and process only such Personal Data as is reasonably necessary for the purposes specified in this Privacy Policy. We do not intentionally collect excessive, irrelevant or unnecessary Personal Data and periodically review our data collection practices to ensure continued compliance with this principle.

Use of Artificial Intelligence

BharatX is an Artificial Intelligence-enabled Software-as-a-Service (SaaS) platform that uses artificial intelligence technologies to assist Users in performing taxation, accounting, financial, regulatory and compliance-related activities. Our AI Services are intended to improve efficiency, automate repetitive tasks, analyse documents, extract information, generate drafts and assist Users in making informed decisions. However, the AI Services are designed to assist—not replace—the professional judgement of qualified accountants, tax professionals, company secretaries, advocates, finance professionals and business users. By using the AI features available on the Platform, you acknowledge and agree that your inputs and uploaded documents may be processed using AI technologies in accordance with this Privacy Policy and our Terms of Use.

AI Technologies Used

Depending upon the Services utilised, BharatX may employ one or more of the following technologies: Large Language Models (LLMs), Natural Language Processing (NLP), Optical Character Recognition (OCR), Retrieval-Augmented Generation (RAG), semantic search, vector databases, document indexing, embeddings, document classification, entity recognition, intelligent document extraction, machine learning algorithms, recommendation engines, predictive analytics, automated rule-based systems, workflow automation, conversational AI, speech-to-text technologies, text-to-speech technologies, fraud detection algorithms, anomaly detection systems and other AI technologies introduced from time to time. The technologies used may evolve as the Platform develops.

Information Processed by AI Services

Our AI systems may process information submitted by Users, including prompts, questions, instructions, uploaded documents, spreadsheets, PDF files, Word documents, presentations, scanned images, invoices, tax returns, GST records, financial statements, accounting records, notices, contracts, legal documents, compliance records, email content where integrated, chat history, generated reports, workflow selections, metadata necessary for processing and other information voluntarily submitted by Users. The AI Services process such information solely for generating the outputs requested by the User unless otherwise disclosed in this Privacy Policy.

Purpose of AI Processing

AI processing may be undertaken for purposes including analysing uploaded documents, extracting structured information, preparing summaries, identifying important clauses, identifying taxation issues, suggesting accounting treatments, generating draft responses, preparing draft notices, comparing documents, identifying inconsistencies, reconciliation assistance, generating reports, searching across uploaded documents, classification of documents, identifying missing information, compliance assistance, workflow automation, drafting communications, generating calculations, answering user queries and improving the overall usability of the Platform. AI processing is always intended to facilitate the User's work and should not be construed as replacing independent professional advice.

AI Is Not a Substitute for Professional Advice

The outputs generated by the Platform are intended solely as informational and productivity-enhancing tools. AI-generated outputs do not constitute legal advice, do not constitute tax advice, do not constitute accounting advice, do not constitute audit opinions, do not constitute financial advice, do not constitute professional certification, do not constitute statutory filings, do not create an attorney-client relationship, do not create a chartered accountant-client relationship, do not create a company secretary-client relationship and should not be relied upon as the sole basis for making legal, financial, taxation or regulatory decisions. Users remain solely responsible for independently reviewing, verifying and validating all outputs before relying upon them or submitting any statutory filing to any governmental authority.

Human Review Requirement

Users acknowledge that all AI-generated content and all other documents generated or assisted by AI should be independently reviewed before use. BharatX recommends that appropriately qualified professionals review all AI-generated outputs before they are relied upon for regulatory, statutory or commercial purposes.

Limitations of AI

Artificial Intelligence systems are probabilistic technologies and may produce inaccurate, incomplete or misleading outputs. Accordingly, AI-generated responses may contain factual inaccuracies, outdated legal or regulatory information, misinterpret uploaded documents, incorrectly classify information, fail to identify important clauses, incorrectly interpret handwriting, incorrectly interpret scanned documents, produce inconsistent responses, omit relevant information, generate incorrect calculations, misunderstand user instructions, provide incomplete legal reasoning, incorrectly identify tax positions, produce responses that appear convincing despite being inaccurate (hereinafter referred to as "hallucinations"), fail to account for jurisdiction-specific legal requirements or otherwise contain errors. Users must independently verify all AI-generated outputs before acting upon them.

Automated Processing

Certain Platform functionalities involve automated processing of Personal Data. Such automated processing is intended to improve efficiency and user experience and is not intended to make legally binding decisions affecting Users without appropriate human oversight.

No Solely Automated Legally Significant Decision-Making

Unless expressly stated otherwise and permitted by Applicable Law, BharatX does not make decisions that produce legal or similarly significant effects solely through automated processing. Final decisions regarding tax filings, statutory submissions, accounting treatments, regulatory compliance, legal strategy, financial reporting, commercial decisions and professional opinions remain the responsibility of the User and, where applicable, the User's professional advisors.

AI Model Training

BharatX is committed to protecting Customer confidentiality. BharatX does not intentionally use Customer Data to train publicly available general-purpose AI models unless the Customer has expressly consented to such processing or such use is expressly disclosed and permitted under the applicable customer agreement.

Unless expressly authorised by the User:

• confidential client information shall not be intentionally incorporated into publicly available AI datasets
• uploaded tax records shall not be disclosed for AI training purposes
• uploaded legal documents shall not be disclosed for AI training purposes
• uploaded financial records shall not be disclosed for AI training purposes

Where BharatX undertakes internal quality improvement activities, such activities shall, wherever reasonably practicable, utilise anonymised, de-identified, aggregated or synthetic information. Where explicit User consent is obtained for participation in model improvement programmes, such processing shall be governed by the terms of such consent.

Third-Party AI Service Providers

To provide AI functionality, BharatX may engage specialised third-party AI service providers. Where such providers process Personal Data on our behalf, BharatX shall endeavour to ensure that such providers are contractually obligated to:

• process Personal Data only for authorised purposes
• maintain appropriate security safeguards
• maintain confidentiality
• comply with applicable contractual obligations
• implement appropriate technical and organisational measures
• assist BharatX in complying with Applicable Law where required
• delete or return Personal Data where contractually required
• refrain from using Customer Data for unauthorised purposes

Certain AI functionality may be provided through infrastructure operated by independent third-party providers. BharatX does not control the internal architecture of such providers but undertakes reasonable contractual and technical measures to ensure processing remains consistent with this Privacy Policy.

AI Output Ownership

Subject to Applicable Law and the applicable Terms of Use:

• Users retain ownership of the documents uploaded by them
• BharatX does not claim ownership over Customer Data merely because such data is processed through AI Services
• AI-generated outputs are produced based upon User instructions and available data
• Users remain responsible for ensuring that their use of AI-generated outputs complies with the Applicable Law, contractual obligations and intellectual property rights

Nothing in this Privacy Policy transfers ownership of Customer Data to BharatX except to the limited extent necessary to provide the Services.

User Responsibilities Relating to AI

Users agree that they shall not:

• upload information in violation of Applicable Law
• upload information without appropriate authority
• use the AI Services for unlawful activities
• rely exclusively upon AI-generated outputs without independent review where professional judgement is required
• upload malicious software
• attempt to manipulate AI systems through abusive prompts
• use the Platform to generate unlawful, fraudulent or misleading content
• intentionally circumvent Platform safeguards
• use AI-generated outputs in a manner prohibited by Applicable Law

Users are solely responsible for ensuring that information uploaded to the Platform may lawfully be processed by BharatX.

Continuous Improvement of AI Services

BharatX continually evaluates and improves its AI Services to enhance response quality, document understanding, extraction accuracy, compliance capabilities, processing efficiency, security, performance, reliability, accessibility and overall user experience. Such improvements shall be implemented in accordance with Applicable Law, this Privacy Policy and appropriate security and confidentiality safeguards.

General Principles of Data Sharing

BharatX values the confidentiality of the information entrusted to it and does not sell, rent, trade, license or otherwise commercially exploit Personal Data belonging to Users. Personal Data shall be disclosed only where such disclosure is necessary for providing the Services requested by the User, the User has instructed or authorised such disclosure, disclosure is required under Applicable Law, disclosure is necessary to protect the legal rights or legitimate interests of BharatX, its Users or third parties, disclosure is necessary for information security, fraud prevention or cyber security purposes, disclosure is required during a corporate restructuring or business transfer or such disclosure is otherwise permitted under Applicable Law. BharatX endeavours to disclose only the minimum amount of Personal Data reasonably necessary for the relevant purpose.

Disclosure to Service Providers

BharatX may engage carefully selected third-party service providers to assist in operating, securing and improving the Platform. Such service providers may process Personal Data solely on behalf of BharatX and only for the purposes authorised by BharatX. Each such service provider is contractually required to implement appropriate confidentiality, privacy and security safeguards consistent with Applicable Law.

AI Subprocessors

To provide AI-enabled functionality, BharatX may engage specialised AI infrastructure providers and model providers. BharatX shall use commercially reasonable efforts to ensure that such providers process data solely for providing the requested AI Services, maintain confidentiality, implement appropriate technical and organisational security measures, comply with contractual restrictions imposed by BharatX, do not use Customer Data for unauthorised purposes, comply with applicable data protection obligations and delete or return Personal Data where contractually required. Where technically feasible, BharatX shall configure AI service providers to minimise retention of Customer Data.

Government System Integrations

Where expressly authorised by the User, BharatX may transmit information to governmental systems or authorised intermediaries for facilitating statutory compliance.

Payment Service Providers

Where Users subscribe to paid Services, payment-related information may be shared with authorised payment service providers. Payment card information, UPI credentials, internet banking credentials and similar financial authentication information are processed directly by the payment service provider in accordance with its own privacy policy and applicable regulatory requirements. BharatX does not intentionally store complete payment card details or CVV information.

Communication Service Providers

To facilitate communications with Users, BharatX may engage communication service providers. Where Users choose to communicate through third-party messaging platforms, such communications may also be subject to the privacy policies and terms of those third-party platforms.

Disclosure Required by Law

BharatX may disclose Personal Data where such disclosure is:

• required under Applicable Law
• required pursuant to a court order
• required pursuant to a legally valid governmental direction
• required by a regulatory authority
• necessary for responding to lawful investigations
• necessary for enforcement of legal rights
• necessary for protection of public safety
• necessary for prevention or investigation of fraud
• necessary for cybersecurity incident response
• necessary for defending legal proceedings
• necessary for protecting BharatX, its Users or third parties
• otherwise legally required

Where legally permissible, BharatX may notify the affected User before making such disclosure.

Corporate Restructuring

In the event of corporate restructuring, the Personal Data may be transferred to the acquiring or successor entity, provided that such entity agrees to process the Personal Data in a manner substantially consistent with this Privacy Policy and Applicable Law. Where required by Applicable Law, BharatX shall provide appropriate notice to Users before such transfer.

Cross-Border Transfer of Personal Data

Certain service providers engaged by BharatX, including AI infrastructure providers, cloud service providers and technology partners, may be located outside India or may process Personal Data outside India. Where cross-border processing is required, BharatX shall undertake such transfers in accordance with notifications, restrictions or requirements issued by the Central Government under the Digital Personal Data Protection Act, 2023 or any other successor legislation.

Data Localisation

Where Applicable Law requires that specified categories of information be stored or processed within India, BharatX shall endeavour to comply with such legal requirements. Where BharatX maintains primary infrastructure within India, this shall not prevent the use of globally distributed infrastructure for ancillary services provided such processing remains compliant with Applicable Law.

Business Partners

Where Users choose to integrate third-party products or services with the Platform, BharatX may share Personal Data with such third parties solely to facilitate the requested integration. Examples include integrations with accounting software, ERP systems, CRM platforms, cloud storage services, document management systems, etc. Such third-party services operate under their own terms and privacy policies, and BharatX is not responsible for their independent privacy practices.

No Sale of Personal Data

BharatX does not sell Personal Data to data brokers, advertisers or unrelated third parties. BharatX does not monetise Customer Data through sale, licensing or commercial exploitation for unrelated advertising purposes. Where anonymised or aggregated information is used for business analytics, product development, benchmarking or research, such information shall not reasonably identify any individual Data Principal.

Aggregated, De-identified and Anonymised Information

BharatX may create aggregated, statistical, anonymised or de-identified information derived from Platform usage. Such information may be used for purposes including research, product development, benchmarking, security analysis, operational improvements, capacity planning, service optimisation, trend analysis, machine learning evaluation, publication of industry insights and other legitimate business purposes. Such information shall not intentionally identify any individual User or Customer.

Consent

BharatX respects the privacy rights of every Data Principal and processes Personal Data only where an appropriate legal basis exists under Applicable Law. Where consent is required, BharatX shall seek such consent through clear, specific and informed notices prior to or at the time of collection of Personal Data. Consent obtained by BharatX shall:

• be free, specific, informed, unconditional and unambiguous
• be obtained through a clear affirmative action
• identify the purposes for which Personal Data is proposed to be processed
• not be bundled with unrelated purposes
• be capable of being withdrawn as easily as it was given
• be recorded where appropriate for compliance purposes
• remain subject to Applicable Law

Where Personal Data is processed under another lawful basis recognised under Applicable Law, BharatX may process such information without obtaining separate consent to the extent legally permissible.

Withdrawal of Consent

Where processing is based upon consent, the Data Principal may withdraw such consent at any time by:

• using account settings
• contacting the Grievance Officer
• sending an email to the designated privacy contact
• or by using any other withdrawal mechanism made available through the Platform

Withdrawal of consent:

• shall not affect the lawfulness of processing undertaken before such withdrawal
• may result in certain Services becoming unavailable
• shall not affect processing required for compliance with Applicable Law
• shall not require BharatX to delete information that must be retained under statutory obligations
• shall not affect information that has already been anonymised

Rights of Data Principals

Subject to Applicable Law, Data Principals may exercise the following rights.

Right to Access

Users may request confirmation regarding whether BharatX processes their Personal Data and may request access to such Personal Data in accordance with Applicable Law.

Right to Correction

Users may request correction, completion or updating of inaccurate, incomplete or outdated Personal Data, and wherever reasonably practicable, BharatX may also provide self-service mechanisms enabling Users to update their own account information.

Right to Erasure

Users may request deletion of Personal Data where:

• the information is no longer required for the purpose for which it was collected
• consent has been withdrawn and no other lawful basis exists
• retention is no longer legally required
• Applicable Law otherwise permits deletion

This right shall remain subject to legal retention obligations, contractual obligations, ongoing investigations, litigation holds and other lawful exceptions.

Right to Withdraw Consent

Where processing is based upon consent, Users may withdraw consent at any time. Withdrawal may affect the availability or functionality of certain Services.

Right to Grievance Redressal

Users may submit complaints or grievances regarding the processing of Personal Data to BharatX's Grievance Officer. Where Users remain dissatisfied, they may pursue remedies before the competent authority in accordance with Applicable Law.

Right to Nominate

Where recognised under Applicable Law, Data Principals may nominate another individual to exercise their rights in the event of death or incapacity.

Exercise of Rights

Requests relating to Personal Data may be submitted through:

• the User dashboard
• privacy request forms
• email
• customer support
• or by contacting the Grievance Officer

BharatX may request reasonable verification of identity before processing such requests.

Data Retention

BharatX retains Personal Data only for so long as necessary to fulfil the purposes described in this Privacy Policy, comply with Applicable Law, resolve disputes, enforce agreements and protect legitimate business interests. Retention periods may vary depending upon the category of information processed and any statutory record retention requirements. Upon expiry of the applicable retention period, BharatX shall securely delete, anonymise, aggregate, and permanently destroy Personal Data using commercially reasonable methods appropriate to the nature of the information.

Information Security

BharatX maintains commercially reasonable technical and organisational measures designed to protect Personal Data against unauthorised access, disclosure, alteration, destruction or accidental loss. Security measures may include encryption during transmission, encryption at rest where appropriate, secure authentication mechanisms, role-based access controls, least-privilege access principles, multi-factor authentication for administrative access, secure software development practices, vulnerability assessments, penetration testing, end-point protection, intrusion detection, audit logging, security monitoring, backup and disaster recovery procedures, periodic security reviews, employee confidentiality obligations, vendor due diligence, incident response procedures and periodic access reviews.

While BharatX employs commercially reasonable security measures, no system connected to the Internet can guarantee absolute security. Users are responsible for maintaining the confidentiality of their account credentials and promptly notifying BharatX of any suspected unauthorised access.

Personal Data Breaches

In the event BharatX becomes aware of a Personal Data breach, BharatX shall take reasonable steps to investigate the incident, contain the breach, assess potential risks, mitigate adverse consequences, preserve relevant evidence, comply with notification obligations under Applicable Law, notify competent authorities where legally required, notify affected Users where required under Applicable Law.

Cookies and Similar Technologies

The Platform may use cookies, local storage, web beacons, SDKs and similar technologies for providing Services. Where required by Applicable Law, BharatX shall obtain appropriate consent before deploying non-essential cookies. Users may manage cookie preferences through browser settings or cookie management tools, although disabling certain cookies may affect Platform functionality. Users may modify cookie preferences using the cookie consent management platform, where available.

Children's Privacy

The Platform is intended solely for individuals who are legally competent to enter into binding contracts under Applicable Law and is not directed toward children. BharatX does not knowingly collect Personal Data from children in contravention of Applicable Law. Where BharatX becomes aware that Personal Data relating to a child has been collected without appropriate legal authorisation, BharatX shall take reasonable steps to delete such information. Where Applicable Law requires verifiable parental consent for processing children's Personal Data, BharatX shall comply with such requirements before undertaking such processing.

Grievance Redressal Officer

In accordance with Applicable Law, BharatX has designated a Grievance Officer responsible for addressing privacy-related concerns.

Grievance Officer

• Name: Mr. Keshav Manchoria
• Designation: Data Protection / Grievance Officer
• Email: support@bharatx.ai
• Address: B-472, Fourth Floor, Sushant Lok Phase-1, DLF QE, Gurgaon, Haryana, 122002

Users may contact the Grievance Officer regarding requests relating to Personal Data, correction requests, deletion requests, withdrawal of consent, complaints regarding privacy practices, security concerns, suspected unauthorised access and any other privacy-related issue. BharatX shall endeavour to acknowledge and resolve grievances within the timelines prescribed under Applicable Law.

Changes to this Privacy Policy

BharatX reserves the right to modify this Privacy Policy from time to time. Where material changes are made, BharatX may notify Users through one or more of the following:

• publication on the Platform
• email notifications
• in-application notifications
• website notices
• or any other reasonable communication method

The revised Privacy Policy shall become effective from the date specified therein unless otherwise required by Applicable Law. Continued use of the Platform following such changes shall constitute acceptance of the revised Privacy Policy to the extent permitted by Applicable Law.

Governing Law and Jurisdiction

This Privacy Policy shall be governed by and construed in accordance with the laws of India. Subject to Applicable Law and any mandatory statutory remedies available to Data Principals, the courts having jurisdiction over the registered office of BharatX shall have exclusive jurisdiction in relation to disputes arising out of or relating to this Privacy Policy.

Contact Us

For any questions regarding this Privacy Policy or our privacy practices, please contact:

• BHARATX GENAI PRIVATE LIMITED
• Email: support@bharatx.ai
• Registered Office: B-472, Fourth Floor, Sushant Lok Phase-1, DLF QE, Gurgaon, Haryana, 122002
• Website: https://www.bharatx.ai