1. Introduction and Scope

This Privacy Policy explains how [Raymera Legal Entity Name] Private Limited (“Raymera”, “we”, “us”, “our”), a company incorporated under the Companies Act, 2013 with CIN [CIN] and registered office at [Registered Address], collects, uses, stores, shares and protects personal data when you use raymera.com, its sub-domains, the Raymera dashboard, and the Raymera products (together, the “Services”).

The Services currently include Raymera Chat, Raymera LeadGen, Raymera Content Engine and, when launched, Raymera Booking and other Raymera products. This Policy applies to all of them unless a product-specific notice says otherwise.

This Policy is issued in accordance with:

• the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”);
• the Information Technology Act, 2000 (“IT Act”) and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, to the extent still in force;
• the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 (“Intermediary Rules”);
• the CERT-In Directions dated 28 April 2022 issued under Section 70B of the IT Act; and
• lawful directions of the Government of India, including the Ministry of Electronics and Information Technology (MeitY) and the Ministry of Home Affairs (MHA).

Our role: Data Fiduciary and Data Processor

Raymera acts in two capacities, and your rights depend on which one applies.

Where Raymera is a Data Processor, the business that deployed Raymera (our “Customer”) is the Data Fiduciary. The Customer decides why and how that data is processed, is responsible for giving you notice and obtaining consent, and handles your requests. We process that data only on the Customer’s documented instructions and our data processing agreement with them. If you contact us about such data, we will forward your request to the relevant Customer where lawful.

By using the Services, you acknowledge that you have read this Policy. Where consent is the basis for processing, we will seek it separately and explicitly, as described in Section 4.

2. Personal Data We Collect

We collect only the personal data needed for the purposes in Section 3. We do not knowingly collect sensitive categories such as health, biometric, financial account passwords, caste, religion or sexual orientation, and we instruct Customers not to configure Raymera products to collect them.

Data you give us directly

Data collected automatically

Data processed on behalf of Customers (End User data)

Customers control what fields their deployments collect. End Users should read the privacy notice of the business whose website they are using.

Data from third parties

We may receive personal data from integrations you connect (such as CRM, calendar, email or messaging tools), from payment gateways confirming transactions, from business partners and resellers, and from publicly available professional sources for B2B outreach. We use such data only for the purposes it was shared for.

3. Purposes and Legal Basis

Under the DPDP Act, we process personal data either with your consent (Section 6) or for a legitimate use (Section 7). We do not process personal data for any purpose not listed below without fresh notice and, where required, fresh consent.

We do not sell personal data. We do not use personal data for behavioural profiling of children or for targeted advertising directed at children.

4. Consent and Notice

Where we rely on consent, it is free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the data needed for the stated purpose.

• Itemised notice. Before or at the time of collection, we tell you what data we collect, why, and how to exercise your rights and complain to the Data Protection Board of India. This Policy and the in-product notices together form that notice.
• Separate consents. Consent for marketing is separate from consent for the Service. Pre-ticked boxes are not used.
• Language. You may request this notice in English or any language listed in the Eighth Schedule to the Constitution of India by writing to [privacy@raymera.com].
• Withdrawal. You can withdraw consent as easily as you gave it: through account settings, the unsubscribe link in any marketing email, or by writing to us. Withdrawal does not affect processing done before it. After withdrawal, we and our processors will stop processing within a reasonable time, unless law requires us to keep the data. Withdrawing consent needed to run the Service may mean we cannot continue to provide it.
• Consent Managers. Once Consent Managers registered with the Data Protection Board are operational, you may give, manage, review or withdraw consent to Raymera through them.
• Records. We keep records of consent given and withdrawn, as proof under the DPDP Act.

5. AI Processing and Customer Data

Raymera products use artificial intelligence to answer questions, qualify leads, generate content and route conversations. This section explains how that affects your data.

• No training on your data by default. We do not use Customer business content or End User conversations to train or fine-tune any general-purpose AI model. We may use such data to improve a Customer’s own deployment only when that Customer enables it.
• Third-party AI providers. We use carefully selected AI model providers as Data Processors to generate responses. They receive only the data needed to generate a response, are contractually barred from using it to train their models, and must delete it within their stated retention period. The current list is in Section 7.2.
• Human review. Authorised Raymera staff may review conversations only to provide support you request, investigate abuse or security incidents, or comply with law. Access is logged and limited by role.
• Automated decisions. Lead scoring and qualification are suggestions to the Customer’s sales team. Raymera products do not make decisions that produce legal or similarly significant effects on End Users without human involvement by the Customer.
• Disclosure to End Users. Customers must tell End Users they are interacting with an AI assistant and must provide a way to reach a human.
• Accuracy. AI outputs may be incomplete or incorrect. Customers are responsible for reviewing the knowledge they provide and the outputs they rely on.
• Unlawful content. Customers must not configure Raymera products to collect or generate content prohibited under Rule 3(1)(b) of the Intermediary Rules or any other law. We may disable deployments that do.

6. Cookies and Tracking Technologies

We use cookies, local storage, pixels and similar technologies. Non-essential cookies are set only after you accept them in our cookie banner, and you can change your choice at any time through “Cookie Settings” in the website footer.

The Raymera Chat widget on a Customer’s website sets only the cookies needed to keep a conversation continuous. Customers are responsible for obtaining End User consent for any cookies their deployment uses. You can also block or delete cookies through your browser; some features may then stop working.

7. How We Share Personal Data

We share personal data only as described below. Every recipient that processes data for us is bound by a written contract requiring confidentiality, security safeguards equal to ours, processing only on our instructions, and deletion or return of data when the work ends.

Categories of recipients

• Customers. End User data captured by a deployment is made available to the Customer who owns it, and to the integrations that Customer connects.
• Service providers (Data Processors). Cloud hosting, AI model providers, email delivery, analytics, customer support tools, payment gateways and professional auditors.
• Affiliates. Group companies that help us operate the Services, under this Policy.
• Professional advisers. Lawyers, chartered accountants and auditors, under confidentiality duties.
• Business transfers. A buyer, investor or successor in a merger, acquisition, restructuring or sale of assets, who must honour this Policy.
• Government and law enforcement. As described in Section 7.3.

Current sub-processors

We will update this list before adding a new sub-processor. Customers may subscribe to change notices at [privacy@raymera.com].

Lawful requests from Government and law enforcement

We disclose personal data to Government agencies only when legally required and only to the extent required. This includes:

• Interception, monitoring and decryption directions issued by the competent authority under Section 69 of the IT Act and the Information Technology (Procedure and Safeguards for Interception, Monitoring and Decryption of Information) Rules, 2009, including directions authorised by the Union Home Secretary, Ministry of Home Affairs, or a State Home Secretary.
• Blocking directions under Section 69A of the IT Act, and traffic data requests under Section 69B.
• Requests from authorised agencies under Rule 3(1)(j) of the Intermediary Rules, to which we respond within 72 hours of a lawful written order, for prevention, detection, investigation or prosecution of offences or for cyber security incidents.
• Notices from the Indian Cyber Crime Coordination Centre (I4C), Ministry of Home Affairs, and other designated agencies, including those received through Government-notified portals.
• CERT-In directions under Section 70B of the IT Act, including requests for logs and incident information.
• Court orders, summons and notices under the Bharatiya Nagarik Suraksha Sanhita, 2023 or other applicable law.
• The Data Protection Board of India and other statutory regulators.

We review each request for legal validity and scope. Where the law allows, we notify the affected Customer or user before disclosing. We keep all interception and monitoring directions strictly confidential as required by law.

We do not sell, rent or trade personal data to anyone.

8. Data Storage and Cross-Border Transfers

Our primary data is stored on servers located in [India / Country and region]. Security and ICT system logs required under the CERT-In Directions are maintained within Indian jurisdiction.

Some sub-processors, including AI model providers, may process data outside India. Under Section 16 of the DPDP Act, we transfer personal data outside India only to countries not restricted by the Central Government by notification, and subject to any conditions the Government prescribes under the DPDP Rules. Each transfer is covered by a contract requiring protection at least equal to this Policy. Where a sectoral law or a Customer contract requires data to stay in India, we honour that requirement.

9. Data Retention and Deletion

We keep personal data only as long as the purpose needs it or the law requires it, then delete or irreversibly anonymise it.

Backups are overwritten on a rolling [35]-day cycle. Deleted data may remain in backups until overwritten, and is not restored except for disaster recovery. Where we intend to erase data because the purpose is no longer served, we will notify you at least 48 hours in advance where the DPDP Rules require it.

10. Security Safeguards and Breach Notification

We apply reasonable security safeguards, as required by Section 8(5) of the DPDP Act and Rule 6 of the DPDP Rules, to prevent personal data breaches.

• Encryption of data in transit (TLS 1.2 or higher) and at rest.
• Role-based access control, least-privilege access, multi-factor authentication for staff, and access logs.
• Logical separation of each Customer’s data.
• Monitoring, logging and alerting to detect unauthorised access.
• Regular backups and a tested recovery plan.
• Vulnerability scanning, patching and periodic security reviews.
• Staff confidentiality agreements and privacy and security training.
• Contractual security obligations on every Data Processor.

No system is completely secure. You are responsible for keeping your login credentials confidential and for configuring your workspace securely.

If a breach happens

11. Your Rights

As a Data Principal under the DPDP Act, you have the following rights over personal data for which Raymera is the Data Fiduciary.

How to exercise them. Use the privacy settings in your account, or email [privacy@raymera.com] with the subject “Data Principal Request”. We will verify your identity before acting, using information we already hold. We respond within the period set by the DPDP Rules, and in any case within 90 days.

End Users. If your data was collected through a Customer’s website, send your request to that business. If you contact us, we will direct it to them.

Your duties. Under Section 15 of the DPDP Act, you must provide authentic information, not impersonate anyone, not suppress material information, and not file false or frivolous complaints.

12. Children and Persons with Disabilities

The Services are built for businesses and are not directed at anyone under 18. We do not knowingly create accounts for, or process personal data of, children. If we learn that we hold a child’s personal data without verifiable consent of a parent or lawful guardian, as required by Section 9 of the DPDP Act and Rule 10 of the DPDP Rules, we will delete it promptly. We do not track, behaviourally monitor or target advertising at children.

Customers whose websites may be used by children must obtain verifiable parental consent themselves and must not configure Raymera products to collect children’s data without it.

For a person with a disability who cannot take legally binding decisions, we accept consent and requests from their lawful guardian, after verifying the guardian’s appointment as required under Rule 11 of the DPDP Rules.

To report that a child’s data has been shared with us, write to [privacy@raymera.com].

13. Grievance Officer, Contact and Changes

Grievance Officer

In accordance with Section 13 of the DPDP Act, Rule 3(2) of the Intermediary Rules and Rule 5(9) of the SPDI Rules, 2011, our Grievance Officer is:

We acknowledge every complaint within 24 hours and aim to resolve it within 15 days of receipt. In all cases we resolve Data Principal grievances within the period prescribed under the DPDP Rules, not exceeding 90 days.

Data Protection Board of India

If you are not satisfied with our response, you may file a complaint with the Data Protection Board of India through its official digital platform, after exhausting our grievance process as required by Section 13(3) of the DPDP Act.

Third-party websites and integrations

The Services may link to or integrate with third-party websites and tools. Their privacy practices are governed by their own policies. We are not responsible for them, and we recommend you read them before connecting.

Changes to this Policy

We may update this Policy to reflect changes in law, the Services or our practices. The “Last updated” date at the top shows the latest version. For material changes, we will notify account holders by email or in-product notice at least [15] days before they take effect and, where required, seek fresh consent. Earlier versions are available on request.

Governing law

This Policy is governed by the laws of India. Subject to the powers of the Data Protection Board of India, courts at [Bengaluru, Karnataka] have exclusive jurisdiction over disputes arising from it.

Contact us

For any privacy question, write to [privacy@raymera.com] or to [Raymera Legal Entity Name] Private Limited, Rajiv Gandhi Nagar, Kodigehalli, Bengaluru, Karnataka 560097, India.

Last updated: September 17, 2026 at 23:47 pm