SAMVIDENT — Privacy policy
Privacy policy

Your data, in plain words.

LAST UPDATED · [DATE]VERSION 0.9DPDPA · GDPR · CCPA · PDPL
§ 01

Who we are

IN PLAIN WORDSWe are SAMVIDENT. One notice, written to four privacy laws, explains what we do with personal data.

This notice is given by SAMVIDENT, a company incorporated in India (“SAMVIDENT”, “we”, “us”).

Where we decide why and how personal data is processed, we are responsible for it: a Data Fiduciary under India’s DPDPA, a controller under the GDPR, a business under the CCPA, and a controller (in Saudi Arabia, a controlling entity) under the PDPL.

You can reach us on every matter in this notice at [email protected].
§ 02

Which laws apply

IN PLAIN WORDSThe law of the place you are in. Each uses its own words; this notice uses all of them.

We apply the highest standard across all four laws to everyone. Where a law gives you a specific right, or names things in its own terms, that is set out in the section concerned.

INDIA · DPDPADigital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025
WE AREData Fiduciary
YOU AREData Principal
REGULATORData Protection Board of India
EUROPEAN UNION · GDPRGeneral Data Protection Regulation (EU) 2016/679
WE AREController
YOU AREData subject
REGULATORYour local supervisory authority
CALIFORNIA · CCPACalifornia Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020
WE AREBusiness
YOU AREConsumer
REGULATORCalifornia Privacy Protection Agency · Attorney General
SAUDI ARABIA · UAE · PDPLSaudi Personal Data Protection Law and its Implementing Regulations · UAE Federal Decree-Law No. 45 of 2021
WE AREControlling entity (KSA) · Controller (UAE)
YOU AREData subject
REGULATORSDAIA (KSA) · UAE Data Office
§ 03

What this notice covers

IN PLAIN WORDSThe website, the early access desk and our emails. Contract data inside the product is governed by your organisation’s agreement with us.

This notice covers samvident.ai, the early access desk and our correspondence with you.

When an organisation uses the SAMVIDENT platform to review its contracts, that organisation decides why its contract data is processed. For that data we act only on its documented instructions, under a written data processing agreement: as a Data Processor (DPDPA), a processor (GDPR), a service provider (CCPA), and a processing entity or processor (PDPL). That organisation’s own privacy notice applies.
§ 04

What we collect

IN PLAIN WORDSOnly what you give us, and the minimum a website needs to work.
  • What you give us: your name, work email, company, role, and the answers you give on the early access desk.
  • What you write to us: the content of emails and messages you send.
  • What a website needs: basic technical data such as browser type and pages requested, used to keep the site secure and working. [Confirm cookie use: essential only.]
  • What we do not collect: sensitive personal data, special category data, financial details or data about children through this website.
CALIFORNIA · CCPA
In the past 12 months we have collected these categories of personal information: identifiers; professional or employment-related information; and internet or other electronic network activity information. Each came from you directly or from your device. We have not collected sensitive personal information.
§ 05

Why we use it

IN PLAIN WORDSTo reply to you, to give you the product you asked for, and to keep things secure.
  • To read and reply to your early access request.
  • To provide, support and secure the SAMVIDENT platform for organisations that use it.
  • To meet our legal obligations.
  • With your separate consent only: to send you updates about SAMVIDENT. You can stop these at any time.

We use personal data only for these specified purposes, and for no purpose incompatible with them. We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.
§ 06

On what basis

IN PLAIN WORDSEvery law asks for a lawful reason to process. Here is ours, in each law’s own terms.
INDIA · DPDPA
Your consent under Section 6, given by a clear affirmative action for a specified purpose after notice under Section 5; or a legitimate use under Section 7, such as where you voluntarily provide data for a specified purpose and have not indicated that you do not consent, or where the law requires it.
EU · GDPR
Steps you ask us to take before a contract, and performance of a contract (Article 6(1)(b)); our legitimate interests in replying to business enquiries and securing our services, which never override your rights (Article 6(1)(f)); legal obligation (Article 6(1)(c)); and your consent for updates (Article 6(1)(a)).
CALIFORNIA · CCPA
We collect, use and retain personal information only for the business purposes in this notice, and only as reasonably necessary and proportionate to them. This notice is our notice at collection.
KSA · UAE · PDPL
Your consent; or, where the PDPL permits, processing needed to perform an agreement to which you are party, to comply with a legal obligation, or for our legitimate interest, which never overrides your rights and is never relied on for sensitive data.
§ 08

Who we share it with

IN PLAIN WORDSOnly with providers bound by contract, and with model providers who see masked text only. We never sell or share data.
  • Service providers who host, email and secure our services for us. Each is bound by a written contract to act only on our instructions and to protect the data: a Data Processor under the DPDPA, a processor under GDPR Article 28, a service provider or contractor under the CCPA, and a processing entity or processor under the PDPL.
  • Model providers, who receive only masked text: parties, amounts and identifiers are replaced before any text is sent.
  • Authorities, where the law requires it.

We do not sell personal information and we do not share it for cross-context behavioural advertising, as the CCPA defines those terms, and we have not done so in the past 12 months. We do not use or disclose sensitive personal information. We honour Global Privacy Control signals.
§ 09

International transfers

IN PLAIN WORDSData may be processed outside the country you are in, always under a lawful safeguard.
INDIA · DPDPA
We transfer personal data outside India only as Section 16 permits, and never to a country or territory restricted by notification of the Central Government.
EU · GDPR
We transfer personal data outside the European Economic Area only to a country with an adequacy decision, or under the Standard Contractual Clauses approved by the European Commission, with supplementary measures where needed (Chapter V).
KSA · UAE · PDPL
We transfer personal data out of Saudi Arabia only as the PDPL and its Regulation on transfers outside the Kingdom permit, through an adequate jurisdiction or appropriate safeguards such as standard contractual clauses. Transfers out of the UAE follow Articles 22 and 23 of the UAE PDPL.
CALIFORNIA · CCPA
The same protections in this notice apply wherever your personal information is processed.

Organisations using the platform may choose where their data is hosted: [hosting regions to be confirmed].
§ 10

How long we keep it

IN PLAIN WORDSOnly as long as the purpose needs, then we erase it.

We keep personal data only for as long as needed for the purpose it was collected for, and erase it when that purpose is served or when you withdraw consent, unless the law requires us to keep it. Early access requests are kept for [retention period], then erased.

Where the DPDP Rules, 2025 prescribe a retention period, a minimum period for logs, or notice before erasure, we follow them. For California, the retention period above applies to each category of personal information listed in § 04.
§ 11

How we protect it

IN PLAIN WORDSMasking, encryption and limited access. If a breach happens, we tell you and the regulator.

We take reasonable security safeguards to prevent a personal data breach (DPDPA Section 8(5); GDPR Article 32; PDPL), including masking before model processing, encryption in transit and at rest, access controls and logging. Our controls are aligned to ISO/IEC 27001; the certification audit is pending.

INDIA · DPDPA
We intimate the Data Protection Board of India and each affected Data Principal without delay, and give the Board a detailed report within 72 hours, as Section 8(6) and the Rules require.
EU · GDPR
We notify the competent supervisory authority within 72 hours where required (Article 33), and you without undue delay where the breach is likely to result in a high risk (Article 34).
KSA · UAE · PDPL
We notify SDAIA within 72 hours, and the UAE Data Office as the UAE PDPL requires, and tell you where the breach may harm you.
CALIFORNIA · CCPA
We notify affected California residents as California’s data breach notification law requires.
§ 12

Your rights

IN PLAIN WORDSAsk what we hold, correct it, erase it, take a copy, object, opt out, nominate someone, or complain. Use the desk below.
INDIA · DPDPA
Access a summary of your personal data and its processing (Section 11). Correct, complete, update or erase it (Section 12). Grievance redressal, answered within the period the Rules prescribe (Section 13). Nominate someone to act for you in case of death or incapacity (Section 14). If our answer does not satisfy you, complain to the Data Protection Board of India.
EU · GDPR
Access (Article 15), rectification (16), erasure (17), restriction (18), portability (20), objection (21), and not to be subject to solely automated decisions (22). We answer within one month. You may complain to your supervisory authority (Article 77).
CALIFORNIA · CCPA
The right to know and access, to delete, to correct, to opt out of sale or sharing, and to limit use of sensitive personal information, and the right not to be discriminated against for using them. You may act through an authorised agent. We answer within 45 days, extendable once by 45 days with notice.
KSA · UAE · PDPL
The right to be informed, to access and obtain a copy in a readable format, to correction, and to destruction or erasure; in the UAE also to restriction, objection and portability. You may complain to SDAIA or the UAE Data Office.

We verify your identity before acting, using information we already hold. We do not charge for a request, unless the law allows a fee for one that is manifestly unfounded or excessive.

THE RIGHTS DESK · DRAFT YOUR REQUEST
TO: [email protected] · SUBJECT: {{rSubj}}

{{rBody}}

Open this in your email →
§ 13

Children

IN PLAIN WORDSThis website is not for children. We do not knowingly process their data.

SAMVIDENT is not directed at children. We do not knowingly process the personal data of a child: a person under 18 under the DPDPA, or under 16 (or a lower age set by a Member State) under the GDPR, without verifiable consent of a parent or lawful guardian. We do not track, monitor or target advertising at children (DPDPA Section 9). We do not sell or share the personal information of consumers under 16 (CCPA). Under the PDPL, a child’s data is processed only with the consent of a legal guardian.
§ 14

Changes to this notice

IN PLAIN WORDSIf this notice changes, we will say so here and, where it matters, by email.

We will post any change on this page with a new date, and review this notice at least once every 12 months. If a change materially affects how we use your data, we will tell you and, where required, ask for consent again.
§ 15

Contact and officers

IN PLAIN WORDSOne address for everything: [email protected].
GRIEVANCE OFFICER
Priya Menon, SAMVIDENT. Under the DPDPA.
DATA PROTECTION OFFICER
Arjun Kapoor. Under the GDPR and the PDPL, where required.
EU REPRESENTATIVE
Lena Hoffmann. Under GDPR Article 27.

Email: [email protected]. California consumers may also submit requests through the rights desk above. We aim to acknowledge every request within two working days.