Privacy Policy

This Privacy Policy explains what personal data we collect when you use the Chataak website, applications and related services (together, the "Service"), why we collect it, who we share it with, how long we keep it, and what rights you have over it.

Please read this Policy together with our Terms and Conditions. Words defined in the Terms, including "Account", "Your Content", "AI Output", "Connected Account" and "Credits", have the same meaning in this Policy.

We have tried to write this Policy in plain language. If anything in it is unclear, or if you would like it explained, please write to us at contact@chataak.com and we will help.

The Service is operated by Chataak LLP ("Chataak", "we", "us" or "our"), a limited liability partnership registered in India.

• Registered address: 1ST FLR, B1 VANIJYA NIKUNJ, Industrial Complex, ENKAY TOWER PLOT, B, Udyog Vihar, Gurugram, Haryana - 122016, India
• LLP Identification Number (LLPIN): ACZ-3104
• GSTIN: 06AAWFC7130R1ZO
• Contact: contact@chataak.com

We decide the purposes for which, and the means by which, your personal data is processed in connection with the Service. Under the Digital Personal Data Protection Act, 2023, this makes us the Data Fiduciary in respect of that data, and makes you the Data Principal.

This Policy applies to personal data we process through our website, our mobile applications, and our correspondence with you about the Service.

It applies to the person who opens an Account and to anyone invited to join that Account. Where an Account belongs to an organisation, the organisation controls the Account and the content in it, and members of that Account may be able to see information about activity within it.

This Policy does not apply to:

• Websites, applications and services operated by others that you may reach through links in the Service
• The social media platforms you choose to connect, which handle your information under their own privacy policies once you connect them or publish to them
• Information you choose to publish, which becomes public on the platform you publish it to

We process personal data in accordance with the laws of India, including the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 together with the rules made under them. Where the law of the country you live in gives you additional protections or rights, those remain available to you to the extent the law requires.

In this Policy:

• "Personal data" means any data about an individual who is identifiable by or in relation to that data.
• "Processing" means any operation performed on personal data, including collecting, recording, organising, storing, using, sharing, restricting, erasing or destroying it.
• "Data Principal" means the individual the personal data relates to. Where the individual is a child, it includes their parent or lawful guardian, and where the individual is a person with a disability, it includes their lawful guardian.
• "Data Fiduciary" means the person who determines the purpose and means of processing personal data. That is us, in respect of the Service.
• "Data Processor" means a person who processes personal data on behalf of a Data Fiduciary. Our providers act as our Data Processors.

We ask for your consent before we process your personal data for a purpose that requires it, and we tell you what data we need and why at the point we ask for it. Your consent covers only the purposes described to you, and only the data necessary for those purposes.

Your consent must be free, specific, informed, unconditional and unambiguous, and it must be given by a clear affirmative action. By creating an Account and using the Service, you consent to the processing described in this Policy.

Withdrawing consent. You may withdraw your consent at any time by writing to contact@chataak.com, or by turning off the relevant setting in the Service where one is provided. Withdrawing consent is as easy as giving it. Withdrawal does not affect processing carried out before you withdrew, and it does not affect processing we are required or permitted by law to continue.

If you withdraw consent for processing that is necessary to operate the Service, we may no longer be able to provide some or all of it to you, and you may need to close your Account.

Consent Managers. Where the law provides for it, you may give, manage, review and withdraw your consent through a Consent Manager registered with the Data Protection Board of India.

Processing without consent. In the limited situations that Indian law allows, we may process personal data without separately asking for your consent. These include where you have voluntarily provided the data to us for a specified purpose and have not indicated that you object to its use for that purpose; where we must comply with a law, a court order or a request from a lawful authority; and where processing is necessary to respond to a medical emergency or a threat to life or safety.

Depending on how you use the Service, you may give us:

• Your profile details — your name, email address, profile picture, and a contact phone number if you choose to provide one
• Your business or brand details — the name, description, address, location, contact email address, contact phone number, website and logo of the business or personal brand you set up in a project
• Your catalogue — the products, collections, services and offers you record so the Service can create content about them, including their names, descriptions, prices and images
• Your billing details — the legal name, billing address, state and postal code we need to raise a valid invoice, and a tax registration number where you require a tax invoice
• Your preferences — display settings, notification settings and similar choices
• Your correspondence with us — the content of the messages you send when you contact us for support, and our replies

Please provide only the information the Service asks for. Do not include personal data about other people in free-text fields unless it is necessary and you are entitled to provide it.

When you use the Service to create content, we process:

• The briefs, prompts, instructions and settings you enter
• The scripts, scene text and narration generated for you, and any edits you make to them
• The photographs, video clips, audio, music and logos you upload
• The images, video clips, voice-overs, music, subtitles and other AI Output generated for you
• The finished videos rendered for you
• The captions, hashtags and links you write or generate for a post

Some of this content may contain personal data — for example, a photograph of a person, a voice recording, or a customer's name in a testimonial. You are responsible for having the right to provide that content, and for giving any notice and obtaining any consent that the law requires from the people concerned. This is also set out in our Terms and Conditions.

When you use the Service, we collect some information automatically:

• Device and application information — the type of device and browser you use, operating system, application version, language and screen settings
• Connection information — your internet protocol address, and the approximate country it indicates
• Sign-in records — when you signed in, from what approximate location, and when you were last active, so we can secure your Account and sign you out after a period of inactivity
• Activity records — the actions taken in your Account, such as when a project was created, a video was generated or a post was published, together with any errors that occurred
• Usage records — how much of your plan allowance you have used, which features consumed it, and when
• Diagnostic reports — where our applications encounter a fault, a report describing what went wrong so we can fix it

We use this information to operate and secure the Service, to fix problems, to measure and bill usage of your plan, and to detect misuse. We do not use it to build advertising profiles about you.

We may receive information about you from:

• The sign-in provider you choose — when you sign in using a third-party sign-in service, that provider confirms your identity to us and shares basic profile details such as your name, email address and profile picture, according to the permissions you grant
• Business listing information — when you search for your business while setting up a project, we receive details about that business, such as its name, address, contact details, location, opening information, photographs and published reviews, which we use to help you fill in your project
• The platforms you connect — when you connect a social media account, we receive details of the account, page or channel you have connected, such as its name and picture, and, once you publish, statistics about how your posts and your account are performing
• Our payment providers — confirmation of whether a payment succeeded or failed, and the information needed to record the transaction and raise an invoice
• People who contact us about you — for example, someone who submits a complaint about content published from your Account

We process location information in a limited way:

• The location you enter. When you set up a project you tell us where your business is. We store that address and its approximate coordinates so that content can be made relevant to your area.
• Your device's location, only if you allow it. When you search for your business, your browser may ask whether you are willing to share your approximate location. If you agree, we use it only to make the search results near you more relevant at that moment. If you decline, search still works.

We do not track your location in the background, we do not build a history of where you have been, and our mobile applications do not ask for continuous or background location access.

We do not ask you for sensitive personal data, and the Service does not need it. Please do not upload or enter information about health, financial accounts, biometric or genetic characteristics, sexual life, caste, religious or political beliefs, or similar sensitive matters, whether about yourself or anyone else.

We also do not:

• Collect identity documents or carry out identity verification checks on you
• Store complete payment card numbers, card security codes or banking credentials, all of which are handled by our payment providers and never reach us in full
• Buy personal data about you from data brokers
• Use advertising networks, advertising identifiers or third-party tracking technologies in the Service

We use personal data for the following purposes, and no others without telling you first:

• To create and secure your Account — to register you, sign you in, keep your session secure, and let you manage who else can access your Account
• To generate content for you — to produce scripts, ideas, images, video clips, voice-overs, music, subtitles, captions and hashtags in response to your instructions
• To produce finished videos — to assemble, render, store and make your videos available for download
• To publish and schedule — to post content to the accounts you connect, at the time you choose
• To show you performance figures — to retrieve and display statistics about the posts you have published and the accounts you have connected
• To manage your plan — to track the allowance you have used, apply the correct limits, and let you buy more
• To take payment and invoice you — to process payments, raise valid invoices and tax documents, and keep the financial records the law requires us to keep
• To send you notifications — to tell you when something in your Account needs your attention, and to send you service messages
• To provide support — to answer your questions, investigate problems you report, and put things right
• To keep the Service safe — to detect, investigate and prevent fraud, abuse, unauthorised access, and breaches of our Terms
• To improve the Service — to understand which features are reliable, where errors occur, and how to make the Service work better, using aggregated or de-identified information wherever we can
• To meet our legal obligations — to comply with the law, to respond to lawful requests from authorities and courts, and to establish, exercise or defend legal claims

The Service uses artificial intelligence to generate content for you. To do this, we send the information necessary to fulfil your request — such as your brief, your business and product details, your script and narration text, and any reference images you have provided — to specialist providers who perform the generation on our behalf as our Data Processors.

We send this information only to carry out the instruction you have given. When you use a generation feature, you are asking us to transmit that information for that purpose.

We do not use Your Content to train general-purpose artificial-intelligence models, and we require the providers who process it on our behalf to use it only to perform the service we have asked them for, and not for their own purposes.

Automated safety filters may prevent us from generating content that appears to breach our Terms or the rules of the provider carrying out the generation. Where this happens, the request may fail or be modified.

A member of our team may look at the content in your Account only in the limited circumstances described in the section on access by our personnel below.

We do not sell your personal data, we do not rent or trade it, and we do not disclose it for advertising or marketing by anyone else.

We share personal data only in the following circumstances:

• With providers who operate the Service on our behalf. These include providers who host and store information, who generate content, who deliver notifications, who process payments, who raise invoices and tax documents, and who help us diagnose faults. They act on our instructions as our Data Processors, are bound by contract to protect the information, may use it only to perform the service we have engaged them for, and must not use it for their own purposes.
• With the platforms you connect, when you tell us to. If you publish or schedule a post, or ask to see performance figures, we exchange the necessary information with the platform you have connected. This happens only for the accounts you have connected and the actions you have asked for.
• With our professional advisers. Our lawyers, accountants, auditors and insurers, where they need the information to advise us, and under a duty of confidentiality.
• With authorities and in legal proceedings. Where we are required to disclose information by law, by a court, or by a lawful request from a government or regulatory authority, or where disclosure is necessary to establish, exercise or defend a legal claim, or to prevent a serious threat to life, safety or property.
• In a business transfer. If our business or a part of it is reorganised, merged, acquired or sold, information may be transferred as part of that transaction. We will make sure the recipient is bound to protect it in a manner consistent with this Policy, and we will tell you if the transfer materially affects how your personal data is handled.

We may also publish or share information that has been aggregated or de-identified so that it can no longer reasonably be used to identify you.

When you connect a social media account, you authorise us to act on that account for the purposes you have chosen, such as publishing content and retrieving performance figures. We store the access permission you grant so that we can carry out those actions, and we keep it in encrypted form.

When you publish, the content you have chosen — including the video, caption, hashtags and any link — is sent to that platform and becomes subject to that platform's own terms and privacy policy. Once published, the content is on that platform, and it stays there until you remove it there. Deleting it from Chataak does not remove it from the platform.

You can disconnect a connected account at any time. Disconnecting withdraws our permission to act on that account and stops any scheduled posts to it. We will delete the stored access permission. Statistics we have already retrieved about posts you published may remain in your Account so that your historical reporting stays intact, and you may ask us to delete those as well.

You can also withdraw our access directly from the security settings of the platform concerned. If you do, publishing and statistics for that account will stop working until you reconnect it.

Our providers may store or process information on infrastructure located outside India. This is most likely to happen when content is generated for you and when diagnostic information is analysed.

Where information is processed outside India, we do so only where the law permits, we require the provider to protect it to a standard consistent with this Policy, and we remain accountable to you for it. We will not transfer personal data to any country that the Government of India restricts or notifies for this purpose.

We take reasonable security safeguards to prevent personal data being lost, misused, altered, disclosed or accessed without authorisation. These include:

• Encrypting information while it travels between your device and the Service, and while it is stored
• Storing the access permissions for your connected accounts in encrypted form
• Making the links used to load your media time-limited, so that they stop working after a short period
• Restricting access to systems and information according to role, so that people can reach only what they need
• Keeping credentials and secrets out of our operational records
• Signing you out after a period of inactivity
• Taking regular backups so that information can be restored
• Monitoring for unusual or suspicious activity and investigating it
• Reviewing our safeguards, and those of the providers we rely on, from time to time

No service can be made completely secure, and we cannot guarantee that unauthorised access will never occur. You also have a part to play. Please keep your sign-in credentials confidential, use up-to-date devices and secure networks, review who has access to your Account and remove anyone who should no longer have it, and disconnect social media accounts you no longer use. If you believe your Account has been accessed without your authorisation, tell us immediately at contact@chataak.com.

Authorised members of our team may access information about your Account — including your profile, usage, billing and support records, and, where it is strictly necessary, the content in your Account — in order to:

• Provide support that you have asked for
• Operate, maintain and troubleshoot the Service
• Administer billing and resolve payment problems
• Investigate a suspected breach of our Terms, a security incident, or unlawful activity
• Comply with a legal obligation

Such access is limited to what is necessary for the purpose, is available only to people whose role requires it, and is subject to confidentiality obligations.

If a personal data breach occurs, we will act promptly to contain and investigate it, and to reduce the harm it may cause.

We will report the breach to the Data Protection Board of India and to the Indian Computer Emergency Response Team, and inform you, within the timeframes and in the manner that Indian law prescribes.

When we inform you, we will describe in clear language what happened, what data was affected, what we have done in response, what we suggest you do to protect yourself, and how to contact us for more information.

We keep personal data only for as long as we need it for the purpose it was collected for. Once that purpose is served and we are no longer required to retain it, we erase it or make it anonymous.

While your Account is open, you can sign in at any time and delete specific items you uploaded or created — such as a project, a script, a video or an uploaded file. You can also delete your Account from Account settings. Closing your Account erases the personal data associated with it, subject to the exceptions below.

In practice:

• Your Account, profile, projects and content are kept while your Account remains open. Items you delete yourself are erased at that time. The rest is erased when you delete your Account from Account settings, or when you ask us to delete it, subject to the exceptions below
• Financial records, including invoices, tax documents and transaction records, are kept for the period Indian tax and company law requires, which may be up to eight years from the end of the relevant financial year
• Security, sign-in and activity records are kept for the period Indian law prescribes for records of this kind, and otherwise for as long as we need them to investigate misuse
• Support correspondence is kept for as long as we need it to resolve your query and for a reasonable period afterwards in case you contact us again about the same matter
• Backups are overwritten in the ordinary course, so a copy of deleted information may persist in a backup for a limited period before it is overwritten
• Records needed for a legal claim are kept until the claim, investigation or proceeding is concluded and any period for challenging it has passed
• Aggregated and de-identified information, which can no longer reasonably be used to identify you, may be kept without a time limit

Indian law gives you the following rights over your personal data. You can exercise any of them by writing to contact@chataak.com.

• The right to information. You may ask us for a summary of the personal data we hold about you and how we are processing it, together with the identities of the other parties with whom we have shared it and a description of what was shared.
• The right to correction and completion. You may ask us to correct personal data that is inaccurate or misleading, to complete data that is incomplete, and to update data that is out of date. You can change much of this yourself in your Account settings.
• The right to erasure. You may ask us to erase your personal data. We will do so unless retaining it is necessary for the purpose it was collected for, or the law requires us to keep it.
• The right to grievance redressal. You may complain to us about how we have handled your personal data, or about our response to any request you have made. See the section on grievance redressal below.
• The right to nominate. You may nominate another individual to exercise your rights on your behalf if you die or become unable to exercise them yourself. Write to us to make a nomination.
• The right to withdraw consent. You may withdraw your consent at any time, as described above.

How we handle your request. We may need to verify your identity before we act, and we may ask you for information that helps us do so. We will respond to your request as soon as we reasonably can, and in any event within 30 days. If we cannot do what you have asked, we will explain why and tell you how to take the matter further.

We will not charge you for exercising your rights, and we will not treat you any differently for having exercised them.

Indian law also places some duties on you as a Data Principal. When you deal with us, you must:

• Comply with the laws that apply to you
• Not impersonate another person when providing your personal data
• Not suppress material information when providing personal data, or when applying for a document, identifier or benefit
• Provide only authentic and verifiably correct information when you ask us to correct or erase your personal data
• Not register a false or frivolous complaint or grievance with us

You can delete individual items — a project, a script, a video, an uploaded file or a connected account — within the Service at any time.

To close your Account and have the personal data associated with it deleted, write to us at contact@chataak.com from the email address registered to your Account. We will verify the request and action it within 30 days.

When we action a deletion request we remove your profile, your projects and scripts, the media and finished videos stored for you, and the permissions you granted us for any accounts you had connected, which are revoked.

Some information necessarily survives deletion:

• Invoices, tax documents and transaction records, which we are required by law to retain
• Records we need to establish, exercise or defend a legal claim, or to investigate a breach of our Terms
• Copies held in our backups, until they are overwritten in the ordinary course
• Information that has been anonymised or aggregated so that it can no longer identify you
• Anything you have already published to a social media account you connected, which remains on that platform until you remove it there

Before you close your Account, please download any videos and other content you wish to keep. Once deleted, we cannot recover them for you.

We use a small number of cookies and similar storage on your device, and we use them only to make the Service work. Specifically, we use:

• A sign-in cookie, which keeps you signed in securely as you move between pages, and which expires after a period so that you are signed out if you stop using the Service
• A preference store, which remembers choices such as whether you prefer the light or dark appearance
• Short-lived temporary storage, used while you are signing in or connecting a social media account, and cleared once the process finishes

We do not use advertising cookies, we do not use third-party analytics or tracking cookies, and we do not allow anyone to track you across other websites through the Service.

When you make a payment, the checkout provided by our payment provider may set its own cookies in order to process the payment securely and prevent fraud. That is governed by their privacy policy.

You can block or delete cookies through your browser settings. If you block the sign-in cookie, you will not be able to stay signed in and most of the Service will not work.

Our mobile applications ask for the minimum access they need:

• Notifications, so that we can alert you when a video is ready, when a scheduled post has gone out, or when something in your Account needs attention. You can turn notifications off at any time in your device settings or in your Account settings. To deliver them, a notification identifier is registered for your device and removed when you sign out or turn notifications off.
• The file picker, which opens only when you choose to upload something, and which gives us access only to the specific files you select.
• Diagnostic reports, which are sent when the application encounters a fault so we can identify and fix it.

Our mobile applications do not access your camera, microphone, contacts, call logs, text messages, calendar or photo library in the background, and do not track your location. Purchases are not made inside the applications.

You can withdraw any permission you have granted, at any time, in your device settings. If you withdraw notification permission, the rest of the Service continues to work.

There are two kinds of message we may send you:

• Service messages, which relate to your Account and the Service — confirming a payment, telling you a video is ready, warning you that a scheduled post failed, notifying you of a security issue, or telling you about a change to this Policy or our Terms. You cannot opt out of these while you hold an Account, because we need to be able to reach you about your own Account.
• Optional messages, such as product updates, tips and offers. We send these only where you have agreed to receive them, and every one of them includes a way to stop. You can also change your preferences in your Account settings at any time.

Turning off optional messages does not affect service messages, and does not affect your Account.

We do not make decisions about you that produce legal effects, or similarly significant effects, by automated means alone.

The Service uses automation to generate content for you, and to flag activity that appears to breach our Terms — for example, unusual usage patterns, or content that our safety filters identify as prohibited. Where automated checks lead to a restriction on your Account, a member of our team reviews the matter, and you may ask us to review the decision by writing to contact@chataak.com.

The Service is intended for adults. You must be at least 18 years old to create an Account.

We do not knowingly collect or process the personal data of anyone under 18. We do not track or monitor the behaviour of children, we do not direct advertising at children, and we do not carry out any processing likely to have a detrimental effect on a child's wellbeing.

If you believe that someone under 18 has provided us with personal data, please write to us at contact@chataak.com and we will verify the position and delete the data.

Where a person with a disability has a lawful guardian, that guardian may act for them in dealing with us, and we will process their personal data only with the guardian's consent.

The Service may contain links to websites, applications and services operated by others, and allows you to connect your social media accounts.

Those third parties are responsible for their own handling of your information, under their own privacy policies. We do not control them, and this Policy does not cover what they do. We encourage you to read their policies before you use them or connect to them.

If you have a complaint about how we have handled your personal data, or about our response to a request you have made under this Policy, please write to us at contact@chataak.com with the subject line "Privacy Grievance".

To help us deal with your complaint quickly, please include:

• Your name and the email address registered to your Account
• A clear description of your complaint and when it arose
• Any reference numbers, dates or links that help us identify what happened
• The outcome you are seeking

We will acknowledge your complaint within 24 hours of receiving it and aim to resolve it within 15 days. Where a complaint is complex or needs investigation, we will tell you and keep you informed of progress.

If you are not satisfied with how we have handled your complaint, you may escalate the matter to the Data Protection Board of India, in the manner and within the time that the Digital Personal Data Protection Act, 2023 and the rules made under it provide. You may also write to us at our registered address set out above.

We may update this Policy from time to time, for example when we add a feature, change a provider, or when the law changes.

When we do, we will post the updated Policy on this page and change the "Last updated" date at the top. Where a change materially affects how we handle your personal data, we will give you notice through the Service or by email before it takes effect, and where the law requires it, we will ask for your consent again.

Please review this page from time to time. Continuing to use the Service after an updated Policy takes effect means you accept it.

For any question, request or complaint about this Policy or about your personal data, contact us at contact@chataak.com.

Chataak LLP, 1ST FLR, B1 VANIJYA NIKUNJ, Industrial Complex, ENKAY TOWER PLOT, B, Udyog Vihar, Gurugram, Haryana - 122016, India.