Privacy Policy

In short

Mavrix AI Private Limited (“Graine”, “we”, “us”) runs Graine AI: voice and chat agents that businesses use to talk with their own customers, and the website and dashboard they build them in. This policy gives the information that India’s Digital Personal Data Protection Act, 2023 (the DPDP Act) and its Rules, and Article 13 of the EU General Data Protection Regulation (GDPR), ask a privacy notice to give.

• If you use Graine (an account, a workspace, our website), we decide why your data is used. We are the data fiduciary (the controller).
• If a business called or chatted with you using Graine, that business decides, and we process your data for it. We are its data processor. Ask the business first; you can also write to us, and we will pass your request on.
• We do not sell or rent personal data, and we do not use customers’ data to train AI models.
• You can ask to see, correct or delete your data, withdraw your consent, nominate someone to act for you, or complain. Use the form or write to founders@graine.ai. We aim to reply within 30 days, and never take longer than 90.

1. Who we are

Graine AI is provided by Mavrix AI Private Limited (GSTIN 09AAUCM0448F1Z6), a company in India.

• Registered office: Basement, Rajendra Complex, Naya Bans, Near Union Bank, Sector 15, Noida, Gautam Buddha Nagar, Uttar Pradesh – 201301, India.
• Corporate office: WeWork Princeville, Embassy Golf Links Business Park, Challaghatta, Bangalore, Karnataka – 560071, India.
• Email: founders@graine.ai

This policy covers our website, the Graine dashboard, our API and SDKs, and the voice, WhatsApp, in-app and chat agents our customers build with them.

2. Two roles: you as our user, and you as someone a business contacted

We handle personal data in two different roles. What this policy means for you depends on which one applies.

Workspace users and visitors: we are the data fiduciary

You are one of these if you sign up for Graine, are invited into a workspace, pay us, write to us, or visit our website. We decide why and how your data is used, and this policy is our notice to you.

People our customers call or chat with: we are the data processor

You are one of these if a business used a Graine agent to call you, message you on WhatsApp, or talk with you in its app or on its website. That business (our customer) decides why and how your data is used, and gives you its own notice. We process the data only on its instructions. The agent is artificial intelligence; the business decides what it says and does, and you can ask the business for a person.

3. What we collect

From workspace users and visitors

• Account: your name, email address, organisation, role and workspace. Our sign-in provider holds your credentials and sessions.
• Billing: billing name and address, GSTIN and business details, invoices, and the payment details you enter with our payment provider.
• Activity: what you change in a workspace (the audit trail), what you ask our support team, and the content you add: agents, prompts, contacts, knowledge-base documents.
• Device and usage: your IP address, browser and device type, and the pages you visit. Analytics are optional and load only if you agree.
• Forms: what you send us through the Trust Center and the privacy request form, so we can answer.

From people our customers contact (for the customer)

• Your phone number, and the number the call came from or went to.
• Call audio and recordings, where the customer records calls.
• Transcripts, summaries, and answers extracted from the conversation, including anything you say.
• What you type in a chat, and the context an app sends (screen details and variables). Our SDK masks PAN, Aadhaar, card numbers, phone numbers and email addresses in what it sends on its own, before it leaves your device.
• An identifier your app sends for you. We turn it into a one-way key before we use it for memory or past conversations.
• Agent memory, only if the customer turns it on; what is saved is redacted first.
• A voice sample, only if you record one for a custom voice.

4. Why we use it, and on what basis

Under the DPDP Act we rely on your consent (section 6) or on a use the Act allows without it (section 7), such as providing a service you asked for or complying with the law. Under the GDPR the bases are in brackets.

5. Who we share it with

• Our subprocessors: the companies that host, transcribe, speak, connect, email, bill or monitor for us. The full list, with what each handles and where, is on the Trust Center.
• Your workspace: other members see your name, email and role, and what you change.
• The customer, for the people it contacted.
• Authorities, when the law requires it or to protect rights.
• A buyer, if Graine is sold or merged. We will tell you first, and the buyer must keep honouring this policy.

We do not sell or rent personal data.

6. Transfers outside your country

Graine’s servers are in Mumbai, India. Some subprocessors process data elsewhere: for example, call recordings are stored in the United Kingdom and our API-key store is in the United States. Where we have not confirmed a vendor’s location, the Trust Center says “On request” instead of guessing. The DPDP Act allows personal data to leave India except to countries the Government restricts (section 16). If you are in the European Union or the United Kingdom and need specific transfer terms, tell us when you request the data processing agreement.

7. How long we keep it

When you ask us to delete your data

We erase it, except what the law makes us keep, and we tell you what that is. India’s DPDP Rules (Rules 6(1)(e) and 8(3)) require personal data, the traffic data connected with it and the logs of its processing to be kept for at least 12 months from the date of the processing, after which they are erased unless another law requires longer. We apply that rule to what we hold as the data fiduciary, and where we process for a customer, the customer decides and we apply the same rule.

When a customer leaves, we delete its workspace’s data from live systems within 30 days of its written instruction. Copies in backups age out on our providers’ normal cycle.

One limit today: a working copy of call records, kept in a separate store of ours, is not removed by an erasure request or when a customer leaves.

8. How we protect it

Our safeguards include encryption in transit, encryption at rest by our hosting and database providers, roles and permissions checked on every request, a hash-chained audit trail, workspaces kept apart from each other, and masking on the device. The Trust Center lists each safeguard and says whether it is in place or still being built, and the security overview explains how they work.

No system is completely secure, so we do not promise that. We do promise to protect your data with the safeguards we describe, and, if a personal data breach affects you, to tell you and, where the law requires, the Data Protection Board of India without delay.

9. Cookies and similar technologies

We use what keeps you signed in without asking. Everything else loads only if you agree, one choice for each purpose, and you can change it at any time.

Fonts and static files load from Google Fonts, jsDelivr and similar services, which see your IP address. Change your cookie choices.

10. Your rights, and how to use them

You have these rights over your personal data.

• Access: a summary of the personal data we process about you, and who we have shared it with (DPDP Act section 11).
• Correction and completion of data that is wrong or incomplete, and erasure of data you no longer want us to hold, subject to the retention rules in part 7 of this policy (DPDP Act section 12).
• Grievance redressal: a reply to a complaint about how we handled your data (section 13).
• Nomination: you may nominate one or more people to use these rights for you if you die or cannot act (section 14; Rule 14(4)).
• Withdraw your consent at any time (section 6(4)); see part 13 below.
• If the GDPR applies to you, you also have the right to restrict or object to processing, and to receive your data in a portable form.

How to ask

Use the form below, or write to founders@graine.ai. To find your data we need an identifier: the email address of your Graine account, or the phone number a business called you on, or the name of the business. We may ask you to confirm who you are before we act, so that nobody else can read or delete your data. There is no charge for a reasonable request. If we cannot do what you ask, we tell you why.

If a business contacted you using Graine, that business decides what happens to your data. Ask it first. If you write to us, we pass your request to it and help it reply; we do not answer for it.

We aim to reply within 30 days of your reference number, and never take longer than 90 days.

11. Grievance Officer

Our Grievance Officer answers questions about how we process your personal data and handles complaints about it. How to raise a complaint, and what we do with it.

• Email: founders@graine.ai
• Post: Grievance Officer, Mavrix AI Private Limited, at the registered office above.
• Reply: we acknowledge within 2 working days, reply within 30 days of your reference number where we can, and never later than 90.

12. Complaints to a regulator

If our reply does not settle your grievance, you may complain to the Data Protection Board of India. The DPDP Act asks you to use our grievance process first (section 13). If you are in the European Union or the United Kingdom, you may also complain to your local data protection supervisory authority.

13. Withdrawing consent

You can withdraw a consent as easily as you gave it. Cookie and analytics choices: Cookie settings. News and offers: the unsubscribe link in each email. Anything else: the form above or an email to founders@graine.ai. Withdrawing does not affect what we did before, and it may mean we can no longer provide a service that needs the data.

14. Children

Graine is a business service. It is not directed at children, and we do not knowingly collect a child’s personal data for our own purposes. If a customer’s agent contacts a child, the customer is responsible for the verifiable parental consent the DPDP Rules ask for (Rule 10). If you believe a child has given us personal data, write to us and we will delete it.

15. Changes to this policy

When we change this policy we change the date at the top. For a change that matters, we also email workspace Admins. Earlier versions are available on request.

16. Contact us

For anything in this policy: