Your Data Rights: how to make a request

Your Data Rights: how to make a request

This page tells you how to ask Graine to show, correct, complete or erase your personal data, how to nominate someone to act for you, and how to withdraw a consent. It is the published means required by Rule 14(1) of the Digital Personal Data Protection Rules, 2025 (the "Rules"), read with sections 11 to 14 of the Digital Personal Data Protection Act, 2023 (the "Act"). The Rules' duties on rights start on 13 May 2027; we follow this process now.

1. In short

1. Email founders@graine.ai with the subject "Data request". Say what you want and give an identifier (part 4).
2. You get a reference number. We confirm who you are, find your data, and answer within 30 days and never later than 90 days.
3. If a business contacted you using Graine, that business decides what happens to your data. We pass your request to it and help it answer.
4. If you are not satisfied, use our grievance process, and then the Data Protection Board of India.

2. Which request goes to whom

3. Your rights

4. How to make a request, and what identifies you

How (Rule 14(1)(a)).

• Email founders@graine.ai with the subject "Data request" (works now); or
• use the request form on our website at www.graine.ai/privacy-policy (also on www.graine.ai/grievance-officer), which gives you a reference number at once; or
• write to The Privacy & Grievance Officer, Mavrix AI Private Limited, Basement, Rajendra Complex, Naya Bans, Near Union Bank, Sector 15, Noida, Gautam Buddha Nagar, Uttar Pradesh – 201301, India.

What identifies you (Rule 14(1)(b), (5)). We need an identifier to find your data. Give one of:

• the email address of your Graine account;
• the phone number a business called or messaged you on, with the name of the business;
• your workspace name, if you are a workspace member.

Proof it is you. We may ask you to confirm who you are before we act, for example by replying from the email address on the account or by confirming details only you would know. We ask for no more than we need. The aim is that nobody else can read or delete your data.

Say what you want. Access, correction (and what is wrong), erasure, withdrawal, nomination, or a grievance. You may write in English; if you prefer another language, say so.

5. What happens next

There is no charge for a reasonable request. If we need longer than 30 days, we tell you why and when you will have the answer, and it is never later than 90 days.

6. What we may keep, and what we may refuse

• Records the law makes us keep. India's Rules (Rules 6(1)(e) and 8(3)) require personal data, traffic data and the logs of its processing to be kept for at least one year from the date of the processing, then erased unless another law requires longer. This applies from 13 May 2027. Tax and company law also require us to keep invoices and billing records for several years. We tell you what we kept and why.
• A copy in a separate working store. The copy of a call kept in a separate working store, with its transcript, summary, answers, phone numbers and recording link, is not erased by this process today. Erasure covers the main database, recording storage and memory.
• A request we cannot verify, or that is plainly unfounded or abusive. The Act asks Data Principals not to impersonate another person, make false complaints or give false information (section 15). We explain any refusal in writing.
• Another person's data. We do not give you data about someone else.
• Data held for a business. We cannot decide for the business; we pass the request on (part 2).

7. Nominating someone to act for you

Under section 14 and Rule 14(4) you may nominate one or more people to exercise your rights if you die or cannot act. Write to us from your account email, naming the person, how to reach them, and which rights they may use. When a nominee later asks to act, we ask for proof of the event and of their identity before we do anything.

8. Withdrawing consent

You can withdraw any consent as easily as you gave it: cookie and analytics choices through the cookie settings link on our website; news and offers through the unsubscribe link in each email; anything else by writing to us. Withdrawing does not affect what we did before, and it may mean we can no longer provide a service that needs the data.

9. What works today, and what is being rolled out (as of 3 Nov 2026)

10. If you are not satisfied

Use our Grievance Redressal Policy (write to the Grievance Officer at founders@graine.ai). If our reply does not settle the matter, you may complain to the Data Protection Board of India; the Act asks you to use our process first (section 13). In the EU or UK you may also complain to your supervisory authority.

11. Contact

founders@graine.ai, for the attention of the Privacy & Grievance Officer. Company: Mavrix AI Private Limited, trading as Graine AI (CIN U62099KA2025PTC210316).

Framework mapping

Revision history