Privacy Notice

Privacy Notice

This is Graine's notice under section 5 of India's Digital Personal Data Protection Act, 2023 (the "Act") and Rule 3 of the Digital Personal Data Protection Rules, 2025 (the "Rules"). It also gives the information Article 13 of the EU General Data Protection Regulation (GDPR) asks for. It is meant to be read on its own: you do not need any other document to understand what we collect, why, and what you can do. The Rules' duties on notice start on 13 May 2027; we apply this notice now.

1. In short

• Who we are. Mavrix AI Private Limited, trading as Graine AI ("Graine", "we"), runs voice and chat agents that businesses use to talk with their own customers, and the website and dashboard they build them in.
• Two roles. If you use Graine (an account, a workspace, our website, you pay us, or you write to us), we decide why your data is used: we are the Data Fiduciary (the "controller" under the GDPR). If a business called or chatted with you using a Graine agent, that business decides, and we process your data for it: we are its Data Processor. Ask the business first.
• No sale, no training. We do not sell or rent personal data. We do not use customer data to train or fine-tune AI models.
• Your choices. You can ask to see, correct or delete your data, withdraw a consent, nominate someone to act for you, or complain. Write to founders@graine.ai. We aim to reply within 30 days and never take longer than 90 days (Rule 14(3)).

2. Who we are

This notice covers our website, the Graine dashboard, our API and SDKs, and our own dealings with the people who use them. It does not cover Graine's separate consumer app, Tring, which has its own privacy notice.

3. Two roles: you as our user, and you as someone a business contacted

Workspace users and visitors: we are the Data Fiduciary. You are one of these if you sign up for Graine, are invited into a workspace, pay us, write to us, or visit our website. We decide why and how your data is used, and this notice is our notice to you.

People our customers call or chat with: we are the Data Processor. You are one of these if a business used a Graine agent to call you, message you on WhatsApp, or talk with you in its app or on its website. That business decides why and how your data is used, and gives you its own notice. We process the data only on its instructions. The agent is artificial intelligence; the business decides what it says and does, and you can ask the business for a person. If you write to us about such a call, we pass your request to the business and help it reply; we do not answer for it.

4. The personal data we collect, why, and on what basis

Under the Act we rely on your consent (section 6) or on a use the Act allows without consent (section 7), such as providing a service you asked for, complying with a law, or employment purposes for our own staff. Under the GDPR the matching legal basis is in brackets.

4.1 From workspace users and visitors

Content you add to a workspace (agents, prompts, contacts, knowledge-base documents) is data you put there for your own use; we hold it to provide the service.

4.2 From people our customers contact (processed for the customer)

Depending on how the customer set up its agent, we may process: your phone number and the number the call came from or went to; call audio and recordings, where the customer records calls; transcripts, summaries and answers extracted from the conversation, including anything you say; what you type in a chat, and the context an app sends (screen details and variables), where our SDK masks PAN, Aadhaar, card numbers, phone numbers and email addresses in what it sends on its own before it leaves your device; an identifier your app sends for you, which we turn into a one-way key before we use it for memory or past conversations; agent memory, only if the customer turns it on (what is saved is redacted first); and a voice sample, only if you record one for a custom voice. The customer's basis is the one that applies to you; ask the customer.

5. Who we share it with

• Our sub-processors: the companies that host, transcribe, speak, connect, email, bill or monitor for us. The full list, with what each handles and where, is the Sub-processor List on our Trust Center.
• Your workspace: other members see your name, email and role, and what you change.
• The customer, for the people it contacted.
• Authorities, when the law requires it, or to protect rights.
• A buyer, if Graine is sold or merged. We will tell you first, and the buyer must keep honouring this notice.

We do not sell or rent personal data.

6. Transfers outside India

Graine's servers for the call platform are in Mumbai, India. Some sub-processors process data elsewhere: for example, call recordings are stored in the United Kingdom and our API-key store is in the United States. Where we have not confirmed a vendor's location, the Sub-processor List says "On request" rather than guessing. Section 16 of the Act allows personal data to be transferred outside India except to countries the Government restricts (see also Rule 15); none is notified as of 3 Nov 2026. If you are in the European Union or the United Kingdom and need specific transfer terms, ask for our data processing agreement, which offers Standard Contractual Clauses.

7. How long we keep it

When you ask us to delete your data, we erase it, except what the law makes us keep, and we tell you what that is. The copy of a call kept in a separate working store is not erased by this today. India's Rules (Rules 6(1)(e) and 8(3)) require personal data, the traffic data connected with it and the logs of its processing to be kept for at least one year from the date of the processing, after which they are erased unless another law requires longer. This applies from 13 May 2027, to what we hold as the Data Fiduciary and, where we process for a customer, as the customer decides. When a customer leaves, we delete its workspace's data from live systems within 30 days of its written instruction; the copy of each call in that separate store is not deleted by this, and copies in backups age out on our providers' normal cycle.

8. How we protect it

Our safeguards include encryption in transit, encryption at rest by our hosting and database providers, roles and permissions checked on every request, a hash-chained audit trail, workspaces kept apart from each other, and masking on the device. The Trust Center lists each safeguard and says whether it is in place or being rolled out, and the Security Overview explains how they work. No system is completely secure, so we do not promise that. We do promise to protect your data with the safeguards we describe and, if a personal data breach affects you, to tell you and, where the law requires, the Data Protection Board of India without delay (Rule 7).

9. Cookies and similar technologies

We use what keeps you signed in without asking. Everything else loads only if you agree, one choice for each purpose, and you can change it at any time. Details are in our Cookie Policy.

10. Your rights, and how to use them

You have these rights over your personal data: access to a summary of what we process about you and who we have shared it with (section 11); correction, completion, updating and erasure (section 12), subject to part 7; grievance redressal (section 13); nomination of someone to use these rights for you if you die or cannot act (section 14; Rule 14(4)); and withdrawal of consent at any time (section 6(4)). If the GDPR applies to you, you also have the right to restrict or object to processing and to receive your data in a portable form.

How to ask (Rule 14(1)). Email founders@graine.ai with the subject "Data request", or use the request form on our website at www.graine.ai/privacy-policy, which gives you a reference number at once. To find your data we need an identifier: the email address of your Graine account, or the phone number a business called you on, or the name of the business. We may ask you to confirm who you are before we act. There is no charge for a reasonable request. If we cannot do what you ask, we tell you why. The full how-to is in our Data-subject rights document.

11. Withdrawing consent

You can withdraw a consent as easily as you gave it (Rule 3(c)). Cookie and analytics choices: the cookie settings link on our website. News and offers: the unsubscribe link in each email. Anything else: write to founders@graine.ai. Withdrawing does not affect what we did before, and it may mean we can no longer provide a service that needs the data.

12. Complaints

Write to the Grievance Officer, Rishabh Bhanot, at founders@graine.ai. Our Grievance Redressal Policy sets out the steps and the time limits. If our reply does not settle your grievance, you may complain to the Data Protection Board of India; the Act asks you to use our grievance process first (section 13). If you are in the European Union or the United Kingdom, you may also complain to your local data protection supervisory authority.

13. Children

Graine is a business service. It is not directed at children, and we do not knowingly collect a child's personal data for our own purposes. If a customer's agent contacts a child, the customer is responsible for the verifiable parental consent the Rules ask for (Rule 10). If you believe a child has given us personal data, write to us and we will delete it.

14. If the GDPR applies to you

For workspace users and visitors in the EU or UK, Graine is the controller (contact above). The legal bases are in brackets in part 4. We keep data as part 7 says. You have the rights in part 10 and may lodge a complaint with your supervisory authority. Transfers to India and to our sub-processors rest on the terms described in part 6. We do not carry out profiling or automated decisions with legal or similarly significant effects on workspace users or visitors. Where Graine acts as processor for a customer, the customer is the controller and answers these questions.

15. Language

This notice is in English. If you prefer any language listed in the Eighth Schedule to the Constitution of India, write to us and we will provide it within 30 days of your request.

16. Changes to this notice

When we change this notice we change the date at the top. For a change that matters we also email workspace Admins. Earlier versions are available on request.

Framework mapping

Revision history