How we collect, use, and protect your personal information
Last updated: October 23, 2025
1. INTRODUCTION
ScaleWaveAI Private Limited ("ScaleWaveAI", "Company", "we", "us", or "our") is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our artificial intelligence services, website, and APIs (collectively, the "Services").
By using our Services, you consent to the data practices described in this Privacy Policy. This Privacy Policy should be read in conjunction with our Terms of Service.
1.1 Legal Basis for Data Processing
We process your personal data based on the following legal grounds:
Contractual Necessity: To provide the Services you've requested (account creation, API access, payment processing)
Consent: For optional data processing like analytics cookies and marketing communications
Legitimate Interests: For fraud prevention, security, service improvement, and business operations
Legal Obligations: To comply with Indian laws, tax regulations, and legal processes
2. COMPANY INFORMATION
Data Controller
ScaleWaveAI Private Limited G2, C556-A, 4C Scheme, Naveen Vihar Colony, New Loha Mandi Road, Jaipur, Rajasthan, India CIN: U85490RJ2025PTC105152
Data Protection Officer/Grievance Officer
Name: Yuvraj Garg Designation: Director Email: yuvraj@scalewaveai.com
3. INFORMATION WE COLLECT
3.1 Personal Information
When you register and use our Services, we collect:
Account Information:
Email address (required)
Organization name (required)
Website URL (optional)
Password (encrypted and hashed)
Profile information from Google OAuth (if used)
3.2 Technical Information
Usage Data: API request logs, service usage patterns, feature utilization statistics
Device Information: IP address, browser type, device type, operating system
Performance Data: Response times, service performance metrics, error logs
3.3 Content Data
Important: Data Deletion Policy
We delete all user content data immediately after processing. We do not retain, store, or use your content data for any purpose other than providing the requested service.
Images uploaded for processing (current)
Future data types: text, audio, video, 3D models
Metadata associated with uploaded content
4. HOW WE USE YOUR INFORMATION
4.1 Service Provision
Account Management: Creating and maintaining user accounts
AI Processing: Providing AI model inference and analysis
Payment Processing: Handling credit purchases and usage billing
Customer Support: Responding to inquiries and providing assistance
4.2 Service Improvement
Performance Optimization: Improving response times and reliability
Model Enhancement: Developing better AI models (using aggregated, non-personal data only)
Quality Assurance: Monitoring service quality and addressing issues
5. DATA SHARING AND DISCLOSURE
5.1 Third-Party Service Providers
We share limited data with trusted service providers who assist in delivering our Services:
Cloud Infrastructure
Amazon Web Services (AWS): Data processing and storage in Oregon, USA
Purpose: Secure data processing and temporary storage Data types: All user data during processing (deleted immediately after)
Payment Processing
Razorpay: Payment gateway services
Purpose: Processing credit and debit card transactions and managing payments Data types: Payment information, billing details, transaction history
Analytics and Monitoring
Google Analytics: Website usage analytics
Purpose: Understanding website traffic and user behavior Data types: Anonymized usage data, device information
Authentication Services
Google OAuth: Third-party authentication (optional)
Purpose: Enabling sign-in with Google account Data types: Email address, profile information (name, profile picture)
Scheduling Services
Calendly: Meeting scheduling widget (optional, only loaded with consent)
Purpose: Scheduling customer consultations and support calls Data types: Name, email, meeting preferences
5.2 Data We Do NOT Share
We never sell personal information to third parties
We do not share user content data with anyone
We do not use personal data for advertising purposes
We do not provide user lists to marketing companies
6. COOKIES AND TRACKING TECHNOLOGIES
Types of Cookies We Use
Essential Cookies:
Session management and authentication
Service functionality and security
Analytics Cookies:
Google Analytics: Website traffic and usage patterns
User journey and feature utilization
Performance metrics and error tracking
Third-Party Service Cookies:
Calendly: Meeting scheduling and calendar integration (Optional)
Razorpay: Payment processing and transaction security (Essential)
These services may set their own cookies as per their privacy policies
6.1 Cookie Consent Management
We have implemented a comprehensive cookie consent system that allows you to control your privacy preferences:
Consent Banner: When you first visit our website, you'll see a cookie consent banner explaining our cookie usage
Granular Control: You can accept all cookies, reject optional cookies, or customize your preferences by category
Essential vs Optional: Essential cookies (authentication, payments, security) cannot be disabled as they're required for core functionality
Settings Page: Visit our Cookie Settings page to update your preferences at any time
Automatic Enforcement: Your choices are immediately applied - optional services like analytics and scheduling widgets are loaded only with your consent
6.2 Managing Cookies
You can control cookies through your browser settings:
Accept All: Allow all cookies for full functionality
Block All: Disable all non-essential cookies (may affect functionality)
Customize: Choose specific cookie categories to allow
Browser Settings: Configure cookies directly in your browser
7. DATA SECURITY
Security Measures
Technical Safeguards:
End-to-end encryption for data transmission
Strong encryption for data at rest
Secure API authentication and authorization
Administrative Safeguards:
Limited access to personal data on a need-to-know basis
Employee training on data protection
Background checks for personnel with data access
Incident response procedures and breach protocols
7.1 Security Certifications
We are actively pursuing industry-standard security certifications:
SOC 2 Type II: In progress
ISO 27001: Planned for 2025
AWS Security Standards: Compliant with AWS security frameworks
7.2 AUTOMATED DECISION-MAKING AND PROFILING
We want to be transparent about any automated processing of your data:
Current Status
No Automated Decision-Making: We do not use automated decision-making systems that significantly affect your rights (e.g., automatic account approvals, credit decisions)
Fraud Detection: We use automated systems to detect suspicious activity and potential fraud, but final decisions involve human review
No Profiling: We do not create detailed user profiles for marketing or other purposes
Service Analytics: We use aggregated, anonymized data to improve Services, but this does not involve individual profiling
If we introduce automated decision-making in the future, we will update this policy and provide appropriate safeguards including the right to human review.
8. DATA RETENTION
Content Data - Immediate Deletion Policy
User Content: Deleted immediately after processing
API Responses: Not retained beyond service delivery
Processing Logs: Temporary logs deleted within 24 hours
8.1 Account Data
Active Accounts: Retained as long as account remains active
Inactive Accounts: Deleted after 3 years of inactivity
Deleted Accounts: All data removed within 30 days of deletion request
9. YOUR RIGHTS AND CHOICES
Your Data Rights
Access and Portability
Right to Access: Request copies of your personal data
Data Portability: Receive your data in a machine-readable format
Account Dashboard: View and manage your personal information online
Correction and Updates
Right to Rectification: Correct inaccurate or incomplete personal data
Profile Updates: Update account information through your dashboard
Deletion and Erasure
Right to Deletion: Request deletion of your personal data
Account Closure: Delete your entire account and associated data
Object and Restrict Processing
Right to Object: Object to processing of your data for direct marketing, legitimate interests, or research purposes
Right to Restrict: Request restriction of processing in certain circumstances (e.g., while disputing accuracy or during investigation)
Withdraw Consent: Withdraw previously given consent for optional data processing (affects future processing only)
Supervisory Authority
Right to Complain: Lodge a complaint with the appropriate data protection authority if you believe we've violated your privacy rights
Indian Users: Ministry of Electronics and Information Technology (MeitY) or designated Data Protection Authority
EU Users: Your local Data Protection Authority (DPA) or supervisory authority
9.1 Exercising Your Rights
To exercise any of these rights:
Email us at support@scalewaveai.com
Include your account details and specific request
We will respond within 30 days (or as required by law)
Identity verification may be required for security
10. INTERNATIONAL DATA TRANSFERS
Data Processing Locations
Primary Processing: AWS Oregon, USA
User Access: Services available globally
Legal Jurisdiction: Governed by Indian law
10.1 GDPR Compliance (EU/EEA/UK Users)
For European Union, European Economic Area, and United Kingdom users:
Data Transfer Mechanisms: We rely on Standard Contractual Clauses (SCCs) approved by the European Commission for data transfers from the EU/EEA/UK to the United States
Adequacy Decisions: We monitor and comply with adequacy decisions and frameworks
GDPR Rights: You have all rights under GDPR including access, rectification, erasure, restriction, portability, objection, and automated decision-making
UK GDPR: We comply with UK GDPR for users in the United Kingdom
Data Protection Impact: We conduct assessments for high-risk processing activities
10.2 CCPA Compliance (California Users)
California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA)
If you are a California resident, you have additional rights under the CCPA/CPRA:
Your California Rights:
Right to Know: Request details about the personal information we collect, use, disclose, and sell (we do not sell personal information)
Right to Delete: Request deletion of your personal information (subject to exceptions)
Right to Opt-Out: We do not sell personal information, so no opt-out is necessary
Right to Non-Discrimination: You will not receive discriminatory treatment for exercising your CCPA rights
Right to Correct: Request correction of inaccurate personal information
Right to Limit: Limit use and disclosure of sensitive personal information (we only use such data for providing Services)
California-Specific Disclosures:
Personal Information Collected: Identifiers (email, name), account information, payment data, usage data, device information
Sources: Directly from you, automatically from your device, from third parties (OAuth providers, payment processors)
Third Parties: Service providers (AWS, Razorpay, Google Analytics) - we do not sell or share for cross-context behavioral advertising
Retention: Account data while active + 3 years; content data immediately deleted; logs within 24 hours
Designated Methods for Requests: Email support@scalewaveai.com with "CCPA Request" in the subject line. We will verify your identity and respond within 45 days (may extend by 45 days with notice if needed).
Authorized Agent: You may designate an authorized agent to submit requests on your behalf. We require written authorization and will verify both your and the agent's identity.
11. CHILDREN'S PRIVACY
Age Restrictions
Our Services are not intended for individuals under 18 years of age
We do not knowingly collect personal information from children under 18
Parental consent is required for users under 18 in jurisdictions where permitted
If you believe we have collected information from a child under 18, contact us immediately at support@scalewaveai.com. We will investigate and delete the information promptly.
12. UPDATES TO THIS PRIVACY POLICY
We may update this Privacy Policy periodically to reflect changes in our practices or applicable laws.
12.1 Notification Methods
Email notifications to registered users for material changes
Last updated date displayed at the top of this page
Prominent notice on website or dashboard
30-day notice period for material changes (where practical)
Your continued use of the Services after changes take effect constitutes acceptance of the updated Privacy Policy. If you do not agree with changes, you may close your account before the changes take effect.
13. MARKETING COMMUNICATIONS AND OPT-OUT
Email Communications
We may send you the following types of emails:
Transactional Emails (Cannot Opt-Out):
Account creation and verification
Password resets and security alerts
Payment confirmations and invoices
Service notifications and important updates
Legal notices and policy changes
Marketing Emails (Can Opt-Out):
Product announcements and new features
Educational content and best practices
Special offers and promotions
Surveys and feedback requests
How to Opt-Out:
Unsubscribe Link: Click the unsubscribe link at the bottom of any marketing email
Email Us: Contact support@scalewaveai.com with "Unsubscribe" in the subject line
Note: Opting out of marketing emails does not affect transactional emails necessary for account management and service delivery.
14. DO NOT TRACK AND GLOBAL PRIVACY CONTROL
Some browsers and devices offer "Do Not Track" (DNT) or "Global Privacy Control" (GPC) signals to indicate user privacy preferences.
Our Response to Privacy Signals
Cookie Consent System: We have implemented a comprehensive cookie consent management system that allows you to control optional cookies
Essential Services: Essential cookies for authentication, security, and core functionality cannot be disabled as they're necessary for the Services to work
Optional Cookies: Analytics and third-party service cookies are only loaded with your explicit consent via our cookie banner
Browser Settings: You can control cookies through your browser settings in addition to our consent system
Future GPC Support: We are monitoring GPC adoption and plan to implement automatic recognition of GPC signals for California residents
Recommended: Use our Cookie Settings page at /settings/cookie-preferences for granular control over your privacy preferences.
15. COMPLIANCE WITH INDIAN LAWS
15.1 Information Technology Act, 2000
We comply with applicable provisions of the IT Act including:
Reasonable security practices for sensitive personal data
Data protection requirements under IT Rules 2011
Grievance officer appointment and complaint handling
15.2 Digital Personal Data Protection Act, 2023 (DPDP Act)
We comply with the Digital Personal Data Protection Act, 2023:
Lawful Processing: We process personal data only for lawful purposes with valid legal basis
Data Principal Rights: We provide mechanisms for users to exercise their rights (access, correction, erasure, portability)
Data Fiduciary Obligations: We maintain transparency, security, and accountability in data processing
Consent Management: We obtain and manage user consent for applicable data processing activities
Grievance Redressal: We have appointed a Data Protection Officer/Grievance Officer as required
Cross-Border Transfers: We ensure appropriate safeguards for international data transfers
Data Breach Notification: We notify the Data Protection Board and affected users in case of breaches
15.3 Consumer Protection (E-Commerce) Rules, 2020
As an e-commerce platform providing AI services:
We display complete company information and contact details
We provide clear terms and conditions before transactions
We issue GST-compliant invoices for all purchases
We have established grievance redressal mechanisms
15.4 Financial Data Retention (GST and Tax Compliance)
Legal Retention Requirements
While we delete user content data immediately after processing, we are legally required to retain certain financial and business records for compliance purposes:
GST Records: Retained for 6 years from the end of the financial year as per GST law
Income Tax Records: Retained for 7 years as per Income Tax Act requirements
Payment Records: Transaction history, invoices, receipts, and payment gateway data
Audit Trail: Financial transactions and accounting records for statutory audits
Companies Act Compliance: Books of accounts retained as required under Companies Act, 2013
Important: This retention applies only to billing, payment, tax, and compliance records. Your uploaded content data (images, files, etc.) is still deleted immediately after processing.
15.5 RBI Guidelines for Payment Data
We comply with Reserve Bank of India (RBI) guidelines regarding payment data:
Data Storage: We do not store complete card details. Payment information is handled by Razorpay, our PCI-DSS compliant payment gateway partner
Tokenization: Card data tokenization is managed by Razorpay in compliance with RBI directives
Transaction Records: We retain transaction IDs, amounts, and payment status for reconciliation and dispute resolution
Payment Gateway Compliance: Razorpay maintains compliance with all RBI guidelines for payment aggregators and gateways
16. DATA BREACH NOTIFICATION AND INCIDENT RESPONSE
16.1 Our Commitment
Despite our robust security measures, no system is completely immune to breaches. We take data security incidents extremely seriously and have established comprehensive incident response procedures.
16.2 Notification Timeline
Breach Notification Process
Internal Detection: Immediate investigation upon discovering a potential breach
Regulatory Notification: We will notify the Data Protection Board of India within 72 hours of becoming aware of a breach, as required by DPDP Act 2023
User Notification: Affected users will be notified within 72 hours via email to registered email addresses
GDPR Compliance: For EU/EEA users, notification to supervisory authorities within 72 hours and to affected individuals "without undue delay"
Public Disclosure: If the breach affects a large number of users or poses significant risk, we will post a public notice on our website
16.3 Information Provided in Breach Notification
If a breach occurs, we will provide you with:
Nature of Breach: Description of what happened and what data was affected
Types of Data: Categories of personal data involved in the breach
Potential Consequences: Likely consequences and potential risks
Remedial Actions: Measures we have taken or will take to address the breach
Recommended Actions: Steps you should take to protect yourself (e.g., password changes, monitoring accounts)
Contact Information: How to reach us for questions or concerns
16.4 Exception: Low-Risk Breaches
Individual notification may not be required if:
The breach data was encrypted and encryption keys were not compromised
Appropriate technical measures make the data unintelligible to unauthorized persons
The breach poses no risk to users' rights and freedoms
However, we will still report such breaches to regulatory authorities as required by law.
16.5 Your Rights After a Breach
If your personal data is involved in a breach, you have the right to:
Receive timely and comprehensive information about the breach
Request deletion of your compromised data (subject to legal retention requirements)
File a complaint with the Data Protection Board or relevant supervisory authority
Seek compensation for damages if the breach resulted from our negligence or non-compliance
Terminate your account without penalty
Note: No refunds will be provided for unused credits even in the event of a breach, as per our no-refund policy. However, we may offer service credits or extended access at our discretion in exceptional circumstances.
17. TECHNICAL DATA DELETION SPECIFICATIONS
When we say "immediate deletion," here's what it technically means:
17.1 Content Data Deletion Timeline
Primary Processing: Deleted from primary processing servers within 60 seconds of API response delivery
Temporary Storage: Deleted from any temporary storage or cache within 5 minutes
Processing Logs: Metadata logs (without actual content) retained for 24 hours for debugging, then permanently deleted
CDN Caches: If applicable for outputs, purged within 15 minutes
Backup Systems: Content data is NOT included in our backup systems
17.2 Account Data Deletion Timeline
User-Initiated Deletion: Within 30 days of deletion request
Backups: Data removed from backups within next backup cycle (maximum 90 days)
Financial Records Exception: Billing and tax records retained for 6-7 years as legally required
Anonymized Analytics: Aggregated, anonymized usage statistics are permanently retained but cannot be linked back to you
17.3 What We Cannot Delete
We cannot delete data that we are legally required to retain:
Financial records for tax compliance (GST, Income Tax): 6-7 years
Data subject to legal hold, court orders, or ongoing investigations
Data necessary to establish, exercise, or defend legal claims
Anonymized or aggregated data that cannot identify you
18. CONTACT INFORMATION
General Privacy Inquiries
Email: support@scalewaveai.com
Data Protection Officer / Grievance Officer
Name: Yuvraj Garg Designation: Director Email: yuvraj@scalewaveai.com Address: G2, C556-A, 4C Scheme, Naveen Vihar Colony, New Loha Mandi Road, Jaipur, Rajasthan, India - 302015
Response Timeframes:
Acknowledgment: Within 48 hours of receiving your inquiry
Resolution: Within 15 business days for grievances
Data Subject Requests: Within 30 days for GDPR/CCPA/DPDP requests (may extend by 30-45 days with notice if complex)
18.1 Data Protection Inquiries
For specific data protection requests (access, deletion, correction, portability):
Email: support@scalewaveai.com
Subject Line: "Privacy Request - [Type of Request]" (e.g., "Privacy Request - Data Deletion")
Include: Your full name, registered email address, account details, specific request, and any verification information requested
Verification: We may request additional information to verify your identity before processing requests
Response Time: Within 30 days (or as required by applicable law)
18.2 Security Concerns
If you discover a security vulnerability or have concerns about data security:
Email: support@scalewaveai.com with "Security" in the subject line
Response: We take security reports seriously and will respond promptly
Responsible Disclosure: Please allow us reasonable time to address issues before public disclosure
By using our Services, you acknowledge that you have read, understood, and consent to the practices described in this Privacy Policy.