1. Who We Are
PravRaha is a private company incorporated in India. Our registered office is at Ranchi, Jharkhand, India 834004. For any privacy-related question, complaint, or rights request, contact our Grievance Officer at [email protected] with the subject line "Grievance Officer."
PravRaha's authorised representative for European Union matters and any UK-specific contact details, where applicable, can be found by reaching at [email protected].
2. The Two-Track Data Architecture You Should Know About
PravRaha is unusual among privacy notices in being explicit about this: we process two materially different categories of personal data, and they carry different rights and obligations.
The rights you have, and the obligations we carry, depend on which track applies. Section 10 sets this out by individual.
3. Personal Data We Collect
3.1 Customer and Authorised User Data
- Identity and contact: name, business email, business phone, job title, employer.
- Authentication: hashed passwords, SSO identifiers, MFA factors.
- Billing: company name, billing contact, GSTIN and other tax identifiers, billing address. We do not store full payment card numbers; payment processors handle that.
- Usage telemetry: features used, queries run, exports, login timestamps, IP addresses, device and browser metadata.
- Support and communications: tickets, emails, recordings of voluntarily joined demo or training calls, chat transcripts.
3.2 Customer-Uploaded Data
Any data the customer chooses to upload, integrate, or generate through the Platform - including CRM records, target account lists, sequence content, and outreach activity logs. PravRaha processes this as a processor under the customer's written agreement and our Data Processing Agreement ("DPA").
3.3 Prospect Data
- Identity and professional: name, business email, business phone, current and prior job titles, employer, location at country, region, and city level, professional profile URLs.
- Business signals: company size, funding events, technology stack, hiring activity, publicly observable role changes, buying-intent signals derived from third-party data partners.
- Derived and inferred: scoring, fit indicators, recommended sequencing.
We do not knowingly collect, infer, or maintain special categories of personal data (including data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health data, or data concerning sexual orientation) about prospects. Customers shall not upload such data to the Platform.
3.4 Technical Data
IP address, browser type, device identifiers, referring URL, pages viewed, time on page, cookie identifiers, and similar telemetry from visitors to our Site and users of the Platform.
4. Sources of Personal Data
We collect personal data from four sources:
- Directly from you, when you sign up, communicate with us, or use the Platform.
- From our customers, when they upload, integrate, or otherwise transmit data to the Platform.
- From licensed third-party data providers under written contracts that include representations as to lawful sourcing. Our current data-provider categories are summarised in our Sub-processor List (Section 7); specific provider identities are made available to enterprise customers under non-disclosure agreement.
- From publicly available sources, including corporate websites, regulatory filings, public business directories, and professional networking platforms (only to the extent the relevant platform's terms permit, and only for business contact information used in a B2B sales context).
We do not purchase consumer data, scrape platforms in violation of their terms of service, or accept data of unverifiable origin.
5. How and Why We Use Personal Data
The following table sets out our processing purposes, the track they relate to, and the lawful basis (under the EU General Data Protection Regulation) or the ground of processing (under India's Digital Personal Data Protection Act, 2023) on which we rely.
| Purpose | Track | Lawful Basis / Ground |
|---|---|---|
| Provide the Services to you or your employer | A | Contract performance |
| Authenticate users, prevent fraud, secure the Platform | A | Legitimate interests; legal obligation |
| Bill customers and collect payment | A | Contract; legal obligation |
| Provide product support and respond to inquiries | A | Contract; legitimate interests |
| Improve the Platform (aggregate analytics, debugging) | A, B | Legitimate interests |
| Compile and maintain the Prospect Database for B2B sales intelligence | B | Legitimate interests (B2B sales context) / certain legitimate uses under the DPDP Act |
| Communicate marketing about PravRaha (existing customers or with separate consent) | A | Consent; legitimate interests |
| Comply with law and lawful requests | A, B | Legal obligation |
6. AI and Automated Processing
The Platform uses machine learning and large language models - both PravRaha-developed and third-party (which currently include Anthropic) - to generate recommendations, scoring, draft outreach content, and other outputs. You should understand:
- AI outputs are probabilistic. They can be wrong, out of date, biased, or unsuitable for a given purpose. Human review by a competent operator is required before any AI-generated content is sent, published, or relied upon.
- We do not make solely automated decisions that produce legal or similarly significant effects on individuals, within the meaning of Article 22 of the GDPR or comparable provisions.
- We log AI inputs and outputs for security, abuse detection, and model improvement, subject to the retention periods in Section 9 and the customer opt-out described in Section 5.
- Where the EU AI Act or comparable regulations require disclosure that content has been generated or materially modified by AI, customers are responsible for making that disclosure in their own outreach.
8. International Data Transfers
We are headquartered in India and our primary data hosting is in AWS Asia Pacific (Mumbai). Sub-processors operate from multiple jurisdictions including the United States and the European Economic Area.
Where personal data of EU, EEA, or UK data subjects is transferred outside those regions, we rely on the Standard Contractual Clauses adopted by the European Commission, the UK International Data Transfer Agreement or Addendum, and supplementary technical and organisational measures as appropriate. Where personal data of Indian data subjects is transferred outside India, we comply with the cross-border transfer requirements of the DPDP Act, 2023 and the rules issued thereunder.
A copy of our standard transfer instruments is available to enterprise customers on written request.
9. Data Retention
We retain personal data only as long as needed for the purposes described in this Policy, or as required by law. Indicative retention periods are set out below; specific contracts may vary these for enterprise customers.
| Data Category | Retention Period |
|---|---|
| Active customer account data | Duration of the customer agreement plus 12 months |
| Billing and financial records | 8 years (Indian Companies Act and GST requirements) |
| Customer-uploaded data after termination | Returned or deleted within 30 days of written request, then purged from backups within 90 days |
| Prospect Database records | Refreshed continuously; opt-out requests result in suppression within 30 days, and durable suppression-list retention thereafter |
| Support communications | 3 years |
| Site and product analytics | 26 months |
| Security logs | 12 months |
10. Your Rights
Subject to applicable law, you have rights including: access, rectification, erasure, restriction of processing, objection to processing, portability, withdrawal of consent, and the right to lodge a complaint with a supervisory authority.
10.1 If You Are a Customer or Authorised User
Most of your rights are exercised through your account settings or by contacting your account administrator. For requests we must action directly, write to [email protected]. We will respond to verifiable requests within 30 days, extendable to 60 days for complex requests, and we will not charge you for reasonable requests.
10.2 If You Are a Prospect
If your information appears in the PravRaha Prospect Database without you being our customer, the following apply:
- You may opt out of being included in the Database and request suppression by emailing [email protected].
- You may request a copy of the personal data we hold about you, including its source category.
- We will action verifiable requests within 30 days (extendable to 60 days where complex), and we will not charge you for reasonable requests.
Where we have not collected your data directly from you, we rely on the disproportionate-effort exception in Article 14(5)(b) of the GDPR (and comparable provisions in other regimes) for individual notice. We discharge the residual obligation through public availability of this Policy and the opt-out and access mechanisms above.
10.3 Jurisdictional Add-ons
- India (DPDP Act, 2023): You may exercise the rights of a Data Principal, including correction, erasure, nomination, and grievance redressal. Our Grievance Officer is reachable at [email protected] (subject: Grievance Officer). Unresolved grievances may be referred to the Data Protection Board of India.
- EU, EEA, and UK (GDPR and UK GDPR): All rights under Articles 15 to 22 apply where we are the controller. You may complain to your local supervisory authority.
- California (CCPA and CPRA): Right to know, delete, correct, opt out of sale or sharing, and non-discrimination. We do not sell personal information.
- Brazil (LGPD), Canada (PIPEDA), Australia (Privacy Act): Equivalent rights apply where the underlying law applies to processing.
11. Security
We maintain administrative, technical, and physical safeguards designed to protect personal data, including: encryption in transit (TLS 1.2 or higher) and at rest (AES-256), role-based access control, multi-factor authentication enforced on production systems, principle-of-least-privilege access, vulnerability management, logging and monitoring, an incident-response procedure, and vendor security reviews.
No system is perfectly secure. If you believe your account has been compromised, contact us immediately at [email protected].
13. Children
The Services are intended for business users 18 years of age or older. We do not knowingly collect personal data from anyone known or reasonably believed to be under 18, and our customers undertake not to upload such data to the Platform. If you believe we have collected such data, contact us and we will delete it. Where India's DPDP Act or other applicable laws impose stricter rules for children's data, those apply.
14. Grievance Officer and Regulatory Contacts
India (DPDP Act, 2023) Grievance Officer. A designated officer is responsible for redressal of grievances raised by Data Principals. Contact: [email protected], subject line "Grievance Officer." Acknowledgement within 7 business days; resolution within 30 days of acknowledgement, save for matters requiring extended review.
EU and UK queries. [email protected], subject line "EU Data Protection."
All other jurisdictions. [email protected].
15. Changes to this Policy
We may update this Policy. Material changes will be notified to active customers by email at least 14 days before they take effect, and posted on the Site with a revised Effective Date. Continued use of the Services after the Effective Date constitutes acceptance. Where required by law, we will obtain consent before applying material changes.