Privacy Policy

1. Introduction and Scope

This Privacy Policy explains how Nelishka AI Solutions (“Nelishka”, “we”, “us”, or “our”) collects, uses, shares, and protects personal data when you use our products and services, including Swarnix. It applies to our websites and to all Nelishka products and services.

This Policy works alongside our Terms of Service at /terms-of-service. If you do not agree with this Policy, do not use the Services.

This Policy covers two groups of people:

• Account Holders — jewellery store owners and their personnel who register for an account and upload inventory data; and
• End Customers — people who chat with a Swarnix AI agent operated by an Account Holder, whether on WhatsApp, an Account Holder’s website chat widget, or an automated chatbot on Facebook Messenger or Instagram.

For data we handle on behalf of an Account Holder (such as End Customer chat data), the Account Holder decides how that data is used in its business. We process that data to operate the Services and as described in this Policy.

2. Who We Are

Nelishka AI Solutions is a company based in Mumbai, Maharashtra, India. For the purposes of the Digital Personal Data Protection Act, 2023 (the “DPDP Act”), Nelishka acts as a Data Fiduciary in respect of the personal data it determines the purpose and means of processing.

You can reach us using the contact details in the Grievance Officer and Contact section below.

3. Definitions

• “DPDP Act” means the Digital Personal Data Protection Act, 2023.
• “Personal Data” means any data about an individual who is identifiable by or in relation to that data.
• “Data Principal” means the individual to whom the Personal Data relates.
• “Data Fiduciary” means the person who, alone or with others, determines the purpose and means of processing Personal Data.
• “Processing” means any operation performed on Personal Data, such as collection, storage, use, sharing, or erasure.
• “Account Holder” means the business or individual that registers for an account, such as a jewellery store owner.
• “End Customer” means a person who interacts with a Swarnix chatbot, for example by messaging it on WhatsApp, through an Account Holder’s website chat widget, or through an automated chatbot on Facebook Messenger or Instagram.
• “Services” means the products and services provided by Nelishka, including Swarnix.

4. Information We Collect

We collect the following categories of data:

• Account and registration data — name, business name, email address, phone number, login credentials, and similar details provided by an Account Holder when registering or managing an account.
• Uploaded inventory data — jewellery product information uploaded by an Account Holder, including descriptions, pricing, images, and stock levels. This may, in some cases, contain personal data if the Account Holder chooses to include it.
• End Customer chat data — messages exchanged with a Swarnix AI agent across supported channels (WhatsApp, website chat, and automated Facebook Messenger or Instagram chat), contact identifiers such as a phone number, profile name, or social account handle, and conversation history.
• Payment-related data — billing details needed to process subscription payments. Card and bank details are handled by third-party payment processors; we do not store full card numbers ourselves.
• Technical, usage, and log data — IP address, device and browser information, access times, pages or features used, and similar diagnostic and analytics data collected automatically.

We do not intentionally collect special or sensitive categories of data beyond what is described above. Account Holders should not upload sensitive personal data into inventory or other fields unless necessary and lawful.

5. How We Collect It

We collect data in the following ways:

• Directly from you — when an Account Holder registers, configures an account, or contacts support.
• Through uploads — when an Account Holder uploads inventory data to the Services.
• Through chat message flows — when an End Customer messages a Swarnix agent on WhatsApp, an Account Holder’s website chat widget, or an automated Facebook Messenger or Instagram chatbot, the messages and related identifiers pass through the platform so the agent can respond.
• Automatically — through logging, cookies, and similar technologies when you use our websites or Services, as described in the Cookies and Tracking section.

6. How and Why We Use It (Purposes and Legal Basis)

We process Personal Data for these purposes:

• To provide and operate the Services, including running the Swarnix AI chatbot and displaying inventory;
• To respond to End Customer messages through the AI agent on behalf of the Account Holder;
• To create and manage accounts and authenticate Users;
• To provide customer support and respond to requests;
• To process payments and manage billing;
• To secure the Services, prevent fraud and abuse, and maintain availability;
• To maintain, analyse, and improve the Services;
• To comply with legal obligations and enforce our Terms of Service.

Legal basis under the DPDP Act. We process Personal Data on the basis of consent or for other lawful purposes permitted under the DPDP Act. Where consent is the basis, you may withdraw it at any time, as described in the Your Rights section; withdrawing consent does not affect processing carried out before withdrawal. For End Customer data processed through Swarnix, the Account Holder is responsible for having a lawful basis to message and engage with its End Customers.

7. AI Processing and Automated Outputs

The Services use artificial intelligence to generate chatbot responses and other outputs. To do this, the AI agent processes Account Holder inventory data and End Customer chat data to understand a message and produce a relevant response. Outputs may be inaccurate or incomplete, and are governed by the AI terms in our Terms of Service.

Use of data for model training. Data is not used for model training or fine-tuning.

We do not make decisions that produce legal or similarly significant effects about a Data Principal solely through automated processing without a lawful basis.

8. Sharing and Third-Party Sub-Processors

We do not sell Personal Data. We share data only as needed to operate the Services or as required by law, with the following categories of recipients:

• Messaging and chat platforms — WhatsApp, Facebook Messenger, and Instagram (each operated by Meta), and website chat widget providers, to send and receive messages through the Swarnix agent. - Meta Platforms, Inc.
• Hosting and infrastructure providers — to host and run the Services. - Hostinger
• Payment processors — to handle subscription payments. - Razorpay Payment Solutions Pvt. Ltd.
• Analytics and diagnostics providers — to understand usage and improve the Services. - Google Analytics
• Professional advisers and authorities — where required by law, regulation, legal process, or to protect our rights, users, or the public.

These recipients are permitted to process Personal Data only for the purposes we specify and are required to protect it appropriately. Your use of WhatsApp, Facebook Messenger, Instagram, or a website chat widget is also subject to that platform's own privacy terms, which we do not control.

9. Cross-Border Transfers

We operate from India and serve customers worldwide. Personal Data may be processed or stored in India or in other countries where we or our sub-processors operate. Where we transfer Personal Data outside India, we do so in line with the DPDP Act and applicable law, and we take reasonable steps so that the data continues to be protected. By using the Services, you understand that your data may be processed in locations outside your home country.

10. Data Retention and Deletion

We keep Personal Data only for as long as needed for the purposes described in this Policy, to provide the Services, to comply with legal obligations, to resolve disputes, and to enforce our agreements. Retention periods depend on the type of data and the purpose. As a general rule, information is retained for 3 months only.

When data is no longer needed, we delete or anonymise it. We may retain limited data where required by law or kept in routine backups for a limited period before those backups are overwritten. Account Holders can request deletion of data as described in the Your Rights section; where we process End Customer data on behalf of an Account Holder, deletion requests may be directed to or coordinated with that Account Holder.

11. Your Rights as a Data Principal

Subject to the DPDP Act and applicable law, you have the following rights:

• Right to access — to obtain a summary of the Personal Data we process about you and the processing activities.
• Right to correction and completion — to have inaccurate or misleading data corrected, and incomplete data completed.
• Right to updating — to have your data kept up to date.
• Right to erasure — to request deletion of your Personal Data where it is no longer needed and retention is not required by law.
• Right to grievance redressal — to raise a complaint with our Grievance Officer, as described below.
• Right to nominate — to nominate another individual to exercise your rights in the event of your death or incapacity.

To exercise any of these rights, contact our Grievance Officer using the details in the Grievance Officer and Contact section. We may need to verify your identity before acting on a request. If you are an End Customer, some requests may be handled by the Account Holder whose chatbot you interacted with, and we will assist as appropriate.

International users. If you are in a jurisdiction with laws such as the EU/UK GDPR or the California Consumer Privacy Act, you may have additional rights, such as the right to object to or restrict certain processing, data portability, or to opt out of certain sharing. We will honour applicable rights to the extent those laws apply to our processing of your data. This Policy does not claim full compliance with every such law; where a specific law applies, the rights it grants will apply.

12. Cookies and Tracking

Our websites and Services may use cookies and similar technologies to keep you signed in, remember preferences, maintain security, and understand usage. You can control cookies through your browser settings; disabling some cookies may affect how the Services work. Where required by law, we will request your consent before placing non-essential cookies.

13. Data Security

We maintain reasonable technical and organisational measures designed to protect Personal Data against unauthorised access, loss, misuse, or alteration, in line with the DPDP Act and the Information Technology Act, 2000. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Breach notification. If a personal data breach occurs, we will take steps to address it and will notify affected Data Principals and the relevant authority, including the Data Protection Board of India where required, in the manner and within the timelines required by applicable law.

14. Children’s Data

The Services are a business tool intended for use by businesses and adults. They are not directed at children and are not intended for use by individuals below the age required to consent under applicable law. We do not knowingly collect Personal Data of children. If we learn that we have collected such data without the consent required by law, we will take steps to delete it.

15. Changes to This Policy

We may update this Policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, provide notice through the Services or by other reasonable means. Your continued use of the Services after the changes take effect means you accept the updated Policy.

16. Grievance Officer and Contact

In accordance with the DPDP Act and the Information Technology Act, 2000, you may contact our Grievance Officer with any question, request, or complaint about your Personal Data or this Policy.

• Grievance Officer: Vibha Modi
• Email: modivibha99@gmail.com
• Data protection contact: Vibha Modi
• Address: 1503/04, Rejoice, Citi of Joy, J.S.D. Road, Mulund West, Mumbai, Maharashtra, India 400080
• Response timeline: We will acknowledge your request within 24 - 48 hours and aim to respond within 7-10 working days, or within the period required by applicable law.

If you are not satisfied with our response, you may escalate your complaint to the Data Protection Board of India as provided under the DPDP Act.

For general queries, contact us at support@nelishkaai.in.

Company details: Nelishka AI Solutions, 1503/04, Rejoice, Citi of Joy, J.S.D. Road, Mulund West, Mumbai, Maharashtra, India 400080. [GST/CIN NUMBER]

17. Governing Law and Jurisdiction

This Policy is governed by the laws of India. Subject to applicable law, the courts at Mumbai, Maharashtra, India shall have exclusive jurisdiction over any dispute arising out of or relating to this Policy.