Effective Date: 01/09/2026
Audecy AI Technologies Private Limited
CIN: U62099KA2026PTC221151
Registered office: NITK Science & Technology Entrepreneurs' Park (NITK), Srinivasnagar, Surathkal, Mangalore, Dakshina Kannada 575025, Karnataka, India
Version 1.0
Effective from 01/09/2026
Last updated 01/09/2026
Next review: 01/01/2027
Audecy AI Technologies Private Limited ("Audecy", "we", "us", "our") builds and delivers applied AI, IoT and software products for enterprise and public sector clients. In the course of running our business we handle personal data belonging to our clients' staff, our suppliers and partners, people who visit our website or contact us, people who apply to work with us, and our own employees.
This policy explains what personal data we collect, why we collect it, what we do with it, who we share it with, how long we keep it and what rights you have. It applies to all of Audecy's operations, including in India, Singapore, the United Kingdom and the countries of the Gulf Cooperation Council.
This policy sits alongside our Anti Bribery, Anti Corruption and Sanctions Policy. Section 7 below explains the personal data we process specifically to meet the obligations in that policy.
For most of the processing described here, Audecy is the data controller, meaning we decide why and how your personal data is used.
Where we build, host or operate a system for a client and process personal data on that client's instructions, Audecy acts as a data processor and the client is the controller. In that situation the client's own privacy notice governs, and our obligations are set out in the data processing agreement we sign with them. Section 8 covers this in more detail.
Grievance Officer and privacy contact
Sudeep Vuppalapati, Founder and Chief Executive Officer
Audecy AI Technologies Private Limited
NITK Science & Technology Entrepreneurs' Park (NITK), Srinivasnagar, Surathkal, Mangalore, Dakshina Kannada 575025, Karnataka, India
privacy@audecyai.com
Depending on where you are and how we deal with you, one or more of the following will apply:
Where two applicable laws differ, we apply the standard that gives you the stronger protection.
This policy covers personal data relating to:
We collect only what we need for the purpose in question. Depending on your relationship with us, this may include:
We do not seek to collect sensitive or special category personal data such as health information, religious or political beliefs, biometric data or caste, except where the law positively requires it of us as an employer in India, or where you volunteer it in an accessibility or accommodation request. Please do not send us sensitive personal data that we have not asked for.
| What we do | Personal data used | Why we do it |
|---|---|---|
| Respond to an enquiry or a contact form | Identity, contact, relationship | To answer you and, if it goes further, to take steps towards a contract |
| Deliver a project or a support engagement | Identity, contact, relationship, transaction | To perform our contract with your organisation |
| Business development and marketing to business contacts | Identity, contact, relationship | Our legitimate interest in growing the business, subject to your right to opt out at any time |
| Screen a counterparty before onboarding | Identity, compliance and integrity | Legal obligation under anti bribery and sanctions law, and our legitimate interest in not doing business with high risk parties |
| Run a recruitment process | Recruitment, identity, contact | To take steps at your request before entering a contract, and our legitimate interest in assessing suitability |
| Maintain books, records and tax filings | Identity, transaction | Legal obligation under company, tax and GST law |
| Operate, secure and improve our website | Technical | Our legitimate interest in a secure and functioning site, with consent where the law requires it for non essential cookies |
| Defend or bring a legal claim | Whatever is relevant | Our legitimate interest in establishing or defending legal rights |
Under Indian law we rely on your consent, or on a legitimate use recognised by the Digital Personal Data Protection Act, whichever applies to the processing in question. Where we rely on consent, you may withdraw it at any time and we will stop that processing, though this does not affect anything done before you withdrew.
Where we rely on legitimate interests, we have considered whether our interest is overridden by your rights, and you can ask us for a summary of that assessment.
Our Anti Bribery, Anti Corruption and Sanctions Policy commits us to screening the parties we do business with. Doing that necessarily involves processing personal data, so we set out here what it means in practice.
Who we screen. Prospective and existing clients, suppliers, subcontractors, agents, resellers, introducers and other business partners, together with the directors, officers and beneficial owners of those organisations where identifying them is necessary.
What we look at. Sanctions and denied party lists maintained by the United Nations, the Government of India, the United States Office of Foreign Assets Control, the United Kingdom Office of Financial Sanctions Implementation and the European Union; politically exposed person status; public corporate registries; adverse media reporting; and information the counterparty gives us in a due diligence questionnaire.
Where the data comes from. From you or your organisation directly, from public registries and the open internet, and from commercial screening and due diligence databases.
Why we may process criminal offence data. Screening can surface allegations, investigations, charges or convictions relating to bribery, corruption, fraud, money laundering or sanctions. We process this only where necessary to meet an obligation under anti bribery and sanctions law or to protect Audecy against a serious risk, we keep it separate and access restricted, and we do not use it for any other purpose.
Automated decisions. Screening tools produce potential matches, but a person at Audecy reviews every match and makes the decision. We do not reject a counterparty solely on the output of an automated system.
Frequency of screening. Screening is repeated periodically for continuing relationships and whenever we become aware of a material change in ownership or control.
Outcomes and escalation. Where a match is confirmed, the transaction is stopped and, where required, reported to the relevant authority.
Your rights here. If a screening result affects a decision about you or your organisation, you can ask us what the result was and correct it if it is wrong. We will tell you unless doing so would prejudice a legal or regulatory investigation.
Reciprocity. Our own clients run equivalent checks on us. When we complete a client's due diligence questionnaire we may have to provide the names, job titles, nationalities and dates of birth of our directors, officers and beneficial owners. We tell those individuals when we do so.
A large part of our work involves building systems that process data belonging to our clients. This section explains how we treat that data, because it is the question clients ask us most often.
We act as a processor. Where we build, host, integrate or support a system for a client, we process the personal data in that system only on the client's documented instructions and only for the purposes of the engagement. The client remains the controller.
We do not train on client data by default. We do not use client data, client documents or the contents of client systems to train, fine tune or improve any general purpose model, and we do not use one client's data to build or improve anything for another client. Where a client wants us to train a model on their own data for their own use, that is agreed specifically in writing in the relevant contract, and the resulting model is used only for that client.
Third party model providers. Some of our products call third party AI model providers. Where that happens we tell the client which providers are involved before the engagement starts, we contract on terms that prohibit the provider from training on the data we send, and we use the provider's zero retention or enterprise settings where they are available. The current list of sub-processors is at [SUB-PROCESSOR PAGE URL] and clients are notified before we add a new one.
Minimisation. We ask clients for the least data that will make the system work, we prefer anonymised, pseudonymised or synthetic data for development and testing, and we do not copy production data into development environments without a written instruction.
Human oversight. Our systems are built to support decisions, not to replace accountable human judgement. Where a client deploys a system of ours in a way that produces legal or similarly significant effects on individuals, we work with the client to ensure a meaningful human review step exists.
Separation. Client environments and data are logically separated. Access is granted on a least privilege basis to named individuals for the duration of the engagement and revoked when it ends.
Our website uses cookies and similar technologies. Strictly necessary cookies keep the site working and secure, and we set these without asking, because the site cannot function without them.
We also use [ANALYTICS PROVIDER] to understand how the site is used, and [OTHER TOOLS, IF ANY]. Where the law requires consent for these, we ask for it through the banner on your first visit, and you can change your choice at any time through [COOKIE SETTINGS LINK]. Most browsers also let you block or delete cookies, though parts of the site may then stop working properly.
We do not use advertising or cross site tracking cookies.
We do not sell personal data, and we do not share it for anyone else's marketing.
We share personal data with:
Audecy operates across several countries and uses service providers located outside India. This means your personal data may be transferred to, stored in or accessed from a country other than your own, including India, Singapore, the United Kingdom, the European Union, the United States and the GCC states.
Where we transfer personal data out of a country whose law restricts such transfers, we put an appropriate safeguard in place. Depending on the transfer this may be an adequacy decision, standard contractual clauses, the UK international data transfer addendum, or binding contractual commitments equivalent to those. We also transfer only within any restrictions notified by the Government of India under the Digital Personal Data Protection Act.
You can ask us which safeguard applies to a particular transfer by writing to privacy@audecyai.com.
We maintain technical and organisational measures appropriate to the risk, including:
Breaches. If a personal data breach occurs we will investigate, contain it, and notify the Data Protection Board of India and any other competent authority within the time the law allows. Where we act as a processor we will notify the affected client without undue delay so they can meet their own obligations. Where a breach is likely to result in a significant risk to you, we will tell you directly.
No system is perfectly secure, and we do not claim otherwise. If you believe your data with us has been compromised, contact privacy@audecyai.com immediately.
We keep personal data only as long as we need it, then delete it or anonymise it.
| Category | Retention |
|---|---|
| Enquiries that do not become a relationship | [24] months from last contact |
| Client and supplier relationship records | Duration of the relationship, then [8] years, to match the record keeping period under the Companies Act, 2013 |
| Books, invoices and tax records | [8] years, or longer where GST or income tax law requires |
| Compliance and screening records | [8] years from the end of the relationship, to evidence the checks we carried out |
| Unsuccessful job applications | [12] months, unless you ask us to delete sooner or agree to stay on file |
| Employee records | Duration of employment, then as required by applicable labour, tax and provident fund law |
| Website analytics | [26] months |
| Client system data where we act as processor | As instructed by the client, and returned or deleted at the end of the engagement |
Where a legal claim, investigation or audit is live or reasonably anticipated, we keep the relevant records until it concludes.
Subject to the law that applies to you, you have the right to:
To exercise any of these, write to privacy@audecyai.com. We will respond within the period the applicable law allows, and in any event within 30 days. We may need to verify your identity first. We do not charge for this unless a request is manifestly unfounded or excessive.
If we act as a processor for a client, we will forward your request to that client and support them in answering it, rather than answering it ourselves.
Complaints. If you are unhappy with how we have handled your data, tell our Grievance Officer first and give us the chance to fix it. You also have the right to complain to a supervisory authority: the Data Protection Board of India, the Information Commissioner's Office in the United Kingdom, the Personal Data Protection Commission in Singapore, or the authority in your own country.
Our website and services are directed at businesses and are not intended for children. We do not knowingly collect personal data from anyone under 18, and we do not undertake tracking, behavioural monitoring or targeted advertising directed at children. If you believe a child has given us personal data, write to privacy@audecyai.com and we will delete it.
Where a client engagement involves data relating to children, we process it only as instructed by the client, only where the client has established a lawful basis including verifiable parental consent where required, and under specific contractual terms agreed for that engagement.
We review this policy at least annually and update it when our practices or the law change. The current version and its effective date are always at the top of this page. Where a change materially affects your rights, we will give notice through the website and, where we hold your contact details and it is appropriate, directly.
Audecy AI Technologies Private Limited
NITK Science & Technology Entrepreneurs' Park (NITK), Srinivasnagar, Surathkal, Mangalore, Dakshina Kannada 575025, Karnataka, India
Privacy and data protection: privacy@audecyai.com
Grievance Officer: Sudeep Vuppalapati, Founder and Chief Executive Officer, privacy@audecyai.com
General business: business@audecyai.com
Telephone: +91 91338 65537
Website: audecyai.com