Privacy Policy

1. Who We Are

Prativani is operated by Neuradigi Technologies (OPC) Pvt. Ltd., a company incorporated in India ("Prativani", "we", "us", "our"). This policy covers the prativani.com website, the Prativani dashboard at app.prativani.com, the embeddable chat widget, our messaging and voice channels, and the APIs behind them.

For anything in this policy, or to make a data-protection request, write to [email protected].

2. Two Roles, Two Kinds of Data

Prativani is a customer-support platform, so most of the personal data flowing through it belongs neither to us nor to you — it belongs to the people your business talks to. That difference decides who is responsible for what.

• Customer data — information about you and your team: your account, your organization, your billing. Here we are the controller (the "data fiduciary" under India's DPDP Act), and this policy describes what we do with it.
• End-user data — the messages, emails, calls, recordings and contact records of the people who contact your business through Prativani. Here we are a processor acting on your instructions. You decide what is collected, how long it is kept, and when it is deleted. Our commitments in that role are set out in our Data Processing Addendum.

If you contacted a business that uses Prativani and want to exercise your rights over that conversation, please contact that business — they control the data. We will help them respond, but we cannot act on their data without their instruction.

3. Information We Collect

From you, as our customer:

• Account and profile — name, email address, phone number, password (stored only as a bcrypt hash), profile photo, organization name, role, language and timezone, two-factor settings, and login history including IP address, device and timestamp.
• Billing — plan, subscription status, invoices, usage records and, for customers in India, a GSTIN if you give us one. Card details go directly to our payment provider; we never receive or store full card numbers.
• Identity and regulatory documents — where you provision a phone number in a regulated market, we collect the identity, address and business-registration documents the telecom regulator requires, and pass them to our telephony provider for approval.
• Support and marketing — the content of enquiries, demo requests and anything else you send us.

On your behalf, about your customers:

• Conversation content — chat, WhatsApp, Facebook, Instagram and email messages, including full email bodies, headers and attachments, plus any files shared in a conversation.
• Voice calls — call metadata and, where recording is enabled, the call audio and its transcript.
• Contact records — names, email addresses, phone numbers, social identifiers, attributes, notes, tags and ratings, whether typed by a visitor, entered by your team, or imported from a file or another system.
• Widget activity — a device identifier stored in the visitor's browser, the pages they viewed on your site with titles and time spent, session start and end, IP address, the approximate city, region and country derived from that IP, and basic browser and device information.
• Campaign engagement — where you send an email campaign, whether each recipient opened it or clicked a link, recorded through a tracking image and rewritten links we serve. Conversation replies are never tracked this way.
• Knowledge base material — articles you write, files you upload, and pages we crawl from websites you point us at.

4. How We Use Information

We use customer data to operate your account and deliver the service (performance of our contract with you); to bill you and meet tax and accounting obligations (contract and legal obligation); to keep the platform secure and prevent abuse, fraud and spam, including enforcing sending and rate limits (our legitimate interests); to provide support (contract); to understand product usage in aggregate and improve Prativani (legitimate interests); to send service notices, and product or marketing email where you have not opted out or where you have consented (contract or consent); and to comply with law, including telecom regulation (legal obligation).

End-user data is processed only to provide the service to you — routing, answering, storing and reporting on the conversations your business has. We do not use it for our own purposes.

5. AI Processing

Prativani's AI features work by sending the relevant content to third-party AI model providers. Specifically:

• AI agent replies, conversation summaries, titles and topic labels are generated by sending message content and matching knowledge-base excerpts to our model provider.
• Knowledge-base search converts your articles and the visitor's question into numerical embeddings through the same provider; those embeddings are stored in our database.
• AI voice calls stream the call audio to a realtime model for speech recognition, response generation and speech synthesis.

We do not train AI models on your data or your customers' data, and we use our model providers under API terms that prohibit them from training on data we submit.

AI output is generated, not verified. It can be incomplete or wrong, and you are responsible for how your AI agent is configured and for what it says to your customers.

6. Service Providers and Subprocessors

We rely on a small number of providers to run Prativani. Each is bound by contract to process data only on our instructions and to protect it appropriately. By category, they are:

• AI model providers — generating agent replies, summaries and topic labels, producing knowledge-base embeddings, and handling speech recognition and synthesis on AI voice calls.
• Communication providers — delivering and receiving email, messages on the social and messaging channels you connect, phone calls, and one-time passcodes by SMS where that is enabled for your account.
• Hosting and storage providers — running the servers and databases, and storing uploaded files, attachments and call recordings.
• Payment providers — processing subscription payments, invoices and usage charges.
• Supporting service providers — resolving an IP address to an approximate location, crawling websites you point your knowledge base at, sending push notifications, verifying that forms are not automated, and single sign-on where you use it.

Every one of them is named, with what it does and where it operates, on our Subprocessors page. That page is kept separately so it can be updated when a provider changes without re-issuing this policy, and it is where we publish advance notice of those changes.

We do not use advertising networks, data brokers or lead-enrichment providers, so none appear on that list.

7. International Transfers

We operate from India, and several of the providers listed above are located in the United States and the European Union. Where personal data is transferred out of the country it was collected in, that transfer relies on the recipient's contractual data-protection commitments — including Standard Contractual Clauses where the transfer is subject to European law — together with the safeguards described in section 9.

8. How Long We Keep Things

We keep personal information only as long as we need it. In practice that means:

• Conversations, with their messages, attachments, recordings and transcripts — kept until you delete them. If you set a retention period under Settings → Compliance, closed conversations are permanently deleted once they age past it. Automatic deletion is off unless you turn it on.
• Audit log — 24 months, which is also the minimum period we keep it for.
• AI agent configuration history — 24 months.
• Agent availability and status history — 90 days.
• Quarantined inbound email — 30 days, after which the message and its attachments are destroyed.
• Generated export files — 7 days after they are produced.
• Imported contacts nobody ever engaged with — 90 days.
• Business verification details and documents — kept while your business verification is active, and deleted when your workspace is deleted. Documents from a review that was rejected or withdrawn, and documents that were replaced, are deleted 30 days later. A verification you started but never submitted is deleted, with its documents, 30 days after it was last changed.
• Copies held by our telephony provider — the business details, address and documents we send to our telephony provider for a phone-number approval stay with it while numbers registered to that approval are held. A submission that is rejected or replaced is deleted from the provider within 30 days of being sent, once no number is registered to it, and everything we sent is deleted from the provider when your workspace is deleted.
• Your workspace — when an owner deletes a workspace it is closed immediately and permanently purged after a 7-day grace period, during which it can still be restored.
• A workspace whose free trial ended without a plan — paused and kept for 30 days, then permanently deleted.

Some records are kept longer where the law requires it — invoices and tax records in particular.

9. Security

All traffic to Prativani is encrypted in transit. Passwords are stored only as bcrypt hashes and are never recoverable. Optional two-factor authentication is available by authenticator app, email or SMS. Access inside a workspace is governed by roles and permissions, sessions can be reviewed and revoked, and administrative actions are written to an audit log. Access to production systems is restricted, and credentials are held in encrypted secret storage.

No method of transmission or storage is completely secure, so while these measures substantially reduce risk we cannot guarantee absolute security. If a breach ever affects your data, section 15 sets out what we will do about it.

10. When We Share Information

We share personal information with the providers listed in section 6; with the channels and integrations you choose to connect; when we are compelled to by a valid legal request; to establish or defend legal claims; and with an acquirer if the business is sold or reorganised, in which case this policy continues to apply until you are told otherwise.

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We run no advertising network, no retargeting and no data brokerage.

11. Government and Law Enforcement Requests

Sometimes a court, a police force, a tax authority or another public body asks a company to hand over information about the people who use it. This section sets out what we do when that happens.

We check that the request is lawful. We do not disclose anything simply because a request looks official. Before we respond we satisfy ourselves that it comes from an authority with jurisdiction over us, that it was properly issued under a law that applies, and that it genuinely covers the information being asked for. A request that fails any of those is refused or sent back for correction.

We disclose the minimum. Where we are legally required to respond, we provide only the specific information the request covers, for the period it covers. We do not hand over a whole account, a whole workspace or a wider date range because that would be easier than narrowing it properly.

We keep a record. For each request we log who asked, what they asked for, the legal basis relied on, who at Neuradigi decided, what was disclosed and when. That record exists so we can account for the decision afterwards.

We tell you where we are allowed to. If a request concerns data belonging to one of our business customers, we notify that customer so they can respond themselves — unless we are legally prohibited from telling them, or there is a genuine emergency involving a risk to someone's life.

We give no government bulk access to customer data, and no authority has direct or unsupervised access to our systems. Requests should be sent to [email protected] and are handled by a person, never automatically.

12. Your Rights

Subject to your local law, you may ask us to give you a copy of the personal information we hold about you, correct it, delete it, restrict or object to how we use it, receive it in a portable format, or withdraw consent you previously gave. You may also complain to your data-protection authority.

If you are in India, the DPDP Act gives you the right to access, correction and erasure, the right to nominate someone to exercise your rights on your behalf, and the right to a grievance-redressal process — start with our Grievance Officer in section 16, and escalate to the Data Protection Board of India if we do not resolve it.

If you are in California, you may request to know, delete or correct your personal information, and you will not be discriminated against for asking. We do not sell or share personal information, so there is nothing to opt out of.

Some of this is self-service. In your workspace, Settings → Compliance lets you export your personal data, unsubscribe from platform email, and set an automatic deletion period for conversation data; a workspace owner can delete the workspace entirely. For anything else, email [email protected]. We will verify who you are and respond within 30 days.

If what you want is deletion and you are not sure which route applies to you, our Deleting Your Data page walks through each case step by step.

13. Cookies and Browser Storage

Prativani sets one cookie, which keeps you signed in, and stores a few preferences in your browser instead of using cookies. We run no analytics or advertising cookies, no session replay and no device fingerprinting. The detail — including what the chat widget stores on sites where it is installed, and the open tracking that email campaigns carry — is in our Cookie Policy.

14. Children

Prativani is a business tool. It is not directed at children, and we do not knowingly collect personal information from anyone under 18. If you use Prativani to communicate with children, obtaining the consents your law requires — including verifiable parental consent where it applies — is your responsibility as the controller of that data.

15. Data Breaches

If a breach affects your data, we will notify you without undue delay once we understand what happened, and we will notify regulators where the law requires it. If the breach involves end-user data we process for you, we will tell you so that you can meet your own notification obligations.

16. Contact and Grievance Officer

Privacy questions, data-protection requests and grievances go to our Grievance Officer, appointed under India's DPDP Act:

Grievance Officer
Neuradigi Technologies (OPC) Pvt. Ltd.
156-Upper, Evershine Mall, Malad West
Mumbai 400064, Maharashtra, India
CIN: U62099MH2024OPC431071
[email protected]

We acknowledge grievances within 72 hours and aim to resolve them within 30 days.

17. Changes to This Policy

We may update this Privacy Policy. If we make a material change — a new purpose, a new category of data, or a new sub-processor handling end-user data — we will post the revised policy here with a new effective date and, where the change affects you meaningfully, tell you by email or in the product before it takes effect.