2. Information We Collect

2.1 Personal Information You Provide Directly

• Full name, designation, and professional title
• Email address and phone number
• Company name, industry, and size
• Billing and payment information (processed via secured payment gateways)
• Messages, queries, and support requests
• Business requirements and project briefs
• Any documents or files you share with us

2.2 Automatically Collected Technical Data

• address and geographic location (country/region level)
• Device type, operating system, and browser version
• Pages visited, features used, and time spent
• Referring URLs, session data, and click-stream data
• API usage patterns and integration metadata
• Error logs and performance diagnostics

2.3 AI Interaction and Product Usage Data

• User inputs, prompts, queries, and commands submitted to AI systems
• AI-generated outputs and responses
• Model feedback, ratings, and correction data provided by users
• Workflow and automation activity logs
• Feature engagement and usage analytics within AI applications
• Training data provided or approved by enterprise clients for model customization

2.4 Enterprise and SaaS Client Data

When Caasaa provides AI solutions to enterprise or SaaS clients, we may process business data on behalf of those clients as a data processor. This includes customer databases, CRM records, internal documents, workflows, employee/user account information, and transaction records. In such cases, the enterprise client is the data controller and Caasaa acts as a data processor under a Data Processing Agreement (DPA).

2.5 Third-Party and Integration Data

Our AI products may integrate with third-party platforms (e.g., CRMs, ERPs, cloud storage, communication tools). Data exchanged through such integrations is handled per the terms of applicable integration agreements and this Policy.

3. How We Use Your Information

3.1 Service Delivery and Operations

• Providing, operating, and maintaining our AI products and services
• Processing client onboarding, contracts, and account management
• Delivering enterprise AI implementations and SaaS subscriptions
• Providing technical support, helpdesk services, and customer success
• Enabling integrations with client systems and third-party platforms

3.2 AI Product Development and Improvement

• Improving performance, accuracy, and reliability of our AI models
• Conducting internal research and development on AI capabilities
• Testing, validating, and monitoring AI system outputs
• Detecting and correcting biases, errors, and model drift

3.3 Business and Commercial Purposes

• Responding to inquiries, proposals, and sales requests
• Billing, invoicing, and financial transaction processing
• Sending product updates, newsletters, and marketing communications (with consent)
• Managing partner and vendor relationships

3.4 Legal, Compliance, and Security

• Complying with applicable laws, regulations, and legal obligations
• Enforcing contractual terms, policies, and intellectual property rights
• Preventing fraud, unauthorized access, and security incidents
• Maintaining records required by law or contract

4. Legal Basis for Processing

5. Sharing and Disclosure of Information

Caasaa does not sell, rent, or trade your personal information. We may share your information only under the following circumstances:

5.1 Service Providers and Technology Partners

We engage trusted third-party vendors to support our operations, including cloud infrastructure providers, payment processors, analytics platforms, communication tools, and security services. These parties are bound by confidentiality and data protection obligations.

5.2 Enterprise Client Relationships

Where Caasaa processes data on behalf of enterprise clients, data may be shared with the client's authorized personnel and integrated systems as specified in the relevant service agreement and DPA.

5.3 AI Ecosystem Partners

Caasaa may collaborate with AI model providers, research institutions, or technology partners for product development. Any data sharing in such context is governed by strict contractual protections.

5.4 Legal and Regulatory Requirements

We may disclose information when required by applicable law, court order, government authority, or to protect Caasaa's rights, property, safety, or that of our users.

5.5 Business Transfers

In the event of a merger, acquisition, asset sale, or corporate restructuring, user information may be transferred as part of business assets, subject to equivalent privacy protections.

5.6 Aggregated and Anonymized Data

We may share aggregated, de-identified, or anonymized data that cannot reasonably be used to identify you, for research, benchmarking, or marketing purposes.

6. AI-Specific Data Practices

6.1 AI Model Training and Data Usage

• Caasaa does not use personally identifiable information to train general AI models without explicit consent
• Enterprise client data used for model fine-tuning is governed by a separate DPA
• Anonymized or synthetic data may be used to improve AI model accuracy
• Model outputs are not sold or shared with unauthorized third parties

6.2 Automated Decision-Making

Some Caasaa AI products may involve automated processing that produces decisions or recommendations. Where such decisions have significant effects on individuals, we ensure transparency, the right to request human review, and compliance with applicable laws (e.g., GDPR Article 22).

6.3 AI Bias and Fairness

Caasaa is committed to ethical AI development. We conduct regular audits of our AI systems to detect and mitigate bias, ensure fairness, and prevent discriminatory outputs.

6.4 Explainability and Transparency

Where technically feasible, we provide clients and users with meaningful explanations of AI-driven outputs and the factors influencing them.

6.5 AI Output Responsibility

Caasaa's AI systems are decision-support tools. Clients and end-users retain responsibility for decisions made using AI-generated outputs. Caasaa is not liable for decisions made solely on the basis of AI recommendations without appropriate human oversight.

7. International Data Transfers

Caasaa operates globally and may transfer personal data across international borders. We ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs), adequacy decisions, Binding Corporate Rules (BCRs), compliance with India's DPDPA 2023, and applicable US state privacy laws.

8. Data Retention

9. Data Security

9.1 Technical Safeguards

• AES-256 encryption for data at rest; TLS 1.3 for data in transit
• Multi-factor authentication (MFA) for all internal systems
• Role-based access control (RBAC) limiting data access to authorized personnel
• Regular penetration testing, vulnerability scanning, and security audits
• Secure Software Development Lifecycle (SSDLC) practices
• AI model security testing against adversarial inputs and prompt injection

9.2 Organizational Safeguards

• Mandatory data privacy training for all employees and contractors
• Data Protection Officer (DPO) overseeing compliance
• Vendor security assessments before onboarding third-party providers
• Privacy-by-Design and Privacy-by-Default principles embedded in product development

9.3 Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, Caasaa will notify affected parties and relevant regulatory authorities within the timeframes required by applicable law (e.g., 72 hours under GDPR; as required under India's DPDPA; and applicable US state laws).

10. Cookies and Tracking Technologies

Caasaa uses cookies, web beacons, pixels, and similar tracking technologies on its website and digital products to enable essential functionality, analyze traffic, personalize content, and support marketing. You can manage cookie preferences through your browser settings or our cookie consent interface.

For detailed information on cookies used, please refer to our Cookie Policy.

11. Your Data Rights

To exercise your rights, please contact us at privacy@caasaa.com. We will respond within 30 days (or within the timeframe required by your applicable law).

12. Regional and Regulatory Compliance

12.1 India — Digital Personal Data Protection Act (DPDPA) 2023

Caasaa is incorporated in India and complies with the DPDPA 2023, including maintaining transparency about data processing, honouring data principal rights, and observing restrictions on cross-border transfers.

12.2 European Union — GDPR

For users in the EU and EEA, Caasaa complies with the General Data Protection Regulation (GDPR), including lawful basis for processing, data subject rights, and data transfer mechanisms.

12.3 United Kingdom — UK GDPR

Caasaa's practices align with the UK GDPR and the Data Protection Act 2018 for users in the United Kingdom.

12.4 United States — State Privacy Laws

Caasaa acknowledges and seeks to comply with applicable US state privacy laws including CCPA/CPRA, CDPA (Virginia), CPA (Colorado), and other applicable state regulations. California residents may opt out of data sales — Caasaa does not sell personal data.

12.5 Other Jurisdictions

For clients in the Middle East, Southeast Asia, Australia, Canada, and other regions, Caasaa seeks to comply with applicable local data protection laws. Enterprise clients may request region-specific DPAs.

13. Intellectual Property and AI Ownership

All content, trademarks, logos, and product names on our website — including AICHA™, ConGen™, DigiMee™, AICA-CRM™, and other Caasaa offerings — are the exclusive property of Caasaa AI Innovations Pvt Ltd. Client data uploaded through Caasaa's platforms remains the property of the client. Caasaa claims no ownership rights over client data and processes it only as instructed.

14. Third-Party Links, Integrations, and Services

Our website and AI products may contain links to or integrate with third-party platforms, APIs, and services. Caasaa is not responsible for the privacy practices or content of these third parties. We recommend reviewing the privacy policies of all third-party services you access in connection with our products.

15. Children's Privacy

Caasaa's Services are not directed at individuals under the age of 18. We do not knowingly collect personal information from minors. If you are a parent or guardian and believe your child has submitted information to us, please contact us at privacy@caasaa.com and we will take prompt steps to delete such information.

16. SaaS Platform-Specific Privacy Terms

SaaS subscribers are responsible for maintaining the security of their account credentials. Caasaa's SaaS platforms use logical data isolation to ensure strict tenant separation. Clients may export their data at any time during their subscription. Upon contract termination, client data will be available for export for 30 days, after which it will be securely deleted unless retention is required by law.

17. Enterprise Deployment Privacy Terms

Enterprise clients processing personal data through Caasaa's solutions will enter into a Data Processing Agreement (DPA) defining roles, processing instructions, security measures, sub-processor lists, and data subject rights mechanisms. For on-premise or private cloud deployments, data does not leave the client's infrastructure. Enterprise clients may request privacy and security audits, and we can provide relevant certifications (e.g., SOC 2, ISO 27001) upon request.

18. Changes to This Privacy Policy

Caasaa may update this Privacy Policy periodically to reflect changes in our practices, products, technologies, or legal requirements. When we make material changes, we will post the updated Policy on our website with a revised "Last Updated" date and notify registered users and enterprise clients by email. Continued use of our Services after changes are posted constitutes acceptance of the updated Policy.

19. Grievance Redressal and Data Protection Officer

Caasaa has appointed a Data Protection Officer (DPO) / Grievance Officer responsible for overseeing data protection compliance. If you have concerns about your data or this Policy:

We will respond to data-related grievances within 30 days of receipt.

20. Governing Law and Jurisdiction

This Privacy Policy is governed by the laws of India, including the Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000, and rules thereunder. Any disputes arising from this Policy shall be subject to the jurisdiction of courts in Greater Noida / Delhi NCR, India, unless otherwise agreed in writing.

2. Acceptance of Terms

By accessing or using any Caasaa Service, you confirm and warrant that:

• You are at least 18 years of age and legally capable of entering into a binding contract.
• You have read these Terms in their entirety and agree to be legally bound by them.
• If acting on behalf of a company, you have the authority to bind that entity to these Terms.
• You agree to comply with all applicable laws, regulations, and third-party agreements.
• You accept Caasaa's Privacy Policy, Cookie Policy, and any applicable supplemental terms.

3. Scope of Application

These Terms apply to all users and clients interacting with Caasaa, including visitors, prospective clients, enterprise clients, SaaS subscribers, business partners, resellers, affiliates, developers accessing APIs, and end users of AI applications built by Caasaa. These Terms apply globally across all markets in which Caasaa operates.

4. Services Overview

Caasaa is an AI product development company that designs, builds, and delivers AI-powered software solutions. Our current portfolio includes, but is not limited to:

All Services are subject to separate commercial agreements, signed proposals, service orders, or SLAs where applicable.

5. Website Use and Conduct Restrictions

5.1 Permitted Use

You may access the Website solely for lawful purposes and in accordance with these Terms, including reviewing product information, submitting inquiries, and accessing publicly available content.

5.2 Prohibited Activities

You agree NOT to engage in any of the following:

• Using the Website or Services for any unlawful, fraudulent, or harmful purpose.
• Attempting unauthorized access to Caasaa's systems, servers, databases, or AI infrastructure.
• Copying, scraping, or reproducing any content, AI model, algorithm, code, or design without express written consent.
• Reverse engineering, decompiling, or attempting to derive source code or model weights from Caasaa's products.
• Uploading or transmitting malicious code, viruses, worms, ransomware, or any harmful software.
• Misrepresenting your identity, affiliation, or authority to access Caasaa's Services.
• Engaging in prompt injection, adversarial attacks, or any attempt to manipulate or bypass Caasaa's AI systems.
• Reselling, sublicensing, or redistributing Caasaa's Services without written authorization.
• Using automated bots, scrapers, or crawlers to access, index, or harvest Website content.

Caasaa reserves the right to monitor Website usage, investigate suspected violations, and immediately suspend or permanently terminate access of any user found in breach of these restrictions.

6. Intellectual Property Rights — Patent & Trademark Protection

6.1 Ownership and Reservation of Rights

All content, materials, and technology on the Website and within Caasaa's products — including logos, brand names, AI models, source code, software architecture, algorithms, and methodologies — are the exclusive intellectual property of Caasaa AI Innovations Pvt Ltd or its duly licensed partners, protected under Indian and international intellectual property laws.

6.2 Registered Trademarks

Unauthorized use, reproduction, or impersonation of Caasaa's trademarks is strictly prohibited and may result in civil or criminal legal action.

6.3 Client Content and AI Output Ownership

Clients retain full ownership of their data and content submitted through Caasaa's platforms. Ownership of AI-generated outputs is governed by the applicable service agreement. Caasaa retains ownership of underlying model architectures, training methodologies, and platform infrastructure in all cases.

7. Subscription, SaaS, and Licensing Terms

Access to Caasaa's SaaS platforms is provided on a subscription basis. Caasaa grants the Client a limited, non-exclusive, non-transferable, non-sublicensable, revocable license to access and use the subscribed Services solely for the Client's internal business purposes during the subscription term. Subscriptions may auto-renew unless cancelled prior to the renewal date as specified in the applicable Order Form.

8. Enterprise Engagement Terms

Enterprise engagements include custom AI development, system integrations, model fine-tuning, private cloud deployments, on-premise installations, and AI advisory services. The scope, deliverables, timelines, and commercial terms for enterprise projects are governed by a signed Master Services Agreement (MSA), Statement of Work (SOW), or equivalent contractual document. Any changes to agreed scope must be mutually agreed upon in writing via a formal Change Request (CR) process.

9. AI Usage, Outputs, and Disclaimers

9.1 Nature of AI Systems

Caasaa's products are built on artificial intelligence, machine learning, and natural language processing technologies. These systems are probabilistic — outputs are generated based on patterns and may not be deterministic. AI-generated content may contain errors, inaccuracies, or omissions.

9.2 User Responsibility for AI Outputs

AI-generated outputs must be independently reviewed and verified before being relied upon for critical decisions. Caasaa's AI systems are decision-support tools and do not replace professional judgment. Final responsibility for decisions rests solely with the user or client.

9.3 Prohibited AI Use Cases

• Generating or spreading disinformation, misinformation, or deceptive content.
• Creating deepfakes or synthetic media without lawful consent.
• Automated decision-making in contexts where such use is prohibited by applicable law without human oversight.
• Surveillance, tracking, or profiling of individuals without appropriate consent.
• Generating content that is defamatory, harassing, obscene, or otherwise harmful.

10. Data Protection, Privacy, and AI Data Practices

Caasaa's collection and processing of personal data is governed by our Privacy Policy, which is incorporated by reference into these Terms. Enterprise clients will enter into a Data Processing Agreement (DPA) as required. Caasaa does not use client data or end-user inputs to train its general AI models without explicit, documented written consent from the data controller.

11. Payment, Billing, and Refund Policy

All fees are quoted exclusive of applicable taxes unless stated otherwise. Invoices are due within the payment period specified in the applicable agreement. Late payments may attract interest at 18% per annum or the maximum rate permitted by law. For SaaS subscriptions: fees are non-refundable unless otherwise stated in the applicable subscription agreement or where required by applicable law. For enterprise projects: refund and cancellation terms will be specified in the applicable MSA or SOW.

12. Service Levels, Uptime, and Support

Caasaa targets a 99.5% monthly uptime SLA for its SaaS platforms, excluding scheduled maintenance, force majeure events, and third-party infrastructure failures. Actual SLA commitments and support response times are specified in the applicable SLA agreement for each subscription tier or enterprise engagement. Caasaa provides tiered support (standard, priority, and dedicated) based on the applicable service agreement.

13. Confidentiality and Non-Disclosure

Both parties agree to maintain strict confidentiality of all Confidential Information received from the other party. Confidential Information shall not be disclosed to any third party without prior written consent, and shall be protected using the same degree of care applied to the receiving party's own confidential information (no less than reasonable care). Confidentiality obligations survive termination of these Terms for a period of three (3) years, or indefinitely for trade secrets.

14. Product Demonstrations and Proposals

Demonstrations, prototypes, proof-of-concept outputs, and proposals provided by Caasaa prior to or during sales engagements are provided "as-is" for evaluation purposes only and do not constitute binding representations of final product capabilities. Specifications and features are subject to change. No license is granted through demonstrations or proposals.

15. Representations and Warranties

Caasaa warrants that: (a) it has full authority to enter into these Terms; (b) its Services will be provided with reasonable skill and care; (c) it will implement reasonable security measures to protect client data; and (d) it will comply with applicable laws in providing its Services.

16. Limitation of Liability

Caasaa's total aggregate liability for any claim arising out of or relating to these Terms or the Services shall not exceed the total amount paid by the Client to Caasaa in the twelve (12) months preceding the event giving rise to the claim, or INR 10,000 (whichever is greater) for free or trial users.

16.1 Specific Exclusions

Without limiting the foregoing, Caasaa is not liable for: decisions made solely on the basis of AI-generated outputs without human review; loss or corruption of data beyond SLA backup policy coverage; downtime due to third-party infrastructure or events outside Caasaa's reasonable control; or security incidents attributable to Client's failure to implement reasonable access controls.

17. Indemnification

You agree to defend, indemnify, and hold harmless Caasaa AI Innovations Pvt Ltd, its directors, officers, employees, contractors, agents, affiliates, and licensors from and against any and all claims, damages, losses, costs, liabilities, fines, penalties, and expenses (including reasonable legal fees) arising from or related to: your violation of these Terms or any applicable law; your unauthorized or improper use of Caasaa's products or Services; infringement of any third-party intellectual property rights caused by your use of the Services; or any claims brought by your own customers arising from your use or deployment of Caasaa's Services.

18. Third-Party Links, APIs, and Integrations

Caasaa's Website and AI products may contain links to, or integrate with, third-party websites, platforms, APIs, tools, cloud services, and data providers. Caasaa is not responsible for the privacy practices, terms of service, security, or data handling activities of any third-party service. Caasaa will provide a list of key sub-processors and third-party integrations upon request by enterprise clients.

19. Termination and Suspension

19.1 Termination by Client

Clients may terminate a subscription or service agreement in accordance with the notice and cancellation provisions in their applicable agreement. Requests for termination must be submitted in writing to legal@caasaa.com.

19.2 Termination and Suspension by Caasaa

Caasaa reserves the right to immediately and without prior notice suspend or terminate Website access for any user or account found to be in violation of these Terms, or terminate a service agreement for material breach by the Client.

19.3 Effect of Termination

Upon termination: Client's right to access the Services ceases immediately; SaaS clients may export their data for 30 days following termination, after which data will be securely deleted; all outstanding payment obligations remain due and payable; and clauses relating to confidentiality, intellectual property, limitation of liability, indemnification, and governing law shall survive termination.

20. Force Majeure

Caasaa shall not be liable for any failure or delay in performance of its obligations resulting from circumstances beyond its reasonable control, including acts of God, natural disasters, pandemics, war, civil unrest, government actions, regulatory changes, widespread internet or infrastructure outages, cyberattacks, or strikes. Caasaa will notify affected clients promptly and use reasonable efforts to resume performance as soon as practicable.

21. Export Controls and Sanctions Compliance

Caasaa's products and technologies may be subject to export control laws and trade sanctions administered by India, the United States, the European Union, and other relevant jurisdictions. Clients agree to comply with all applicable export control laws and to not export, re-export, transfer, or make available Caasaa's products or services to any sanctioned country, entity, or individual.

22. Children's Use Restrictions

Caasaa's Website and Services are intended for users aged 18 (eighteen) years and above. Caasaa does not knowingly collect personal information from minors. If you are a parent or guardian and believe a person under 18 has used our Services, please contact us immediately at privacy@caasaa.com.

23. Anti-Corruption and Ethical Use

Users and clients of Caasaa's products agree that they will not use Caasaa's Services in connection with any activity that violates anti-corruption laws, including the Prevention of Corruption Act (India), the UK Bribery Act, or the US Foreign Corrupt Practices Act. They will not use Caasaa's AI products to generate propaganda, hate speech, or content that facilitates discrimination on the basis of race, gender, religion, national origin, disability, or other protected characteristics.

24. Amendments and Updates

Caasaa reserves the right to modify, update, or replace these Terms at any time. Updates will be posted on the Website with a revised "Last Updated" date. For material changes, Caasaa will provide notice to registered users and enterprise clients via email or in-platform notification with reasonable advance notice. Your continued use of the Services after any update constitutes your acceptance of the revised Terms.

25. Severability and Waiver

If any provision of these Terms is found to be invalid or unenforceable, such provision shall be modified to the minimum extent necessary to make it enforceable, and the remaining provisions shall continue in full force and effect. Caasaa's failure to enforce any right or provision shall not constitute a waiver of such right or provision.

26. Entire Agreement

These Terms, together with Caasaa's Privacy Policy, Cookie Policy, any applicable SLA, DPA, Order Form, MSA, SOW, or other executed agreement, constitute the entire agreement between the parties with respect to the subject matter herein and supersede all prior discussions, negotiations, representations, and agreements. In the event of a conflict between these Terms and a signed client agreement, the terms of the signed agreement shall prevail.

27. Governing Law, Dispute Resolution, and Jurisdiction

27.1 Governing Law

These Terms shall be governed by and construed in accordance with the laws of India, including the Information Technology Act, 2000, the Digital Personal Data Protection Act, 2023, and the Indian Contract Act, 1872.

27.2 Amicable Resolution

In the event of any dispute, the parties agree to first attempt to resolve the matter through good-faith negotiation within thirty (30) days of written notice.

27.3 Arbitration

If the parties are unable to resolve a dispute through good-faith negotiation, either party may refer the dispute to binding arbitration under the Arbitration and Conciliation Act, 1996 (India). The seat of arbitration shall be Greater Noida / Delhi NCR, India. The language of arbitration shall be English.

27.4 Jurisdiction

Any matter not subject to arbitration shall be subject to the exclusive jurisdiction of the courts located in Greater Noida / Delhi NCR, Uttar Pradesh, India.

28. Contact Information and Legal Notices

For all legal, contractual, and compliance inquiries, please contact:

Legal notices must be sent in writing to the registered address above or to legal@caasaa.com with confirmation of receipt. Caasaa will acknowledge legal notices within 5 business days.

2. How Caasaa Uses Cookies

Caasaa uses cookies and tracking technologies for the following purposes:

• Essential Operations: To enable core website and platform functionality, including user authentication, session management, and security.
• Performance and Analytics: To analyze how visitors interact with our website and products, measure page performance, and identify areas for improvement.
• Personalization: To remember your preferences, settings, and choices, and to deliver a more tailored experience.
• Marketing and Attribution: To understand how users arrive at our website, measure the effectiveness of marketing campaigns, and deliver relevant content.
• AI Product Engagement: Within our SaaS platforms, to track feature engagement, session activity, and usage patterns to improve our AI products.

3. Types of Cookies We Use

4. Third-Party Cookies

Our website and AI products integrate with trusted third-party services that may set their own cookies on your device when you interact with our platform. These may include:

• Google Analytics & Google Ads — Website analytics and advertising attribution
• LinkedIn Campaign Manager — Professional audience retargeting
• Facebook / Meta Pixel — Social advertising and campaign measurement
• HubSpot — CRM, marketing automation, and lead tracking
• Hotjar / Clarity — Heatmaps and session recording for UX improvement
• Intercom / Freshdesk — Customer support chat and ticketing
• Razorpay / Stripe — Payment processing (these cookies are essential for transaction security)
• YouTube / Vimeo — Embedded video content players

These third-party services may collect and process your data in accordance with their own privacy and cookie policies. We recommend reviewing the relevant policies of these providers. Caasaa does not control third-party cookies and is not responsible for the practices of third-party services.

5. Cookies in Caasaa's AI Products

When you use Caasaa's AI-powered SaaS platforms (including AICHA™, AICA-CRM™, DigiMee™, and others), we use additional session management and operational cookies that are integral to the functioning of these products:

• Authentication and Session Tokens: Securely identify and maintain your logged-in session.
• AI Model Preference Cookies: Remember model configurations, personas, and workflow preferences you have saved.
• Feature Flag Cookies: Used to selectively enable or test new product features for specific user groups.
• Usage Analytics Cookies: Track how features and AI workflows are used to improve product design and performance. Usage data is anonymized and aggregated.
• Conversation Context: Temporary session data to maintain conversational context within AI chat interfaces (not persisted beyond the session unless explicitly saved by the user).

6. Managing Your Cookie Preferences

6.1 Cookie Consent Interface

When you first visit www.caasaa.com, you will be presented with a cookie consent banner that allows you to accept all cookies, reject non-essential cookies, or customize your preferences by category. You can change your preferences at any time by accessing the cookie settings from the footer of our website.

6.2 Browser-Level Controls

Most web browsers allow you to control cookies through their settings. You can:

• Block all or certain types of cookies
• Delete existing cookies from your browser
• Set your browser to notify you when cookies are being set
• Use browser extensions that block tracking technologies

Note that disabling certain cookies may affect the functionality and performance of our website and AI products. Strictly necessary cookies cannot be disabled as they are essential for the platform to operate securely.

For guidance on managing cookies in popular browsers:

• Google Chrome: Settings → Privacy and Security → Cookies and other site data
• Mozilla Firefox: Settings → Privacy & Security → Cookies and Site Data
• Safari: Preferences → Privacy → Manage Website Data
• Microsoft Edge: Settings → Cookies and Site Permissions

6.3 Opt-Out of Analytics and Advertising

• Google Analytics: Install the Google Analytics Opt-out Browser Add-on
• Interest-Based Advertising: Visit aboutads.info/choices or youronlinechoices.eu

7. Cookie Retention Periods

8. Your Rights

Depending on your jurisdiction, you may have the following rights in relation to cookie data:

• Right to Withdraw Consent: You may withdraw your consent to non-essential cookies at any time through our cookie preference centre or your browser settings.
• Right to Access: You may request information about the cookies and tracking technologies used on our website.
• Right to Erasure: You may delete cookies stored on your device at any time through your browser controls.
• Right to Object: You may object to the use of cookies for marketing or profiling purposes.
• GDPR Rights (EU/EEA users): You have the right to lodge a complaint with your national data protection supervisory authority if you believe your rights have been violated.
• DPDPA Rights (India): You have the right to withdraw consent and to raise grievances with our Data Protection Officer (DPO).

9. Updates to This Cookie Policy

Caasaa may update this Cookie Policy from time to time to reflect changes in the cookies we use, changes in applicable laws, or changes in our practices. When we make material changes, we will post the updated Policy on our website with a revised "Last Updated" date and, where appropriate, notify you through the cookie consent banner or by email. Your continued use of our Services after such updates constitutes acceptance of the revised Policy.

10. Contact Us

If you have any questions, concerns, or requests regarding this Cookie Policy or our use of cookies, please contact us:

We will acknowledge and respond to your inquiry within 30 days of receipt.

2. Scope and Territorial Applicability

The GDPR applies to Caasaa's processing of personal data in the following circumstances:

• When we offer goods or services to individuals located in the EU, EEA, or UK, regardless of whether payment is required;
• When we monitor the behaviour of individuals located in the EU, EEA, or UK (for example, through analytics or AI-driven personalisation);
• When we process personal data on behalf of Enterprise or SaaS clients who are themselves subject to the GDPR;
• When we engage EU/EEA/UK-based vendors, sub-processors, or partners.

This Notice covers all Caasaa products and services, including our AI CRM, AI Caller Agents, Virtual AI Team, RealtorGPT, Call & Meeting Analyzer (CM Analyzer), AI Campaigner, AI Content Creator, and any other industry-agnostic or industry-specific AI solutions delivered by Caasaa.

3. Data Controller and Data Protection Officer

For personal data that Caasaa determines the purposes and means of processing, Caasaa AI Innovations Pvt Ltd acts as the Data Controller. For personal data we process on behalf of our Enterprise and SaaS clients, Caasaa acts as a Data Processor, and the client is the Controller.

We have appointed a Data Protection Officer (DPO) responsible for overseeing GDPR compliance. You may contact our DPO with any questions relating to this Notice or your rights:

Where required, Caasaa will appoint an EU/UK Representative under Article 27 of the GDPR. Details of any appointed Representative are available on request via the contacts above.

4. Definitions Under the GDPR

For the purposes of this Notice, the following terms carry the meanings given under the GDPR:

5. Categories of Personal Data We Process

Depending on how you interact with Caasaa, we may process the following categories of personal data:

• Identity and contact data — name, job title, company, email address, phone number, postal address.
• Account and authentication data — usernames, hashed passwords, access logs, role permissions.
• Technical and usage data — IP address, device identifiers, browser type, operating system, session activity, and product interaction logs.
• AI interaction data — prompts, queries, transcripts, uploaded content, and outputs generated through Caasaa AI products.
• Communication data — records of calls analysed by CM Analyzer, support tickets, and correspondence.
• Commercial data — billing details, subscription history, and contractual information.
• Marketing and preference data — consent records, communication preferences, and campaign engagement.

6. Lawful Bases for Processing

Under Article 6 of the GDPR, we only process personal data where we have a valid lawful basis. The bases we rely on include:

Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal. Where we rely on legitimate interests, you may object to such processing as described in the "Your GDPR Rights" section.

7. Purposes of Processing

We process personal data for clearly defined and limited purposes, including:

• To provide, operate, and maintain Caasaa AI products and SaaS platforms;
• To authenticate users and secure access to accounts and workspaces;
• To deliver, configure, and support Enterprise AI deployments;
• To process and analyse content submitted to AI products in order to generate outputs requested by you or your organisation;
• To improve our products, models, and service quality (using aggregated or anonymised data wherever possible);
• To communicate with you regarding service updates, security notices, and — with consent — marketing;
• To comply with legal, regulatory, and contractual obligations;
• To detect, prevent, and respond to security incidents, fraud, and misuse.

We will not use personal data for purposes that are incompatible with those for which it was originally collected without providing notice and, where required, obtaining consent.

8. AI Processing and Automated Decision-Making

Caasaa builds AI products that process data to generate insights, content, and recommendations. We are transparent about how these systems use personal data:

• Model training. By default, Caasaa does not use identifiable Enterprise or SaaS client data to train shared foundation models. Where client data is used to fine-tune models for that client's own benefit, it is isolated to that client.
• Anonymisation. Where data is used for product improvement, we apply de-identification and aggregation so that individuals cannot reasonably be re-identified.
• Human oversight. Outputs from Caasaa AI products are intended to support, not replace, human decision-making.

9. Your GDPR Rights as a Data Subject

If you are located in the EU, EEA, or UK, you have the following rights in respect of your personal data:

To exercise any of these rights, contact our DPO at privacy@caasaa.com. We respond to verified requests within one month, extendable by two further months for complex requests, with notice to you.

10. How to Exercise Your Rights

You can submit a data subject request through any of the following channels:

• Email our DPO at privacy@caasaa.com with the subject line "GDPR Request";
• Use the in-product privacy controls available in your Caasaa SaaS account dashboard;
• Contact your dedicated account manager (for Enterprise clients).

To protect your data, we may need to verify your identity before fulfilling a request. We will not charge a fee for handling a request unless it is manifestly unfounded, excessive, or repetitive, in which case a reasonable administrative fee may apply or we may refuse to act, as permitted by Article 12 of the GDPR.

11. Consent and Cookie Management

Where we rely on consent, we obtain it through clear, affirmative action. For EU/EEA/UK visitors, our website displays a cookie consent banner on first visit that allows you to accept, reject, or customise non-essential cookies.

• Strictly necessary cookies are always active and do not require consent.
• Analytics, functional, and marketing cookies are only set after you provide consent.
• You can change or withdraw your cookie preferences at any time via the "Cookie Preferences" link in the website footer or the consent interface.

We maintain records of consent, including when and how it was given, to demonstrate compliance. For details on the specific cookies we use, please refer to our Cookie Policy.

12. International Data Transfers

Caasaa is headquartered in India and may transfer personal data outside the EU, EEA, or UK to provide our services. Whenever we transfer personal data internationally, we ensure an adequate level of protection through one or more of the following safeguards:

• Standard Contractual Clauses (SCCs) approved by the European Commission, and the UK International Data Transfer Agreement (IDTA) or Addendum where applicable;
• Adequacy decisions where the destination country is recognised as providing adequate protection;
• Supplementary technical and organisational measures, such as encryption and access controls, to protect data in transit and at rest.

You may request a copy of the relevant transfer safeguards by contacting our DPO. Where Caasaa relies on SCCs, they are incorporated into our Data Processing Agreements with clients and sub-processors.

13. Data Processing Agreements and Sub-processors

When Caasaa processes personal data on behalf of an Enterprise or SaaS client, we enter into a Data Processing Agreement (DPA) that meets the requirements of Article 28 of the GDPR. Our DPA sets out the subject matter, duration, nature, and purpose of processing, the types of data and categories of data subjects, and the obligations and rights of the Controller.

Caasaa engages carefully vetted sub-processors (such as cloud hosting, infrastructure, and analytics providers) to deliver our services. For all sub-processors we:

• Conduct due diligence on their security and compliance posture;
• Impose data protection obligations equivalent to those in our own DPA;
• Maintain a current list of sub-processors, available to clients on request;
• Provide clients advance notice of changes, with the opportunity to object.

14. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including legal, accounting, or reporting requirements.

When personal data is no longer required, we securely delete or irreversibly anonymise it. Enterprise clients may define custom retention and deletion schedules under their DPA.

15. Data Security Measures

Caasaa implements appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction, as required by Article 32 of the GDPR. These include:

• Encryption of data in transit (TLS) and at rest;
• Role-based access controls and the principle of least privilege;
• Network segmentation, firewalls, and intrusion monitoring;
• Regular security testing, vulnerability assessments, and patch management;
• Logical isolation of client environments in multi-tenant SaaS deployments;
• Staff confidentiality obligations and ongoing data protection training;
• Business continuity and disaster recovery planning.

We continually review and improve our security posture in line with evolving threats and industry best practice.

16. Personal Data Breach Notification

Caasaa maintains an incident response process to detect, investigate, and respond to personal data breaches.

• Where we act as Controller and a breach is likely to result in a risk to individuals' rights and freedoms, we will notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it.
• Where a breach is likely to result in a high risk to individuals, we will also notify the affected data subjects without undue delay.
• Where we act as Processor, we will notify the affected Controller(s) without undue delay after becoming aware of a breach, and assist them in meeting their notification obligations.

17. Right to Lodge a Complaint

If you believe that our processing of your personal data infringes the GDPR, you have the right to lodge a complaint with a supervisory authority, in particular in the EU/EEA Member State or UK region of your habitual residence, place of work, or the place of the alleged infringement.

We would, however, appreciate the opportunity to address your concerns before you approach a supervisory authority. Please contact our Data Protection Officer first at privacy@caasaa.com and we will do our best to resolve the matter.

18. Changes to This GDPR Notice and Contact

We may update this GDPR Notice from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes, we will update the "Last Updated" date at the top of this page and, where appropriate, provide additional notice (such as a website banner or email).

We encourage you to review this Notice periodically to stay informed about how we protect your personal data. Your continued use of Caasaa's services after any update constitutes acknowledgement of the revised Notice, to the extent permitted by law.

This GDPR Notice should be read together with our Privacy Policy and Cookie Policy.