PRIVACY POLICY

Introduction

Your privacy matters to us. This Privacy Policy explains how Eventila Technologies Private Limited and Spyne AI Inc. (together, "Spyne", "we", "us", or "our") collect, use, share, and protect your personal information when you use our website (www.spyne.ai), our AI-powered image processing and editing platform, the Converse AI automated calling agent, and all related services (collectively, the "Services").

This Privacy Policy also describes your choices and rights regarding your personal information. If you do not agree with this Privacy Policy, do not access or use the Services.

This policy should be read alongside our Terms of Service and, where applicable, our Data Processing Addendum. All capitalized terms not defined herein have the meanings assigned in the Terms of Service.

1. Scope and Application

This Privacy Policy applies to all personal information processed by Spyne in connection with the Services, including information collected from:

• Visitors to www.spyne.ai
• Registered customers and account holders
• End users of the Converse AI platform
• Individuals who contact us for support, sales, or other inquiries

This Privacy Policy does not apply to information Spyne processes solely as a data processor or service provider on behalf of its customers. When acting as a processor, Spyne handles personal data according to the instructions of the customer (the controller). For details on how a specific customer uses your information, please contact that customer directly.

2. Information We Collect

2.1 Information You Provide Directly

Account and Registration Information

When you register for an account or complete our online registration form, we collect: full name, business email address, company name, job title, billing contact information, and account credentials (username and password).

Payment and Billing Information

When you subscribe to paid Services, we collect billing details including name, billing address, and payment card information. Payment card data is handled by our third-party payment processors and is not stored on Spyne’s servers.

Customer-Uploaded Content

The Services allow you to upload images, vehicle photographs, voice recordings, call transcripts, and other materials (“Customer Data”). You retain all ownership rights to Customer Data. Spyne processes it solely to provide and improve the Services.

Support and Communications

If you contact us for support or with inquiries, we collect the information you provide, such as contact details, a description of your issue, and any attachments or screenshots you share.

Converse AI Calling Service Data

When you use or configure the Converse AI automated calling agent, we collect: caller and recipient phone numbers, call metadata (time, duration, direction), call recordings (where you have obtained required consents), voice transcripts, and interaction logs.

2.2 Information We Collect Automatically

Usage Data

We automatically collect information about how you interact with the Services, including features accessed, actions taken, pages viewed, links clicked, search queries, and session duration.

Device and Technical Information

We collect device identifiers, IP address, browser type and version, operating system, referring URLs, and crash or diagnostic data when you access the Services.

Cookies and Tracking Technologies

Spyne and our third-party partners use cookies, web beacons, pixel tags, and similar tracking technologies to operate the Services, remember your preferences, analyze usage, and deliver relevant advertising. You can manage cookie preferences through your browser settings or as described in our Cookie Policy at www.spyne.ai/cookie-policy.

2.3 Information From Third Parties

We may receive information about you from the following sources:

• CRM and dealer management systems (DMS) you connect to the Converse AI platform
• Third-party authentication providers (e.g., Google or Microsoft SSO)
• Analytics and advertising partners
• Public business databases and social media platforms, for sales and marketing purposes

3. How We Use Your Information

How we use your information depends on the Services you use and how you use them. We use personal information for the following purposes:

Purpose	Description
Provide and operate the Services	To authenticate users, process transactions, deliver core platform features (including AI image processing and the Converse AI calling agent), and provide customer support.
Personalize your experience	To tailor content, recommendations, and communications based on your usage patterns and preferences.
Improve and develop Services	To analyze usage trends, troubleshoot issues, train and fine-tune AI/ML models using anonymized data, and develop new features.
Communicate with you	To send transactional emails, subscription updates, product announcements, and support responses.
Marketing and promotional activities	To send promotional communications and display targeted advertising for Spyne Services, subject to your opt-out preferences.
Safety and security	To detect, prevent, and respond to fraud, unauthorized access, abuse, and security incidents.
Legal compliance	To comply with applicable laws, regulatory obligations, court orders, and to enforce our Terms of Service.
AI model improvement	To use anonymized and aggregated Customer Data to improve Spyne’s AI models, provided such data cannot identify you or your organization. We will not use Customer Data to train general-purpose models shared with third parties without prior written consent.

4. How We Share Your Information

We do not sell your personal information. Mobile phone numbers and text message opt-in consent are not shared with third parties or affiliates for marketing or promotional purposes. We share information only in the following circumstances:

4.1 Service Providers

We engage third-party vendors and service providers to perform functions on our behalf, including cloud hosting, payment processing, analytics, marketing automation, and customer support tooling. These providers access personal information only as necessary to perform their services and are contractually bound to protect it.

4.2 Integrated Third-Party Systems

If you connect the Converse AI platform to third-party systems such as a CRM or DMS (e.g., Salesforce, CDK, Reynolds & Reynolds, or Tekion), information about your interactions may be shared with those systems as directed by you. Spyne is not responsible for how those third parties handle your data.

4.3 Business Transfers

If Spyne undergoes a merger, acquisition, sale of assets, or reorganization, your information may be transferred as part of that transaction. We will notify you via email or a prominent notice on the Services prior to your information being subject to a different privacy policy.

4.4 Legal Obligations and Protection of Rights

We may disclose your information when required to do so by law, court order, or regulatory authority, or when we believe disclosure is reasonably necessary to: (a) comply with applicable legal obligations; (b) protect our legal rights or interests; (c) prevent fraud, security incidents, or illegal activity; or (d) protect the safety of any person.

4.5 With Your Consent

We may share your information with third parties for other purposes with your express prior consent.

4.6 Aggregated or De-Identified Data

We may share aggregated or de-identified information that cannot reasonably be used to identify you for industry research, analytics, and marketing purposes.

5. Call Recording and Consent (Converse AI)

The Converse AI platform may record voice interactions. As the customer using this feature, you are solely responsible for:

• Obtaining all legally required consents from called parties prior to recording any conversation, in compliance with applicable law (including all-party consent requirements in jurisdictions such as California, Florida, and others in the US, and applicable Indian law);
• Providing required disclosures to called parties at the commencement of any recorded call; and
• Maintaining records of all consents for the period required by law.

Spyne may retain call recordings for a limited period solely for the purpose of providing and improving the Services. Customers may request deletion of recordings in accordance with applicable data protection law.

6. Data Storage and Security

6.1 Storage and Infrastructure

Spyne stores and processes Customer Data on cloud infrastructure operated by trusted third-party providers. Data may be stored in India, the United States, or other jurisdictions depending on the applicable entity and infrastructure configuration.

6.2 Security Measures

Spyne implements and maintains reasonable technical and organizational security measures designed to protect Customer Data against unauthorized access, loss, disclosure, and destruction. These measures include:

• Encryption of data in transit (TLS) and at rest
• Role-based access controls and authentication requirements
• Periodic security reviews and vulnerability assessments
• Incident response procedures

Spyne is ISO 27001 certified, SOC 2 compliant, and GDPR-aligned. You can review our security posture at trust.spyne.ai.

6.3 Breach Notification

Spyne will promptly notify affected customers upon becoming aware of any personal data breach affecting Customer Data, in accordance with applicable breach notification laws including the DPDPA (India), applicable US state laws, and GDPR where applicable.

7. Data Retention

We retain personal information for as long as your account is active, as necessary to provide the Services, and as required by applicable law. Specific retention practices include:

Data Type	Retention Period
Account information	Duration of account activity plus a reasonable period thereafter to support re-activation or legal compliance.
Customer-uploaded content	As long as your account is active or as directed by you upon termination (subject to applicable legal holds).
Call recordings and transcripts	As specified in your Order Form or applicable SLA; available for export upon request prior to deletion.
Marketing preferences	Until you withdraw consent or opt out, plus a reasonable period thereafter.
Billing and payment records	As required by applicable tax and financial regulation (typically 7 years in India, up to 7 years in the US).

After the applicable retention period, we will delete or de-identify your information. Where deletion is not immediately possible (e.g., due to backup archives), we will securely isolate the data until deletion is practicable.

8. Your Rights and Choices

Depending on your jurisdiction, you may have the following rights with respect to your personal information:

8.1 Universal Rights

• Access: Request a copy of the personal information we hold about you.
• Correction: Request that we correct inaccurate or incomplete information.
• Deletion: Request deletion of your personal information, subject to legal obligations.
• Restriction: Request that we limit our processing of your information in certain circumstances.
• Portability: Request your data in a structured, machine-readable format.
• Objection: Object to our use of your information for marketing purposes.
• Withdraw consent: Where processing is based on consent, withdraw it at any time without affecting prior lawful processing.

8.2 Additional US Rights (CCPA/CPRA and State Laws)

If you are a California resident or resident of another US state with applicable privacy law (including Virginia, Colorado, Connecticut, or Texas), you additionally have the right to:

• Opt out of the “sale” or “sharing” of your personal information;
• Opt out of targeted advertising;
• Not be discriminated against for exercising your rights; and
• Designate an authorized agent to submit requests on your behalf.

Spyne does not knowingly sell or share the personal information of consumers under 16 years of age.

8.3 Additional India Rights (DPDPA 2023)

If you are a Data Principal under the Digital Personal Data Protection Act, 2023 (DPDPA), you have the right to:

• Obtain information about the personal data being processed and the purposes thereof;
• Correct and update your personal data;
• Erase your personal data, subject to applicable legal retention requirements;
• Nominate a representative to exercise your rights in the event of death or incapacity; and
• Raise a grievance with Spyne and, if unresolved, with the Data Protection Board of India.

8.4 EEA and UK Rights (GDPR / UK GDPR)

If you are located in the European Economic Area or the United Kingdom, you have rights under GDPR or UK GDPR including the right to lodge a complaint with your local supervisory authority.

8.5 How to Exercise Your Rights

To exercise any of the above rights, please contact us at legal@spyne.ai. We will respond within the timeframes required by applicable law (generally 30 days, extendable in complex cases). We may request additional information to verify your identity before processing your request.

8.6 Opt-Out of Marketing Communications

You may opt out of receiving promotional emails from us at any time by clicking the unsubscribe link in any marketing email or by contacting us at legal@spyne.ai. Note that you will continue to receive transactional communications related to your account.

9. Regional Data Protection Disclosures

9.1 India — Digital Personal Data Protection Act, 2023 (DPDPA)

Eventila Technologies Private Limited acts as the Data Fiduciary for personal data of Indian individuals processed through the Services. Spyne processes such data in accordance with the DPDPA and its Privacy Policy. Where Spyne processes personal data on behalf of a customer, the customer acts as the Data Fiduciary and Spyne acts as a Data Processor solely for the purpose of providing the Services.

To raise a grievance regarding data protection, please contact our Grievance Officer at legal@spyne.ai. Unresolved grievances may be escalated to the Data Protection Board of India once operational.

9.2 United States — CCPA/CPRA and State Privacy Laws

Spyne AI Inc. acts as the relevant entity for personal data of US individuals. Where Spyne processes personal information on behalf of a California-based customer, Spyne acts as a “service provider” under the CCPA/CPRA and does not sell or share such personal information except as directed by the customer or as necessary to provide the Services.

Categories of personal information collected in the preceding 12 months include: identifiers (name, email, IP address), commercial information (billing records), internet activity data, professional/employment information, geolocation data, and inferences drawn from usage. We do not collect sensitive personal information beyond account credentials. For details on recipients of disclosed information and opt-out rights, see Sections 4 and 8 above.

9.3 European Economic Area and United Kingdom — GDPR / UK GDPR

Where Spyne processes personal data of EEA or UK individuals, it does so on the following legal bases: (a) performance of a contract (to provide the Services); (b) legitimate interests (service improvement, security, marketing subject to your right to object); (c) compliance with a legal obligation; and (d) consent (where expressly obtained).

International transfers of personal data outside the EEA or UK are governed by appropriate safeguards, including standard contractual clauses approved by the European Commission. To exercise your GDPR rights or lodge a complaint, contact legal@spyne.ai.

9.4 International Transfers

Spyne may transfer personal data across borders to provide the Services. We take steps to ensure that any such transfers comply with applicable data transfer requirements, including the use of standard contractual clauses, data transfer agreements, or other recognized mechanisms.

10. Children’s Privacy

The Services are not directed to or intended for use by children under the age of 18 (or the applicable age of majority in your jurisdiction). We do not knowingly collect personal information from minors. If you believe we have inadvertently collected such information, please contact us at legal@spyne.ai and we will promptly delete it.

11. Third-Party Links and Services

The Services may contain links to third-party websites, integrations, or services. This Privacy Policy does not apply to those third parties. We encourage you to review the privacy policies of any third-party services you access through the Services. Spyne is not responsible for the privacy practices of third-party services.

12. Cookies and Tracking

Spyne uses cookies and similar tracking technologies on its websites and platform for the following purposes:

• Essential cookies: Required for the Services to function (authentication, session management, security).
• Analytical cookies: To understand how users interact with the Services and to improve them.
• Marketing cookies: To deliver relevant advertising and measure campaign effectiveness.

You can manage your cookie preferences through your browser settings or our cookie consent tool. Note that disabling certain cookies may affect the functionality of the Services. For full details, please review our Cookie Policy at www.spyne.ai/cookie-policy.

13. Data Processing Addendum

Where required by applicable law (including GDPR, DPDPA, or US state privacy laws), Spyne offers a Data Processing Addendum (DPA) that governs the processing of personal data on behalf of customers. The DPA is available at www.spyne.ai/legal/dpa. In the event of any conflict between the DPA and this Privacy Policy with respect to the processing of personal data, the DPA shall prevail.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. If we make material changes, we will provide notice by posting the updated policy on our website and, where required or appropriate, by notifying you by email. We encourage you to review this Privacy Policy periodically.

Your continued use of the Services after the effective date of an updated Privacy Policy constitutes your acceptance of the changes. If you do not agree with any changes, you must stop using the Services and may request deletion of your account in accordance with Section 8.

15. How to Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

General Inquiries	info@spyne.ai
Privacy / Legal	legal@spyne.ai
India Office	Eventila Technologies Private Limited | Unit No. 102, First Floor, Bestech Business Tower, Sector 48, Sohna Road, Gurugram, Haryana 122018, India | CIN: U72100DL2015PTC281740
US Office	Spyne AI Inc. | 3524 Silverside Rd, Suite 35b, Wilmington, DE 19810, USA | EIN: 37-2061208

16. Text Messaging Terms

How you opt in. Spyne sends text messages only to people who have agreed to receive them, in one of these ways:

1. Web forms: by submitting a form on spyne.ai (such as a demo request) with your phone number, you accept our Terms of Service, including receiving calls and text messages from Spyne at that number about your request and account;
2. Customer agreements: by signing an order form or agreement with Spyne that incorporates our Terms of Service, the customer agrees that Spyne may call and text the customer’s designated contacts about onboarding, support and account matters;
3. On a call: before sending a text, a Spyne representative will ask: “Is it okay if I text you the details at this number? Message frequency varies, message and data rates may apply, and you can reply STOP at any time to opt out.”

The first message you receive confirms your opt-in. Consent is not a condition of purchase.

What we send. Messages about demos, onboarding, support and account matters. Message frequency varies. Message and data rates may apply.

Opting out and help. Reply STOP to cancel at any time; you will receive one confirmation message and no further texts. Reply HELP, or contact info@spyne.ai, for help. Opting out of text messages does not cancel any subscription or terminate any Order Form; those requests must follow Section 6.3 of our Terms of Service.

Scope. This section covers text messages Spyne sends on its own behalf. It does not change a customer’s responsibilities under Section 2.2.2 of our Terms of Service for messages the customer sends to its own contacts using the Services.

Carriers are not liable for delayed or undelivered messages.