Last updated on March 18th, 2026.

Welcome to the privacy policy of Balaji Apex Technologies Pvt. Ltd. ("Balaji Apex Technologies," "we," "us," or "our"). We are committed to safeguarding your personal information and respecting your privacy rights (as a "Data Principal") when you use our AtithiAI platform and related services.

This Privacy Policy explains how we collect, use, and share your personal information when you use our AtithiAI platform, including our website, application, AI agents, and related services (collectively, our "Services"). **Balaji Apex Technologies acts as a Data Fiduciary** with respect to the personal data we process.

For the purposes of this policy, "User" refers to property managers or hosts who register and use our Services, and "Guest" refers to individuals who interact with our AI agents. The User and Guest are collectively referred to as the "Data Principal" in the context of the Digital Personal Data Protection Act, 2023 (DPDPA).

1. Legal Basis for Processing and Consent

We process your personal data based on the principles of the Digital Personal Data Protection Act, 2023 (DPDPA). We will process your data either with your Consent or for a defined Legitimate Use as permitted under the DPDPA.

Consent: Where processing is based on consent, it will be free, specific, informed, unconditional, and unambiguous with a clear affirmative action. You may withdraw your consent at any time, subject to the process detailed in Section 4.

2. Information We Collect (Types of Personal Data)

We collect personal information in various ways, including when you provide it directly to us, when we obtain it from third parties, and passively through technology.

2.1 Information You Provide Directly to Us

• When Users register for an account: Name, email address, phone number.

• When Users add property details: Property name, address, description, and operational instructions.

• When Users add Guest details: Guest name, primary contact number, check-in, and check-out dates.

• When Guests interact with our AI agents: The content of conversations (messages sent by Guests and responses from the AI), including any personal information Guests choose to share within these conversations.

2.2 Information We Collect Passively

• Web Browser Cookies and Technologies: Usage data, IP addresses, geographical location, browser, and operating system details. You may choose to set your web browser to refuse cookies, but note that some parts of the Services may not function properly.

• Usage Data: We process data about your use of our website and services to help us analyze and improve our Services.

• Communication Platform Data: Message timestamps, delivery status, and the Guest's profile name (if available). Location data may be collected if explicitly shared by the Guest via the communication platform.

2.3 Information We Collect from Third Parties (Data Processors)

We receive and share information about Data Principals with third-party service providers who act as Data Processors under the DPDPA. This includes:

• Authentication and User Management Services: When you sign in using Google Auth, we collect your name, email address, and profile picture URL as provided by the Google OAuth service to create and authenticate your account.

• Cloud Data Storage Services: Storage of the data you provide to us.

• Digital Messaging Platform Providers: Facilitation of communication with Guests.

• Artificial Intelligence and Machine Learning Providers: Services used to process guest queries, understand context, and generate personalized responses based on the property information and conversation history.

3. How We Use Your Information (Purpose Limitation)

We collect and use your personal data strictly for the specified purposes for which it was collected:

• To Provide and Maintain Services: To deliver automated guest communication, manage properties and guests, and facilitate conversations.

• To Personalize AI Responses: To personalize the AI's responses to Guests based on their conversation history and relevant property information (this requires sharing the data mentioned in 2.1).

• To Track Usage: To monitor usage and ensure service delivery.

• To Process Payments: To process payments for our Services (if applicable).

• To Improve Services: To analyze usage patterns, troubleshoot issues, and enhance the performance and functionality of our Services and AI agents.

• For Communication: To respond to your inquiries, provide customer support, and send administrative information, service updates, and relevant notifications.

• For Legal Compliance and Protection: To establish, exercise, or defend legal claims, and comply with legal obligations, including those under the IT Act, 2000, and DPDPA, 2023.

• For Analytics and Measurement: To understand how our services are used and for ensuring that our services are working as intended.

4. Your Rights and Duties (As a Data Principal under DPDPA)

As a Data Principal, you have the following rights over your personal data:

• Right to Access Information: The right to obtain a summary of the personal data being processed.

• Right to Correction and Erasure: The right to request the correction or completion of your personal data, or the erasure of your personal data when the purpose of collection is no longer being served (Right to be Forgotten).

• Right of Grievance Redressal: The right to have a readily available and effective mechanism for the redressal of your grievances concerning our compliance with this Policy and the DPDPA (See Section 8, Contact Us).

• Right to Nominate: The right to nominate an individual who will exercise your rights in the event of your death or incapacity.

• Right to Withdraw Consent: The right to withdraw your consent at any time, provided the withdrawal is clear and easily accessible. Withdrawal of consent will not affect the lawfulness of processing based on consent before its withdrawal.

Duties of Data Principal: You have the duty to comply with the provisions of the DPDPA, including the duty not to register a false or frivolous grievance and not to furnish any false particulars or impersonate another person.

5. Sharing Your Personal Information and Cross-Border Transfer

We do not sell your personal information. We may share your data with trusted third-party service providers who assist in operating our Services.

• Third-Party Service Providers (Data Processors): We share information with service providers (listed in Section 2.3) who process data on our behalf. These third parties are contractually obligated to protect your information and act in compliance with the DPDPA.

• AI Model Providers: To facilitate the core function of AtithiAI (virtual host support), we share the content of Guest conversations and relevant property details with our AI Model Providers for the sole purpose of generating personalized and relevant responses. We limit the data shared to the minimum necessary for the provision of the Service.

• Cross-Border Transfer: Your personal data may be transferred, stored, and processed in locations outside India, including to our third-party data processors. By using our Services, you consent to this transfer, provided that such transfers comply with the provisions of the DPDPA regarding transfers to countries not restricted by the Central Government of India.

• Legal Compliance: We may disclose your information to comply with any applicable Indian law, regulation, legal process, or governmental request (including requests from the Data Protection Board of India or law enforcement agencies), or to protect the security or integrity of AtithiAI's Services.

• Google Compliance: AtithiAI's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.

6. Security, Data Retention, and Accuracy

We implement appropriate administrative, technical, and physical measures to protect your information, including encryption and access controls, to meet the reasonable security safeguards required under the DPDPA and the IT Act, 2000.

• Data Accuracy: As a Data Fiduciary, we shall make reasonable efforts to ensure that the personal data processed is complete, accurate, and consistent, particularly when it is used to make decisions concerning a Data Principal or is shared with another Data Fiduciary.

• Data Retention: We cease to retain personal data as soon as it is reasonable to assume that the purpose for which the data was collected is no longer being served, and retention is no longer necessary for legal or business purposes. Your data will be deleted upon withdrawal of consent, unless retention is required by law.

• Data Usage: To improve our AI responses, authorized personnel may occasionally review de-identified conversation logs. We do not use personal data of guests to train foundation models.

7. Children's Privacy

Our Services are intended for Users (property managers/hosts) who are adults. Our Services are not directed to individuals under **18 years of age** (the age of majority under DPDPA). We do not knowingly collect Personal Information from children under 18. If we become aware that a child under 18 has provided us with Personal Information, we will take steps to delete such information. If you believe that a child under 18 may have provided us Personal Information, please contact us at [email protected].

8. Grievance Redressal and Contact Us

If you have any questions, concerns, or wish to exercise your rights as a Data Principal, please contact our designated **Grievance Officer** using the details below. We are committed to acknowledging your complaint promptly and resolving it in a timely manner.

9. Changes to this Privacy Policy

We reserve the right to update this Privacy Policy from time to time. We will notify you of significant changes by posting the revised Privacy Policy on our website or through email communication, and indicate when such changes will become effective.