enlytical.ai — operated by Nuvoretail Enlytical Technologies Private Limited

Effective date: August 2026 | Version: 1.0 | Last updated: September 2026

In short: We provide a business SaaS platform. We collect the account, billing and usage data needed to run it, and we process the marketplace and advertising data you connect in order to deliver the Services. We use only de-identified / aggregated data to improve our models. We do not sell your personal data. You can access, correct, erase and export your data and withdraw consent by contacting us. This Policy is written to meet India’s Digital Personal Data Protection Act, 2023 and is ready for the GDPR and US state privacy laws as we expand.

This Privacy Policy explains how Nuvoretail Enlytical Technologies Private Limited (“Company“, “we“, “us“, “our“) collects, uses, shares and protects personal data in connection with the enlytical.ai platform, the website at app.enlytical.ai, and related applications, APIs and services (together, the “Services” or the “Platform“). It applies to account holders, Authorised Users, agency users and website visitors. Capitalised terms not defined here have the meaning given in our Terms and Conditions of Use (the “Terms“), into which this Policy is incorporated by reference.

1. Our role: when we are a Data Fiduciary and when we are a Data Processor

• When we handle your Account, billing and usage data, and website-visitor data, we determine the purposes and means of processing and act as a Data Fiduciary (a “controller” under the GDPR).

• When we process data from your Connected Accounts (for example, your marketplace seller, vendor and advertising data) to provide the Services, we act as a Data Processor on your behalf. You are the Data Fiduciary for that data and are responsible for having a valid legal basis (including any consent or notice) to provide it to us and to authorise our processing.

Most Connected Account data is commercial rather than personal data. This Policy applies to the extent any such data is personal data.

2. Personal data we collect

3. Why we use personal data, and our legal basis

The DPDP Act, 2023 is primarily consent-based and also permits processing for certain specified legitimate uses; it does not contain a broad “legitimate interests” ground of the kind found in the GDPR. We rely on the bases below.

4. AI processing

• To provide the Services to you, we process the inputs you provide and the data you connect — including prompts, brand information, brand guidelines, brand assets, product information and connected-account data — to generate audits, recommendations, insights, campaign settings, content, images and reports (AI Output) for you. The context used to generate AI Output such as brand images is typically brand and business information, not personal data.

• To develop, train, benchmark and improve our models and the Services, we use only de-identified and aggregated data. We do not use your identifiable data to generate AI Output for other customers.

• Where an AI feature uses a third-party AI model or service, the inputs required to provide that feature may be shared with that provider. We engage such providers under terms that require them to keep your data confidential and not to use it to train their own models [Company to confirm this is contractually true of each AI provider].

• We do not sell personal data, and we do not make solely automated decisions producing legal or similarly significant effects on you without a lawful basis and appropriate safeguards. Automated actions we take on your Connected Accounts are carried out on your instruction and configuration, as described in the Terms.

5. How we share personal data

We share personal data only as needed, and with appropriate safeguards:

• Sub-processors / service providers — cloud hosting and infrastructure, AI model providers, analytics, communications/email, and payment processors, each under contractual confidentiality and data-protection obligations. A current list of sub-processor categories is available on request at privacy@enlytical.ai.

• Connected Services / marketplaces — to the extent required to operate the API integrations you authorise.

• Legal and corporate — to comply with law, enforce our Terms, protect rights and safety, or in connection with a merger, acquisition, financing or sale of assets (subject to this Policy).

• We do not sell your personal data and do not share it for third-party cross-context behavioural advertising.

6. International transfers

• We may process and store data in India and in other countries where we or our sub-processors operate.

• Under the DPDP Act, transfers of personal data outside India are permitted except to any country or territory restricted by the Central Government; we comply with any such restriction in force.

• For personal data protected by the GDPR and transferred out of the EEA/UK, we rely on an adequacy decision or the European Commission’s Standard Contractual Clauses (with the UK Addendum where relevant), together with appropriate supplementary measures.

7. Retention

• We keep personal data for as long as your Account is active and as needed to provide the Services.

• After termination, User Data is retained for a [30]-day export window and then deleted or de-identified, except where we must retain records to meet legal, tax, accounting, dispute-resolution or security obligations.

• Certain limited data — including identifiers such as your account email address and user name where they form part of security logs, audit trails and action histories — may be retained after Account deletion to preserve the integrity of those logs and to meet security, fraud-prevention, legal, tax and accounting obligations. We retain such data only for as long as, and for the purposes for which, it is required.

• De-identified and aggregated data, which is not personal data, may be retained indefinitely.

8. Security

We implement reasonable technical and organisational security safeguards appropriate to the risk, which include encryption of data in transit and at rest, access controls on a least-privilege basis, network protections, logging and monitoring, backups, and due diligence on sub-processors. No system is fully secure and we cannot guarantee absolute security. In the event of a reportable personal-data breach, we will notify the affected persons and the Data Protection Board of India (and, where applicable, the relevant GDPR supervisory authority) in the manner and within the timelines required by law.

9. Your rights

9.1 Under India’s DPDP Act, 2023

• Access a summary of the personal data we process about you and our processing activities;

• Correction, completion, updating and erasure of your personal data (erasure is subject to data we are required or permitted to retain — see section 7, Retention);

• Grievance redressal through our Grievance Officer;

• Nominate another individual to exercise your rights in the event of your death or incapacity;

• Withdraw consent at any time, as easily as it was given (this does not affect processing carried out before withdrawal); and

• Make a complaint to the Data Protection Board of India.

9.2 Under the GDPR (for EEA/UK individuals)

• Access, rectification, erasure, restriction of processing, data portability, and objection;

• Withdraw consent; and lodge a complaint with your supervisory authority.

9.3 For United States residents (including California — CCPA/CPRA)

Where US state privacy laws apply as we expand, you may have the right to know/access, delete, and correct your personal information, to opt out of any “sale” or “sharing” and of targeted advertising, to limit the use of sensitive personal information, and to be free from discrimination for exercising these rights. We do not sell or share personal information as those terms are defined under the CCPA/CPRA.

9.4 Other regions

Where the laws of your jurisdiction (for example, in the Middle East) grant additional rights, we will honour them to the extent they apply.

10. How to exercise your rights

To exercise any right, or to withdraw consent, contact us at privacy@enlytical.ai (or the Grievance Officer at grievance@enlytical.ai). We will respond within the timelines required by applicable law and may need to verify your identity before acting. If you access the Platform under an organisation’s Account, we may direct your request to that organisation, which is the Data Fiduciary for that data. Some rights, including erasure, are subject to limited exceptions — for example, data we must keep in our audit trails and logs or to comply with law (see section 7).

11. Cookies

We use cookies and similar technologies as described in our Cookie Policy. You can manage non-essential cookies through our consent banner and your browser settings.

12. Children

The Services are intended for business and commercial use and are not directed to children. We do not knowingly process children’s personal data. Under the DPDP Act, a “child” is an individual under 18 years of age; where its provisions on children apply, we will obtain verifiable consent of a parent or lawful guardian as required, and will not undertake tracking, behavioural monitoring or targeted advertising directed at children, or any processing likely to cause a detrimental effect on a child.

13. Contact, Grievance Officer and Data Protection Officer

We will appoint a Data Protection Officer and an EU/UK representative if and when required — for example, if we are notified as a Significant Data Fiduciary, or before an EU/UK launch.

14. Changes to this Policy

We may update this Policy from time to time. We will post the updated version with a new effective date and, for material changes, provide additional notice (for example, by email or in-Platform notice). Continued use of the Services after the effective date constitutes acceptance of the updated Policy.

15. Language

This Policy is published in English. On request, we will make the information in this notice available in any language specified in the Eighth Schedule to the Constitution of India, as contemplated by the DPDP Act.