Axonwise Private Limited
Privacy Policy

Axonwise Private Limited (doing business as Sarvam.AI) is the Data Fiduciary under DPDPA 2023.

Our Commitments

• Process personal data only with informed consent or under legitimate uses;
• Implement appropriate technical and organisational measures;
• Maintain transparency in data processing activities;
• Facilitate the exercise of your rights as Data Principal.

Compliance Certifications

• ISO 27001:2022
• SOC 2 Type II
• Significant Data Fiduciary as notified under DPDPA Section 10

Contact Details

Registered Office: Sarvam AI, 2nd Floor, 732 Urban Vault, Indiranagar, Bangalore 560038, Karnataka, India.

Email: legal@sarvam.ai; saurabh@sarvam.ai

Personal Data

In order to access/use the Offerings, upon expressly consenting, you may be required to provide certain personal data, such as:

• First and last names
• Location (unless disabled by accessing Device settings)
• Email address
• Residential and/or workplace address
• Mobile number, postal code, etc.

Product Usage Data

When you use our Product, we collect the information provided by you which includes your inputs, file uploads, and outputs generated by the Product.

Automatic Data

We may also automatically receive, collect, store and process certain data sourced by your usage of the Offerings, including:

• IP address assigned to the Device used by the User;
• Type of browser used by the User;
• The domain server through which the User accesses the Offerings;
• Queries, comments, or feedback as submitted by the User;
• The type/model/make of device used by the User ("Device").

Enhanced Access (With Permission)

We may seek and receive one-time or continuous access to:

• Location data (GPS, IP address, cell tower/Device location);
• Device data and your usage thereof;
• Camera access to scan/capture/upload documents and/or photographs;
• Microphone permissions;
• Any other files and media.

A user may, at any time, revoke access to the aforesaid data through the Device settings.

Sources of Personal Data

• Submitted by yourself, through our Offerings or by contacting/emailing our official contact;
• Shared with or by any of our employees and affiliates;
• Our sales or marketing representatives (including third party representatives), vendors, suppliers and service providers;
• Sourced from public websites and social media, including your publicly accessible profiles; and
• Sourced via cookies and similar tracking technologies as deployed on our Offerings.

Sensitive Personal Data

We do NOT knowingly collect sensitive data except:

• Voice biometric data for Content Studio (with consent);
• Financial transaction data (processed by certified payment gateways, not stored by us).

We do not sell your data to any third party.

Consent

Free, specific, informed, unconditional, unambiguous consent obtained from the Data Principal.

Legitimate Uses

• Performance of contract;
• Compliance with law;
• Medical emergency;
• Employment and safeguards;
• Reasonable purposes as prescribed under applicable law.

Purpose Limitation

Personal data is processed only for the specific purposes for which consent was obtained.

We may use your personal data for the following purposes:

• To provide a meaningful user experience, better usability, troubleshooting and maintenance of our Offerings;
• To develop and improve our existing Offerings and such other aspects we deem necessary;
• To develop new products, user experience, services, etc.;
• For compliance and undertaking of the purchase orders/contract for our products, items or services;
• To understand when and which parts of our Offerings are most visited and their frequency;
• To identify a User;
• To communicate with a User, including contacting and responding to queries or requests;
• To communicate special offers and general information about our products, services and events which may be similar to those that you have already purchased or enquired about, unless the User has opted not to receive such communication;
• To offer tailored content based on Users' preferences;
• To enhance and optimize our company operations, systems, security and processes;
• To enable marketing and sales related communications and related purposes;
• To protect and defend the rights or property of Sarvam;
• To protect the personal safety of Users of our Offerings and/or the general public;
• To protect against or defend any legal liability; and
• In order to be compliant with applicable law or to honor back-to-back obligations we may have with any other third party in relation to our Offerings.

• We will not use User data for any purpose other than in connection with Offerings. You understand that we may share the User data with required third parties in connection with our Offerings as may be required and you explicitly agree to such User data being shared.
• We may use third party vendors, service providers, including logistic service providers, payment gateway service providers, maintenance service providers, etc. to help us better provide our Offerings to you, to whom we may have to disclose your personal data. Where we use third-party tools, these third parties will have access to some of your personal data, including analytics tools.
• When accessing/using the Offerings, in the event you are directed to a third party website or application, and if you choose to access them, we will not be responsible for any such third-party websites or applications. Sarvam will not disclose any of the User's personally identifiable data to third parties, save when required under applicable law.
• If all or some of the business, stock or assets of Sarvam are acquired or merged with another business entity, we may share all or some of your data with the acquiring/merged entity.

• This Privacy Policy is governed by your rights as per applicable law within the territory from where you access our Offerings.
• You shall also be provided with an option to:
  • Provide or deny consent for use of the data collected;
  • Restrict disclosure to third parties;
  • Data retention preferences;
  • Data rectification;
  • Revoke consent already granted to collect data;
  • Request deletion or anonymization of the data collected by us.
  However, in the event of the foregoing, please note that we may not be able to provide all our Offerings efficiently to you.
• To the extent applicable under applicable law, you can exercise your rights by submitting a request to the grievance officer.

Default Policy: Opt-Out. We do NOT use Your Content to train AI models unless you explicitly opt-in.

What We May Use (With Opt-In)

• De-identified usage patterns;
• Error logs (identifiers removed);
• Explicitly labeled training data.

Your Rights

• Check opt-in/opt-out status at any time;
• Withdraw consent for training data use at any time;
• Request deletion of contributed training data.

Automated Decision-Making

We do NOT use automated decision-making that produces legal or similarly significant effects on individuals without human review.

• Voice samples are processed solely for the requested services;
• Audit logs are maintained for 3 years post-deletion;
• You must obtain consent from individuals whose voice you clone;
• Automated filters are in place for misuse detection;
• You retain all rights to cloned voice models;
• AI synthesis metadata tagging is applied where feasible;
• You are responsible for disclosing AI-generated content to end users.

Our Offerings utilise:

• Large language models;
• Speech synthesis systems;
• Voice encoders.

These systems are trained on diverse datasets. Outputs are probabilistic and may contain inaccuracies or biases. We employ continuous monitoring and bias mitigation techniques.

Limitations

• Outputs may be inaccurate or incomplete;
• Outputs are not guaranteed to be unique;
• Human review is recommended for critical applications.

Where applicable, we attach the following to AI-generated content:

• Indicators/labels of synthetic generation;
• Persistent unique identifiers;
• Timestamps, file/asset identifiers, and integrity signals.

Purposes

• Regulatory compliance;
• Identification and attribution;
• Abuse prevention;
• Security;
• User reports and dispute resolution.

Anti-Tampering

We do not enable removal of SGI labels or provenance metadata. Retention of SGI metadata is governed by the Data Retention section below.

Right to Access

You have the right to obtain confirmation of whether your personal data is being processed, a summary of your personal data, and details of entities with whom your data has been shared.

Right to Correction & Erasure

You may request correction of inaccurate or misleading personal data, completion of incomplete data, updating of personal data, and erasure of personal data that is no longer necessary.

Right to Grievance Redressal

You have the right to have readily available means of registering a grievance with the Data Fiduciary, and to have such grievance addressed within the prescribed timeframe.

Right to Nominate

In case of death or incapacity, you have the right to nominate another individual to exercise your rights as Data Principal.

Right to Consent Withdrawal

You may withdraw consent at any time with the same ease with which it was given. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Before or at the time of collecting personal data, we provide a clear, standalone notice containing:

• An itemised list of the personal data being collected;
• The specific purposes for which each category of data will be processed;
• The manner in which you may exercise your rights;
• Contact details of the Data Protection Officer.

How Consent Is Obtained

• Clear affirmative action (no pre-ticked boxes);
• Unbundled consents for distinct purposes;
• Multilingual notices where applicable.

Consent Manager integration is supported where available.

Effect of Withdrawal

• We will cease processing your personal data;
• Data will be deleted within 30 days of withdrawal;
• Withdrawal does not affect the lawfulness of past processing;
• You may lose access to certain features or Offerings.

Retention Periods

Deletion Upon Request

You may request deletion of your data via Account Settings or by emailing saurabh@sarvam.ai. Deletion will be completed within 30 days.

Automatic Deletion

• Inactive accounts (3+ years) will be scheduled for deletion with 60-day prior notice;
• Temporary data is auto-deleted based on applicable schedules.

Anonymization

Where deletion is not technically feasible, data will be irreversibly anonymized so that it can no longer be associated with any individual.

• The data provided by the User is stored in access controlled facilities with restricted access.
• User data transmitted over the internet is protected through the use of encryption, using the secure socket layer (SSL) or equivalent protocols.
• We shall use generally accepted industry standards to protect the User data submitted to us, both during transmission and upon receipt.
• No method of transmission over the Internet, or method of electronic storage, is 100% secure. Therefore, we cannot guarantee absolute security and your use of our Offerings is at your sole risk and discretion.
• The collection, usage, and sharing of User data by us shall be in compliance with applicable laws.
• If any security breach comes to our knowledge, we may take all steps required to protect misuse of such data and may attempt to notify you electronically so that you can take appropriate steps.

Transfer Destinations

• USA: AWS, GCP, Azure;
• EU: Model providers, security vendors;
• Other jurisdictions: As necessary for service delivery.

Safeguards

• Standard Contractual Clauses (SCCs);
• Adequacy Decisions;
• Contractual Obligations;
• Data Localization where required.

Data Localization (India)

The following categories of data are stored exclusively in India:

• Payment data (RBI guidelines);
• Voice biometric data;
• Critical personal data as classified under applicable law.

Your Rights

• Object to cross-border transfers;
• Request information about transfer safeguards;
• File complaints with the relevant supervisory authority.

• When you are using/accessing our Offerings, one or more cookies will be sent to the Device being used by you. The cookies are either used to improve the quality of our Offerings or for storing your preferences as a User, improving the overall User experience. You have the option of disabling cookies via your Device settings. However, if you disable cookies, some parts of our Offerings may not function as designed/intended.
• If you would like to disable our access to any passive data we receive from the use of various technologies, you may do so by disabling cookies in your web browser/Device. Please note that Sarvam may still receive data about your usage.

Our Offerings are NOT directed to individuals under the age of 18 years.

Strict Prohibitions

• No accounts for individuals under 18;
• No AI services without verifiable parental consent for minors;
• No voice cloning for individuals under 18.

Verifiable Parental Consent

Where parental consent is required, we implement age-appropriate verification methods as prescribed under applicable law.

Parent/Guardian Rights

Parents and guardians may review, request deletion, and refuse further collection of their child's personal data.

Educational Institutions

Where our Offerings are used through educational institutions, we comply with applicable educational privacy laws and institutional agreements.

Discovery of Children's Data

If we discover that personal data of a child under 18 has been collected without appropriate consent:

• Data will be deleted within 72 hours;
• The account will be terminated;
• Parents/guardians will be notified.

Data Protection Officer

Name: Saurabh Kumar Karn

Address: Sarvam AI, 2nd floor, 732 Urban Vault, CMH Road, Indiranagar, Bangalore - 560025

Email: saurabh@sarvam.ai

Business Hours: Monday–Friday, 9:00 AM – 6:00 PM IST

Response Timeline: Acknowledgment within 72 hours; Resolution within 30 days.

Grievance Process

• Step 1: Internal Complaint to Data Protection Officer;
• Step 2: Data Protection Board of India;
• Step 3: Legal Remedies under DPDPA.

European Users

You may lodge a complaint with your local Data Protection Authority or the Lead Supervisory Authority.

California Users

You may contact the California Attorney General's Office.

In the event of any dispute, difference or claim arising out of this Privacy Policy, the same shall be settled in accordance with the applicable laws in India through regular judicial process and the courts of Bengaluru, India, shall have exclusive jurisdiction.

If you are located in the European Economic Area (EEA), United Kingdom (UK), or Switzerland, the following supplemental terms apply in addition to the main Privacy Policy.

Legal Basis for Processing

Special Category Data

Where we process special category data, we do so on the basis of explicit consent per GDPR Article 9(2)(a).

Additional GDPR Rights

In addition to the rights outlined in the main Privacy Policy, you have the right to:

• Data portability (receive your data in a structured, commonly used, machine-readable format);
• Object to processing based on legitimate interests;
• Restrict processing in certain circumstances;
• Object to automated decision-making and profiling;
• Lodge a complaint with your supervisory authority.

Data Transfers

• Standard Contractual Clauses (2021 version);
• UK International Data Transfer Agreement (IDTA);
• Adequacy decisions where applicable.

Supervisory Authorities

• UK: Information Commissioner's Office (ICO)
• Switzerland: Federal Data Protection and Information Commissioner (FDPIC)

Categories of Personal Information Collected (Last 12 Months)

California Consumer Rights

• Right to Know: What personal information is collected, used, and disclosed;
• Right to Delete: Request deletion of personal information;
• Right to Correct: Request correction of inaccurate personal information;
• Right to Opt-Out: We do not sell personal information;
• Right to Limit Sensitive PI: Limit the use and disclosure of sensitive personal information;
• Right to Non-Discrimination: No penalty for exercising your rights.

Authorized Agent

You may designate an authorized agent to make requests on your behalf. We may require verification of both the agent's authority and your identity.

Verification Process

To verify your identity when exercising your rights, we may ask you to confirm information we already hold about you.

Third Parties Receiving Data

• Cloud infrastructure providers;
• Payment processors;
• Analytics providers;
• Security vendors;
• Customer support tools.

Financial Incentives

We do not offer financial incentives for the collection or retention of personal information.

"Shine the Light"

We do not disclose personal information to third parties for their direct marketing purposes.

Change Notification

We will provide at least 30 days' notice before adding or replacing a sub-processor.

Objection Process

If you have concerns about a new sub-processor, you may email saurabh@sarvam.ai within 15 days of the notification. We will work in good faith to address your concerns.