Privacy Policy

This policy explains what personal data Niyoos collects, why, who receives it, how long we keep it, how we protect it, and the rights you have. It is written to meet the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (the "SPDI Rules"), which apply today, and the Digital Personal Data Protection Act, 2023 and Rules, 2025 (the "DPDP law"), whose main obligations apply from 13 May 2027.

1. Who we are

Niyoos is operated by Loktara Ventures Private Limited (CIN U62099PB2026PTC069238), 5th Floor, F-547, 8A, Ind. Area, Sector 75, Chandigarh Sector 55, S.A.S. Nagar (Mohali), Rupnagar - 160055, Punjab ("we", "us").

Privacy contact and Grievance Officer: Varun Avhad, Chief Technology Officer · privacy@niyoos.com · grievance@niyoos.com · +91 96993 51139. This person can answer any question about how we process your personal data.

2. Two roles: whose data, whose decisions

Niyoos handles personal data in two different roles.

(a) We decide (data fiduciary). For personal data we collect to run our business, we decide why and how it is used. This covers your account and sign-in, your workspace's Members, billing and receipts, support and complaints, security records, and visits to our websites. This policy covers that data in full.

(b) Our customer decides (data processor). Our customers send their AI agents' calls through Niyoos. Those calls can contain personal data about the customer's own customers, employees or other people ("end users"). For that data the customer decides why it is processed, and we process it only on the customer's instructions, under our Data Processing Agreement. If you are an end user, the customer that runs the agent is responsible to you, and you should contact them first. Section 5 describes what Niyoos stores of that data, so that you know.

AI model providers are chosen by our customers. When a customer's agent calls an AI model provider (such as OpenAI, Anthropic or Google) through Niyoos, the request goes to the provider the customer chose, using the customer's own provider account and key. Those providers act for the customer, under the customer's contract with them, not for us.

3. Personal data we collect as a data fiduciary

Sensitive personal data. Under the SPDI Rules, passwords and payment-instrument details are sensitive personal data. We hold neither: Clerk handles sign-in, and Razorpay handles payment details. Customers store API keys for their AI model providers with us; we treat those as secret credentials (section 9).

4. Personal data we process for customers (data processor)

We do not use any of this data to train AI models, to build profiles of end users, or for advertising.

5. Who receives personal data

We do not sell personal data. We share it only as follows.

5.1 Our sub-processors, which provide parts of the service under contract with us. The current list, with locations, is on our Sub-processors page:

5.2 AI model providers chosen by a customer receive that customer's requests, on the customer's instruction (section 2).

5.3 Your own workspace. Admins and Members of a workspace can see the workspace's data, including which Member took which action.

5.4 When the law requires. We disclose personal data to a government agency, regulator or court only when the law requires it or a lawful order compels it, including reports to the Indian Computer Emergency Response Team (CERT-In). Where the law allows, we tell the affected customer first.

5.5 Business transfer. If our business is transferred, personal data may pass to the new owner, who must honour this policy. We will tell you first.

6. Transfers outside India

Most data stays in India (Amazon Web Services, Mumbai). Some data goes abroad:

• to Clerk (United States): account and sign-in data;
• to Resend (Japan): your email address and the content of emails we send you;
• to Vercel (global network): technical data of visits to our websites;
• to Google (United States): website analytics, only if you accept.

Each provider is bound by contract to protect the data to a standard at least equal to Indian law. Indian law does not currently restrict transfers to these countries. If the government restricts transfers to a country, we will comply.

7. How long we keep personal data

8. Deleting your data

8.1 Leaving a workspace. When an Admin removes you from a workspace, your membership and any access you had to tool details are removed. The workspace's records of what you did stay, under an internal identifier.

8.2 Deleting your account. When you delete your Niyoos account, we delete your account record and the link between you and the pseudonym used in audit ledgers, so those entries can no longer be connected to you. Records of actions in a workspace keep only an internal identifier. Records of your acceptance of our terms are kept for 3 years after your account ends, and a registration record (your name, email address, workspace and sign-up date) for 180 days, as Indian law requires (section 7). No part of the service reads the registration record; it exists only to answer a lawful request.

8.3 Deleting a workspace. An owner can delete a workspace in Settings, after confirming by typing its name. Deletion is immediate. We stop every agent, revoke every key, cancel any paid plan with Razorpay, and erase the workspace's data from our database. What remains:

• payment receipts and billing records, for the period in section 7;
• records of who accepted our terms, for the period in section 7;
• registration records of Members whose accounts are deleted with the workspace, for 180 days (section 7);
• audit ledger copies already archived, until their 90-day lock ends;
• application and security logs, until they expire after 365 days;
• database backups, until they expire after 7 days;
• email delivery records held by Resend, under its retention period;
• records Razorpay must keep by law.

9. How we protect personal data

• Data is hosted in India on Amazon Web Services and sent over encrypted connections (TLS).
• Customers' AI provider keys are encrypted with keys held in AWS Key Management Service and used only to make the customer's calls. Agent keys are stored only as one-way hashes.
• Tool details are masked and encrypted with a separate key for each workspace and day.
• Every request to our API is checked against the workspace of the signed-in user; automated tests check that one workspace cannot see another's data.
• The audit ledger is hash-chained, sealed and anchored with signatures from AWS Key Management Service, so changes to it can be detected.
• Access to production systems is limited to the people who run the service.
• Logs are kept for 365 days in India to investigate incidents.

More detail is on our Security page. No system is perfectly secure; if a breach happens, section 11 applies.

10. Your rights

You have the right to:

1. know what personal data we hold about you and who we have shared it with;
2. correct, complete or update it;
3. erase it, where we no longer need it or you withdraw consent, unless the law requires us to keep it;
4. withdraw consent you gave (for example, to analytics cookies), as easily as you gave it. Withdrawal does not affect processing before it;
5. nominate someone to exercise your rights if you die or become unable to (from 13 May 2027);
6. complain to us, and, from 13 May 2027, to the Data Protection Board of India.

How: email privacy@niyoos.com from the email address on your account, or write to us. Tell us which right you want to use. We may ask you to confirm your identity. You can also change many things yourself in the app.

When: we acknowledge requests within 24 hours and aim to complete them within 30 days. The law's outer limit, from 13 May 2027, is 90 days. Complaints follow the timelines on our Grievance Redressal page.

If you are an end user of one of our customers, ask that customer. If you contact us, we will pass your request to them and help them answer it.

11. Data breaches

If a security incident affects personal data, we will:

• report it to CERT-In within 6 hours of noticing it, as the law requires;
• tell affected customers without delay, and in any case within 48 hours of confirming it, with what we know and what we are doing;
• from 13 May 2027, tell affected people and the Data Protection Board as the DPDP law requires, for data we hold as a data fiduciary.

12. Children

Niyoos is for businesses and professionals. You must be at least 18 to use it. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it. Customers are responsible for any children's data in their own end users' data.

13. Cookies

We use cookies that are needed for sign-in and security, and analytics cookies only if you accept. See our Cookie Policy.

14. Automated decisions

Niyoos makes automated decisions about agents' calls, not about people: spending limits, the Free plan request limit and loop detection can refuse or stop calls according to the customer's settings and plan. We do not make automated decisions about individuals that have legal or similarly significant effects on them, and we do not profile people.

15. Changes to this policy

We will post changes here with a new effective date. For a change that materially affects you, we will email Admins at least 30 days before it applies. A new company added as a sub-processor that handles customer data is announced at least 30 days in advance on the Sub-processors page. Earlier versions are available on request.

16. Contact

Varun Avhad, Grievance Officer and privacy contact · privacy@niyoos.com · grievance@niyoos.com · +91 96993 51139 Loktara Ventures Private Limited, 5th Floor, F-547, 8A, Ind. Area, Sector 75, Chandigarh Sector 55, S.A.S. Nagar (Mohali), Rupnagar - 160055, Punjab