Privacy Policy

1. Introduction

Welcome to Negotio ("Negotio", "Platform", "we", "our", or "us"), an AI-assisted platform that enables individuals, businesses, and organizations to create, collaborate on, negotiate, manage, and organize agreements digitally.

This Privacy Policy explains how Ambrosiac Private Limited, the operator of Negotio ("Company", "Data Fiduciary", "we", "our", or "us"), collects, uses, stores, processes, shares, transfers, retains, and protects Personal Data when you access or use:

• letsnegotio.com;
• the Negotio web application;
• any mobile applications that we may make available;
• APIs, integrations, and related software; and
• all associated products, services, features, content, and functionality (collectively, the "Services").

This Privacy Policy applies whenever you:

• create an account;
• access or browse the Services;
• invite or collaborate with other users;
• create, upload, edit, negotiate, or manage agreements or other User Content;
• communicate with us; or
• otherwise interact with the Services.

This Privacy Policy is intended to comply with the Digital Personal Data Protection Act, 2023 ("DPDP Act"), applicable rules made thereunder, and other applicable privacy and data protection laws.

For the purposes of this Privacy Policy, "Personal Data" means any data about an individual who is identifiable by or in relation to such data, as defined under applicable law.

Ambrosiac Private Limited acts as the Data Fiduciary in relation to the Personal Data processed through the Services.

We process Personal Data only for lawful purposes and in accordance with applicable law. Where required, we process Personal Data with your consent or on any other lawful basis permitted by applicable law.

Because Negotio is a collaborative platform, you may upload, create, share, or otherwise process Personal Data relating to yourself or other individuals while using the Services. You represent that you have the necessary rights, permissions, and legal authority to provide such Personal Data to the Services and, where required by applicable law, to authorize its processing.

Certain features of the Services may use artificial intelligence ("AI") to generate summaries, drafting suggestions, negotiation insights, action items, recommendations, and other AI-assisted outputs based on User Content that you choose to process using such features. Such processing is carried out solely for the purpose of providing the requested functionality and in accordance with this Privacy Policy.

This Privacy Policy should be read together with our Terms of Service, which govern your use of the Services. Terms not otherwise defined in this Privacy Policy have the meanings assigned to them in the Terms of Service.

2. Information We Collect

We collect Personal Data and other information that is necessary to provide, operate, maintain, improve, secure, and support the Services. The information we collect depends on how you interact with the Services and the features you choose to use.

A. Account Information

When you create an Account or are invited to use the Services, we may collect information including: your name; email address; phone number (where provided); organization or company name; job title or role (where provided); profile information; account preferences; and any other information you voluntarily provide while creating or managing your Account.

B. User Content

The Services allow users to create, upload, import, edit, organize, negotiate, and manage agreements and related content. Depending on how you use the Services, we may process User Content including: agreements; drafts; templates; comments; negotiation history; notes; attachments; uploaded documents; messages exchanged through the Services; and other content that you choose to create, upload, or share.

You remain responsible for ensuring that you have the necessary rights and permissions to upload or share such information through the Services.

C. Collaboration Information

When you collaborate with other users, we may collect information relating to collaboration activities, including:

• workspace memberships;
• invitations sent or received;
• collaborator information;
• permissions and access controls;
• comments and discussions;
• document activity;
• version history; and
• other collaboration-related information necessary to provide the Services.

D. AI Feature Usage

Where you choose to use AI-powered features, we may process information necessary to generate:

• summaries;
• drafting suggestions;
• negotiation insights;
• action items;
• recommendations; and
• other AI-assisted outputs.

Such processing may include relevant portions of User Content submitted for AI-assisted functionality. AI processing is carried out solely for providing the requested Services in accordance with this Privacy Policy and applicable law.

E. Technical Information

When you access or use the Services, we may automatically collect certain technical information, including: IP address; browser type and version; device type; operating system; language settings; device identifiers (where applicable); pages visited; features used; referring URLs; date and time of access; log information; and diagnostic information relating to your use of the Services.

F. Cookies and Similar Technologies

Negotio currently uses only essential cookies, local storage, and similar technologies that are required for the Services to function. We do not currently use analytics, advertising, or third-party tracking cookies.

The essential categories we use today are:

• Authentication and session — to sign you in and keep you signed in securely;
• User preferences — to remember choices such as your cookie acknowledgement and interface settings;
• Security — to protect your account and detect abuse of the Services.

If we introduce additional categories in the future (for example, product analytics or performance measurement), we will update this Privacy Policy and, where required, request your consent before those technologies are activated.

You may configure your browser to refuse or remove cookies. However, doing so may affect the availability or functionality of certain features of the Services, including your ability to remain signed in.

G. Information from Third Parties

We may receive information from third-party service providers, integrations, authentication providers, payment providers, or other services that you choose to connect to the Services. Such information will be processed only as necessary to provide the requested Services and in accordance with this Privacy Policy and applicable law.

H. Google Sign-In

Negotio offers Google Sign-In as an optional authentication method.

If you choose to sign in using your Google Account, we receive basic account information made available by Google, including your name, email address, profile picture (if available), and information necessary to authenticate your account.

We use this information solely to authenticate your identity, create and manage your Negotio account, and provide the Services.

Negotio requests only the standard Google authentication scopes required for sign-in (currently openid, email, and profile). We do not request access to your Gmail, Google Drive, Google Calendar, Contacts, or any other Google services unless we introduce additional integrations in the future and obtain any required authorization.

Google-provided profile information is retained for as long as your Negotio account remains active or as otherwise required by applicable law.

3. Who Processes Your Information

Ambrosiac Private Limited, the operator of Negotio, acts as the Data Fiduciary in relation to the Personal Data processed through the Services.

We collect Personal Data directly from you when you:

• create an Account;
• use the Services;
• upload or create User Content;
• invite collaborators;
• communicate with us;
• connect third-party services or integrations; or
• otherwise interact with the Services.

In order to provide, operate, maintain, secure, improve, and support the Services, we may engage trusted third-party service providers ("Service Providers") to process Personal Data on our behalf. These Service Providers may assist us with services including:

• cloud hosting and infrastructure;
• authentication and identity verification;
• data storage and backup;
• analytics and performance monitoring;
• customer support;
• email and communication services;
• payment processing;
• security and fraud prevention;
• AI-powered functionality; and
• other operational services necessary to provide the Services.

Where Service Providers process Personal Data on our behalf, they do so only under appropriate contractual obligations and only for the purposes authorized by us and permitted under applicable law.

We require our Service Providers to implement appropriate technical and organizational security measures designed to protect Personal Data and to process such data only in accordance with our instructions.

The Services may also allow you to connect or interact with third-party services that are not owned or controlled by Negotio. Your use of such third-party services is governed by their respective privacy policies and terms of service. Negotio does not control and is not responsible for the privacy practices of independent third-party services.

We encourage you to review the privacy policies of any third-party services before providing them with your Personal Data.

4. How We Use Your Information

We process Personal Data only for lawful purposes and in accordance with applicable law. Depending on how you use the Services, we may process your Personal Data for one or more of the following purposes:

A. Providing the Services

We use Personal Data to:

• create and manage your Account;
• authenticate users and maintain account security;
• provide access to workspaces, agreements, and collaboration features;
• facilitate negotiations and communications between authorized users;
• generate AI-assisted features that you choose to use;
• provide customer support; and
• otherwise operate and deliver the Services.

B. Collaboration and Agreement Management

Because Negotio is a collaborative platform, we process Personal Data to:

• enable users to create, edit, review, negotiate, and manage agreements;
• allow authorized collaborators to access shared User Content;
• manage invitations, permissions, and access controls;
• maintain version history and collaboration records; and
• support communication between collaborators.

C. AI-Assisted Features

Where you choose to use AI-powered features, we may process relevant Personal Data and User Content to:

• generate summaries;
• provide drafting suggestions;
• identify action items;
• provide negotiation insights;
• generate recommendations; and
• provide other AI-assisted functionality requested by you.

AI processing is performed solely to provide the requested functionality and in accordance with this Privacy Policy. AI-generated outputs should always be reviewed by users before being relied upon or incorporated into any agreement or business decision.

AI Data Usage

Negotio uses artificial intelligence features solely to provide the AI-powered functionality requested by users, such as generating summaries, suggestions, analyses, and other in-product assistance.

Negotio does not use Customer Content, agreements, uploaded files, prompts, AI conversations, or AI-generated outputs to train foundation AI models. Customer data is processed only to deliver the requested functionality and in accordance with this Privacy Policy.

Where AI services are provided through trusted third-party providers, Personal Data is processed only as necessary to deliver the requested functionality and in accordance with appropriate contractual, privacy, and security obligations.

D. Improving the Services

We may use information to:

• improve functionality and user experience;
• develop new features;
• monitor system performance;
• troubleshoot technical issues;
• conduct testing and quality assurance;
• analyze usage trends; and
• improve the reliability, security, and performance of the Services.

Where reasonably possible, we may use aggregated or de-identified information for these purposes.

E. Security and Fraud Prevention

We may process Personal Data to:

• verify user identities where applicable;
• detect, investigate, and prevent fraud;
• protect Accounts from unauthorized access;
• monitor for security incidents;
• enforce our Terms of Service;
• protect the rights, property, and safety of Negotio, our users, and others; and
• maintain the security and integrity of the Services.

F. Communications

We may use your Personal Data to:

• respond to your enquiries;
• provide technical support;
• send important service-related notifications;
• notify you about changes to the Services, this Privacy Policy, or our Terms of Service;
• send security alerts; and
• communicate with you regarding your Account.

Where permitted by applicable law, we may also send product updates, newsletters, promotional communications, or information about new features. You may opt out of receiving marketing communications at any time, although you may continue to receive important administrative or service-related communications.

G. Legal and Regulatory Compliance

We may process Personal Data where necessary to:

• comply with applicable laws and regulations;
• respond to lawful requests from courts, regulators, or governmental authorities;
• establish, exercise, or defend legal claims;
• enforce our legal rights;
• comply with legal obligations; or
• protect the Services and our users.

H. Other Lawful Purposes

We may process Personal Data for any other purpose:

• with your consent;
• where required or permitted by applicable law; or
• where reasonably necessary to provide, maintain, secure, improve, or support the Services.

We will not process Personal Data for purposes that are incompatible with those described in this Privacy Policy unless required or permitted by applicable law or with your consent.

5. How We Share Your Information

We do not sell your Personal Data.

We may share Personal Data only where necessary to provide the Services, comply with applicable law, protect our legitimate interests, or with your consent.

A. With Other Users

Because Negotio is a collaborative platform, certain Personal Data and User Content may be shared with other users whom you authorize to collaborate with you. Depending on the permissions granted within the Services, authorized collaborators may be able to view, edit, comment on, negotiate, or otherwise interact with User Content and related information.

You are responsible for determining who you invite to collaborate and the permissions you grant to other users.

B. With Service Providers

We may share Personal Data with trusted Service Providers that perform services on our behalf, including providers of: cloud hosting and infrastructure; authentication and identity verification; payment processing; customer support; analytics and performance monitoring; email and communication services; security and fraud prevention; AI-powered functionality; data storage and backup; and other services necessary to operate, maintain, secure, and improve the Services.

These Service Providers process Personal Data only on our behalf, subject to appropriate contractual obligations and applicable law.

C. With Third-Party Integrations

Where you choose to connect or use third-party integrations, we may share the information necessary to enable those integrations to function. Your use of such third-party services is governed by their respective privacy policies and terms, and we encourage you to review those policies before connecting such services.

D. Legal Requirements

We may disclose Personal Data where we reasonably believe such disclosure is necessary to:

• comply with applicable law;
• comply with a lawful request from a court, law enforcement agency, regulatory authority, or other competent governmental body;
• establish, exercise, or defend legal claims;
• investigate suspected unlawful activity;
• enforce our Terms of Service or other legal rights; or
• protect the rights, property, safety, or security of Negotio, our users, or others.

E. Business Transfers

If Ambrosiac Private Limited undergoes a merger, acquisition, investment, corporate restructuring, sale of assets, or other business transaction, Personal Data may be transferred as part of that transaction. Where appropriate, such transfers will be subject to confidentiality obligations and applicable data protection laws.

F. With Your Consent

We may share Personal Data with third parties where you have expressly directed us to do so or otherwise provided your consent.

G. Aggregated and De-Identified Information

We may use or disclose aggregated, anonymized, or de-identified information that does not reasonably identify an individual for purposes such as analytics, research, service improvement, business reporting, or other lawful purposes.

H. No Sale of Personal Data

Except as described in this Privacy Policy, we do not sell, rent, or trade your Personal Data to third parties for their own marketing or commercial purposes.

6. Your Privacy Rights and Choices

Subject to applicable law, including the Digital Personal Data Protection Act, 2023 ("DPDP Act"), you may have certain rights regarding your Personal Data.

A. Access to Your Personal Data

You may request information regarding the Personal Data we process about you, subject to applicable law.

B. Correction and Updating

You may request that inaccurate, incomplete, or outdated Personal Data be corrected or updated. Where available, you may also update certain Account information directly through the Services.

C. Deletion of Personal Data

You may request deletion of your Personal Data, subject to applicable law and our legitimate obligations to retain certain information for legal, regulatory, security, dispute resolution, fraud prevention, backup, or operational purposes. Deletion of Personal Data may result in the loss of access to certain features of the Services.

D. Withdrawal of Consent

Where our processing is based on your consent, you may withdraw that consent at any time by:

• updating your Account settings (where available); or
• contacting us using the contact details provided in this Privacy Policy.

Withdrawal of consent will not affect the lawfulness of processing carried out before such withdrawal but may limit or prevent your continued use of certain features of the Services.

E. Account Closure

You may close or delete your Account through the Services where available or by contacting us. Following account closure:

• access to your Account may be disabled;
• certain User Content may remain available to collaborators where necessary to preserve shared agreements or collaboration history;
• Personal Data may be retained where required by applicable law or our legitimate operational, legal, security, or dispute resolution requirements; and
• remaining Personal Data will be handled in accordance with our data retention practices described in this Privacy Policy.

F. Marketing Communications

Where permitted by applicable law, you may opt out of receiving promotional or marketing communications by following the unsubscribe instructions contained in those communications or by contacting us. Even if you opt out of marketing communications, we may continue sending important administrative, legal, security, or service-related communications relating to your Account or the Services.

G. Grievances

If you believe that your Personal Data has been processed in a manner that does not comply with applicable law or this Privacy Policy, you may contact our Grievance Officer using the contact details provided in this Privacy Policy. Where applicable, you may also have the right to seek remedies or file complaints before the appropriate authority in accordance with applicable law.

H. Exercising Your Rights

You may exercise any applicable privacy rights by contacting us using the details provided in the Contact Us section of this Privacy Policy. We may request reasonable information to verify your identity before processing your request in order to protect your Personal Data and the rights of other users. We will respond to requests within a reasonable period and in accordance with applicable law.

7. Third-Party Services, Integrations, and Links

The Services may contain links to, integrate with, or enable access to third-party websites, applications, products, or services that are not owned or controlled by Ambrosiac Private Limited. These may include, without limitation:

• payment processors;
• authentication and identity providers;
• cloud hosting providers;
• AI service providers;
• communication and email services;
• electronic signature providers;
• document storage services;
• productivity and business software integrations; and
• other third-party services that you choose to connect to the Services.

Where you choose to use or connect third-party services, certain Personal Data may be shared with those services as necessary to enable the requested functionality. Your use of any third-party service is governed solely by the applicable third party's privacy policy, terms of service, and other applicable agreements.

Negotio does not own, operate, or control independent third-party services and is not responsible for their privacy practices, security measures, content, availability, or performance.

We encourage you to review the privacy policies and terms of any third-party services before providing them with your Personal Data or connecting them to your Account.

The inclusion of a link, integration, or third-party service within the Services does not imply our endorsement, sponsorship, or recommendation of that third party unless expressly stated otherwise.

8. Data Security

We implement reasonable technical, organizational, and administrative measures designed to protect Personal Data against unauthorized access, use, disclosure, alteration, loss, or destruction.

Our security measures are designed to protect the confidentiality, integrity, and availability of the Services and may include:

• encryption of Personal Data in transit using industry-standard protocols;
• encryption of Personal Data at rest where appropriate;
• user authentication and access controls;
• role-based permissions for collaborative features;
• secure cloud infrastructure;
• system monitoring and logging;
• backup and disaster recovery procedures;
• vulnerability management and security updates; and
• other reasonable technical and organizational safeguards appropriate to the nature of the Services.

Access to Personal Data is limited to authorized personnel, contractors, and Service Providers who require such access to perform their responsibilities and who are subject to appropriate confidentiality obligations.

While we take reasonable steps to safeguard Personal Data, no method of transmission over the Internet or electronic storage can be guaranteed to be completely secure. Accordingly, we cannot guarantee absolute security.

You are also responsible for helping protect your Personal Data by:

• maintaining the confidentiality of your Account credentials;
• choosing a strong and unique password;
• enabling additional security features where available;
• promptly notifying us of any suspected unauthorized access to your Account; and
• using the Services in a secure manner.

We will take reasonable steps to investigate suspected security incidents and, where required by applicable law, notify affected users and appropriate authorities of Personal Data breaches.

We regularly review and update our security practices to help protect the Services against evolving security risks.

9. Data Retention

We retain Personal Data only for as long as necessary to provide the Services, fulfill the purposes described in this Privacy Policy, comply with applicable law, resolve disputes, enforce our legal rights, prevent fraud, maintain security, or meet other legitimate business and operational requirements.

The length of time we retain Personal Data depends on factors including:

• the nature of the Personal Data;
• the purpose for which it was collected;
• whether your Account remains active;
• applicable legal, regulatory, tax, accounting, or compliance obligations; and
• our legitimate operational requirements.

When you delete your Account or request deletion of your Personal Data, we will take reasonable steps to delete or anonymize the relevant Personal Data within a reasonable period, unless we are required or permitted to retain it under applicable law or for legitimate operational, legal, security, fraud prevention, backup, audit, or dispute resolution purposes.

Certain User Content that has been shared with other authorized users or forms part of collaborative workspaces, agreements, audit history, or version history may continue to be retained where necessary to preserve the integrity, continuity, or functionality of the Services.

Backup copies of Personal Data may continue to exist for a limited period as part of our routine backup and disaster recovery processes before being securely deleted or overwritten in accordance with our retention practices.

We maintain internal data retention schedules and periodically review retained Personal Data to ensure it is not retained longer than necessary for the purposes described in this Privacy Policy or as required by applicable law.

Where Personal Data is no longer required, we will securely delete, anonymize, or otherwise dispose of it in accordance with applicable law and our internal data retention practices.

10. Cross-Border Data Transfers

Negotio may use Service Providers, cloud infrastructure, or other technology providers that process or store Personal Data in jurisdictions outside the country in which you reside, including outside India.

Negotio primarily hosts Customer Content and application data using cloud infrastructure located in Singapore (AWS ap-southeast-1 via Supabase). Certain Service Providers may process limited Personal Data in other jurisdictions where necessary to provide specific functionality, such as email delivery or AI-assisted features. Details of our current Service Providers are available on our Sub-processors page.

Accordingly, your Personal Data may be transferred to, processed in, or stored in countries other than your own where it is necessary to provide, operate, maintain, secure, or improve the Services.

Where Personal Data is transferred across borders, we will take reasonable steps to ensure that such transfers are carried out in accordance with applicable data protection laws and are subject to appropriate safeguards.

Where required under applicable law, cross-border transfers of Personal Data will be undertaken only to jurisdictions permitted under applicable law or in accordance with any restrictions, conditions, or requirements prescribed by competent governmental authorities.

By using the Services, you acknowledge that your Personal Data may be processed in jurisdictions where our Service Providers or infrastructure are located, subject always to the protections described in this Privacy Policy and applicable law.

11. Children's Privacy

The Services are intended only for individuals who are at least 18 years of age or the legal age required to enter into a binding contract in their jurisdiction, whichever is higher.

We do not knowingly collect Personal Data directly from individuals who do not meet these eligibility requirements.

If we become aware that Personal Data has been collected from an individual who is not eligible to use the Services in violation of this Privacy Policy or our Terms of Service, we will take reasonable steps to delete such Personal Data or otherwise comply with applicable law.

If you believe that a child or other ineligible individual has provided Personal Data through the Services, please contact us using the details provided in the Contact Us section of this Privacy Policy so that we may investigate and take appropriate action.

12. Data Accuracy

We take reasonable steps to ensure that the Personal Data we process is accurate, complete, and, where appropriate, kept up to date.

You are responsible for ensuring that the information you provide to the Services is accurate, current, and complete, and for promptly updating your Account information if it changes.

Where available, you may update your Personal Data directly through your Account settings. You may also request correction or updating of your Personal Data by contacting us using the details provided in the Contact Us section of this Privacy Policy.

If we become aware that Personal Data is inaccurate or incomplete, we may take reasonable steps to correct, update, or delete such information where appropriate and in accordance with applicable law.

We encourage users to periodically review their Account information to help ensure that it remains accurate and up to date.

13. Changes to This Privacy Policy

We may update or modify this Privacy Policy from time to time to reflect changes in the Services, applicable laws, technology, our data processing practices, or for other operational, legal, or business reasons.

When we make material changes to this Privacy Policy, we may notify you through the Services, by email (where you have provided one), or by any other reasonable means, as required or permitted by applicable law.

Unless otherwise stated, any revised Privacy Policy becomes effective when it is published through the Services.

Your continued access to or use of the Services after the revised Privacy Policy becomes effective constitutes your acknowledgment of the updated Privacy Policy.

We encourage you to review this Privacy Policy periodically so that you remain informed about how we collect, use, process, share, retain, and protect your Personal Data.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy, the processing of your Personal Data, or your privacy rights, you may contact us using the details below.

Grievance Officer / Privacy Contact

Name: Poorva Jadhav
Email: info@ambrosiacstudios.com

Postal Address:
Ambrosiac Private Limited
Office No. 1, S. No. 50/15/1,
Samarth Sankul,
Narhe,
Pune – 411041,
Maharashtra, India

CIN: U51909MH2017PTC297612
GSTIN: 27AAPCA8304B1ZU

You may contact us to:

• exercise your privacy rights;
• request access to, correction of, or deletion of your Personal Data;
• withdraw your consent where applicable;
• report suspected privacy or security concerns;
• submit grievances relating to the processing of your Personal Data; or
• ask questions regarding this Privacy Policy or our privacy practices.

We will acknowledge receipt of your privacy-related enquiry or grievance as soon as reasonably practicable and aim to resolve it promptly, normally within 7 business days. More complex matters may require additional time, in which case we will keep you informed of the progress. We will handle all privacy-related requests and grievances in accordance with applicable law. If you are not satisfied with our response, you may have the right to seek remedies or lodge a complaint with the appropriate regulatory or governmental authority, where permitted by applicable law.

See also our Terms of Service.