Privacy Policy

Last updated: September 2026 • Plain-English Policy • DPDP Act, 2023 & 2026 Rules Compliant

1. Introduction & The Three Parts of Our System

MudraForge ("we," "us," or "our") is an Indian organizational AI engineering firm committed to clear transparency, data privacy, and data sovereignty. This Privacy Policy explains how we collect, protect, and handle data across the three connected parts of our platform:

• The MudraForge Cloud Runtime: The secure cloud engine that executes your company's automated workflows, connects safely to your business software (such as ERPs or accounting databases), and enforces your company's safety rules in code.
• Adesha (The Management App): The dedicated app for mobile phones (Android on Google Play, and upcoming on iOS) and desktop computers (Windows, Mac, Linux) where authorized managers review AI actions, approve important business decisions with a single tap, and manage company files. Adesha is a secure native application, not an open browser dashboard.
• The Customer-Facing WhatsApp Deployment Service: A managed deployment service that connects your company’s existing business systems (such as your CRM, ERP, or customer databases) to a front-end conversational AI interface on WhatsApp. External customers interact directly with your business through this customer-facing interface via text or voice notes in English and Indian languages, while your internal staff manages operations and approvals via Adesha.

2. Your Company Owns Your Data (Fiduciary vs. Processor)

Under India's Digital Personal Data Protection (DPDP) Act, 2023 and implementing rules:

• Your Company is the Data Fiduciary (The Data Owner): Your business decides what customer, employee, and operational data is processed. You own, govern, and control your data at all times.
• MudraForge is the Data Processor (The Service Provider): We only process data on your company's direct instructions under our signed business agreement. We never use your proprietary data for our own commercial purposes.
• Direct Account Contacts: MudraForge acts as a Data Fiduciary only for direct business contact and billing information (such as administrative emails, company billing details, and inquiries submitted directly through our website at mudraforge.in).

3. What Information We Process

Depending on how your company uses our system, we process the following categories of business information:

• Customer Ingress Messages & Voice Notes (WhatsApp & Web): Inbound text messages, customer phone numbers, voice recordings (processed for real-time speech-to-text in Indian languages), and attached business documents (such as invoices, receipts, or product specifications) submitted by your external customers through the WhatsApp front-end interface.
• Internal Manager Approvals & Identity (Adesha): Manager names, corporate email addresses, assigned role tiers, IP addresses, and cryptographic approval timestamps generated when internal staff review actions or sign off on requests in the Adesha app (distinguishing internal supervision from customer messaging).
• User Personal Workspace (VFS) Files: Personal research notes, drafts, analysis, documents, and code uploaded to or created within an individual user's cryptographically isolated Virtual File System (VFS) in Adesha.
• Safety & Execution Records: UTC timestamps, system verification logs, and safety rule checks that verify actions stay within your company's approved operational and spending limits.

4. What We NEVER Collect & User Personal Space Protection

We believe business software should respect privacy boundaries. The Adesha management app and the MudraForge cloud runtime never perform unauthorized monitoring:

• User Personal Space Isolation: Each individual user's personal VFS partition is cryptographically segregated. An enterprise organization cannot arbitrarily inspect or claim ownership over an individual user's private personal working notes and drafts directly.
• No Location Tracking: We never track personal GPS or physical location.
• No Contact Scraping: We never read your personal phone contact list or address book.
• No Background Recording: We never listen to microphones in the background or access cameras without direct action.
• No Clipboard Spying: We never read personal clipboard contents or other app activities.
• Minimal Permissions: Adesha only requests permissions strictly required to operate: internet access to sync securely, push notifications to alert managers when an approval is waiting, file downloads when saving reports, and fingerprint or face unlock to verify high-stake approvals.

5. Why We Process Your Data (Legitimate Business Purposes)

We process information exclusively to deliver your contracted services:

• Running authorized AI reasoning cycles and answering user questions.
• Delivering approval cards to managers in Adesha for high-consequence business actions (such as financial transactions or live database changes).
• Maintaining tamper-evident statutory audit trails required under Indian law.
• Enforcing company safety rules, spending limits, and emergency stop commands.
• Sending critical service notifications and administrative alerts.
• Zero Data Selling: We never sell, rent, lease, or trade your data to data brokers, advertising networks, or third-party marketing firms.

6. Third-Party AI Data Safety & Zero AI Model Training Guarantee

To deliver fast, multilingual cloud services, MudraForge works with enterprise-grade infrastructure providers. We specifically protect user data from third-party AI exposure:

• Third-Party AI Shielding: Knowledge workers often risk exposing sensitive personal notes and company data by pasting them into consumer third-party AI chatbots. MudraForge provides a sovereign sandbox: when you interact with AI in your personal VFS, your data is completely protected and safe with MudraForge. Data is never exposed to public chat logs or third-party tracking.
• Sarvam AI Private Limited (Bengaluru, India): Powers Indian language understanding, voice-to-text transcription, and speech synthesis across 10+ Indian languages. Audio notes and text prompts are processed in-memory and discarded immediately under strict Zero Data Retention (ZDR). No data is stored or used to train public models.
• Cloudflare, Inc.: Provides secure edge cloud infrastructure, secure network routing, and data encryption. Data moving across the network is protected by TLS 1.3, and stored data is encrypted with AES-256.
• MongoDB, Inc. (Mumbai & Delhi, India): Provides secure database storage hosted exclusively in domestic data centers within India to guarantee Indian data residency.
• Meta Platforms, Inc. (WhatsApp Business): Provides the secure message transmission layer for our customer-facing deployment service under Meta's official WhatsApp Business Cloud API enterprise terms.
• Zero AI Model Training Covenant: Under our binding enterprise agreements, your personal workspace data, corporate documents, and voice recordings are never used to train or fine-tune public foundation AI models.

7. Dual-Partition Storage: Personal Vault vs. 90-Day Temporary Workspace

To keep files organized, protect personal privacy, and reduce data liability, files in the system are divided into two clear areas:

• The User Personal Vault: Dedicated, permanent storage within each user's personal VFS partition for personal documents, master contracts, and project deliverables. Files in the User Vault are protected from automated cleanup and remain saved for the active duration of the user account.
• Temporary Workspace: A 90-day working scratchpad for daily AI drafts, intermediate spreadsheets, and temporary exports. Files here are automatically cleaned up after 90 days to avoid unneeded data accumulation, unless saved by the user to their permanent Vault.
• Customer Voice Notes & Media: Voice notes and attached media sent by external customers through the WhatsApp deployment service are converted to text in memory and cleaned up automatically once processing is complete.

8. 7-Year Statutory Audit Trail (Mandatory under Indian Law)

In accordance with Section 8(7) of the DPDP Act, 2023, Rule 3(1)(h) of the IT Intermediary Rules, 2021, and the Companies Act, 2013, MudraForge maintains tamper-evident audit records of manager approvals, financial actions, and system executions for seven (7) years.

Exemption from Erasure: These audit logs record the complete chain of custody—including which manager approved an action, the exact timestamp, the device used, and the system output. Because Indian statutory law requires businesses to preserve compliance records for fraud prevention and forensic accountability, immutable compliance audit logs are legally exempt from data erasure requests.

9. Security Architecture & Company Isolation

We implement bank-grade security measures to safeguard your information:

• Strict Company Separation: Each client company's data is stored in isolated, cryptographically segregated digital vaults. It is structurally impossible for one company to access or view another company's data.
• Strong Encryption: All data moving across the internet is encrypted using TLS 1.3 with forward secrecy. All stored data is encrypted at rest using AES-256.
• Automated Safety Filtering: All incoming messages from WhatsApp and web portals pass through automated security filters that remove malicious code, strip harmful links, and block prompt injection attacks before reaching the AI.

10. Your Rights Under India's DPDP Act

Indian citizens whose personal data is processed through our platform have clear statutory rights under the DPDP Act, 2023 and 2026 Rules:

• Right to Access: The right to receive a plain-English summary of personal data being processed and the list of third-party service providers used.
• Right to Correction: The right to request the correction of inaccurate, misleading, or outdated personal information.
• Right to Erasure: The right to request the deletion of personal data from active operational databases (excluding mandatory 7-year statutory audit records required by law).
• Right of Grievance Redressal: The right to easily access our Grievance Officer and receive timely resolution.
• Right to Nominate: The right to designate a representative to manage data rights in the event of death or incapacity.

11. How to Submit a Request & Response Timelines (SLA)

To exercise your statutory rights or submit a Data Subject Access Request:

• Send an email from your registered corporate email address to [email protected] with the subject line "DPDP Data Request" or "DPDP Deletion Request".
• Include your full name, organization name, registered phone number, and the details of your request.
• Our Guaranteed Timelines: Our Grievance Office will provide an official acknowledgment within forty-eight (48) hours and complete forensic verification, processing, and resolution within thirty (30) calendar days.

12. Official Grievance Redressal Officer

For questions, compliance inquiries, or formal grievances under the DPDP Act, 2023 or IT Intermediary Rules, 2021, please contact our designated Grievance Officer: