1. Introduction

This Privacy Policy describes how CFURST Solutions Pvt Ltd ("Intauryx", "Company", "we", "us", "our") collects, uses, discloses, and protects personal data when you access or use the Intauryx platform (the "Service"), in accordance with the Digital Personal Data Protection Act, 2023 ("DPDP Act") and its Rules.

This Policy should be read together with our Terms and Conditions. By accepting the Terms and Conditions, you also acknowledge that you have read and understood this Privacy Policy.

2. Data Fiduciary Details

Company: CFURST Solutions Pvt Ltd

CIN: U72900UP2020PTC131884

Address: B-51, Paramount Golf Foreste, Opposite Sector Zeta 1, Surajpur, Greater Noida, UP-201306

Email: support@intauryx.com

3. Roles — Data Fiduciary and Data Processor

The Organisation that administers a Service account (i.e., the professional services firm using Intauryx) is the Data Fiduciary for the personal data of its own clients and personnel that it stores or manages using the Service ("Organisational Data"). It determines the purpose and means of processing that data and is responsible for providing notice to, and obtaining consent from, the individuals concerned.

CFURST Solutions Pvt Ltd acts as a Data Processor in respect of Organisational Data, processing it only on the documented instructions of the relevant Organisation. In respect of Account Information and Usage Information described in Section 4 below, which we collect directly from Users for our own purposes (operating, securing, and supporting the Service), the Company acts as an independent Data Fiduciary.

The detailed contractual terms governing our processing of Organisational Data on behalf of your Organisation — including sub-processors, audit rights, and data return/deletion on termination — are set out in our Data Processing Addendum, entered into by your Organisation's Administrator at the time of Organisation onboarding, and available to Organisation Admins at any time from Org Settings. 

4. Personal Data We Collect

4.1 Account Information

When you register or are invited to the platform, we may collect:

• Name

• Email address

• Phone number

• Organisation information

• User role and permissions

4.2 Usage Information

When you interact with the platform, we may collect:

• Login activity and authentication records (including OTP and MFA logs)

• System interactions and platform usage data

• Chatbot interactions: the prompts you enter and the responses generated, which are stored as conversation history (voice input is not stored). To the extent they contain Organisational Data, they are treated as Organisational Data under Section 4.3

• Device, browser, and IP address information

4.3 Organisational Data

Organisations using the platform may store information including:

• Client records

• Project information

• Documents and files

•  Communications and work items

• Emails and attachments received into, and sent from, the Service through the Organisation's connected mailbox, including sender and recipient addresses, subject lines, message content and timestamps, and contact details of client key personnel

This Organisational Data is processed by us on behalf of, and on the instructions of, the Organisation, which acts as the Data Fiduciary for it, under the terms of our Data Processing Addendum. Any individual whose personal data forms part of Organisational Data should direct data-protection requests to the relevant Organisation in the first instance, in accordance with Section 14 below. This includes individuals who are not Users of the Service, such as people who exchange emails with an Organisation that uses the email features.

4.4 Communications Data

Records of support requests, service notifications, and document-request emails sent through the Service. System emails (such as account activation invitations and password-change links) are sent from info@intauryx.com through an email delivery service, and one-time passwords are sent by SMS through an SMS delivery service.

4.5 Mailbox Connection and Email Activity Data

Where an Organisation Administrator connects a mailbox to the Service, we store the credentials needed to access it. These are OAuth 2.0 authorisation tokens where the email provider supports OAuth 2.0 (in which case we do not receive or store the mailbox password); otherwise, an application-specific password generated by the mailbox user in the email provider's security settings and entered by the Organisation Administrator or, where the email provider permits it, the mailbox's regular account password. Credentials are stored in encrypted form, are accessible only to authorised application processes, and are used only to connect to the mailbox and carry out the email operations described in this Section. Our support team can provide documentation and assistance on generating an application-specific password.

Once a mailbox is connected, we import only emails received from email addresses stored at Client level in the Service, or listed on the whitelist maintained for that mailbox's email address by the Organisation Administrator and the relevant User. We identify the Entity an email relates to using the key in the email subject, and apply a label named "Intauryx" to imported emails in the mailbox; the emails themselves remain in the mailbox. Emails sent directly from the mailbox outside the Service are not tracked; only emails sent through the Service are recorded. We do not send any email from the mailbox on our own: an email is sent only when a User sends a comment or reply through the Service. If a notice of non-delivery is received, it is displayed as a comment on the relevant Entity. We also record per-User status information, such as whether an Email Action Item has been read or resolved by a User. (In this Policy, "Entity" means any record in the Service from a Client down to a Task, that is, a Client, Project, Assignment or Task, and "Work Item" means an Assignment or Task.)

The content of emails, attachments and Email Action Items is Organisational Data (Section 4.3) and is processed by us on behalf of the Organisation. Access to it within the Service is determined by role: Organisation Administrators can access all Email Action Items, Project Managers can access those relating to their projects, and other Users can access emails addressed to them.

We do not sell connected email data to third parties or use email content for advertising or marketing purposes.

5. Purpose and Legal Basis of Processing

We process personal data for the following purposes:

• Providing and maintaining the Service;

• Managing user authentication and account access;

• Enabling collaboration and workflow management, including AI Features described in Section 13;

• Enabling email features, including converting emails into Email Action Items and comments, sending comments as emails, preparing AI-assisted draft replies, and notifying authorised Users when a mailbox needs to be reconnected;

• Monitoring system performance and security, and preventing fraud or unauthorised access;

• Responding to support requests and resolving grievances;

• Improving functionality and user experience; and

• Complying with applicable law, including tax, accounting, and regulatory requirements.

Where we act as Data Fiduciary (Section 3 above), we process personal data on the basis of your consent (Section 6), or, where applicable, on the basis of a "legitimate use" recognised under Section 7 of the DPDP Act — for example, where you have voluntarily provided personal data to us for a specified purpose (such as raising a support request) and have not indicated that you do not consent to its use, or where processing is necessary to comply with a legal obligation.

6. Consent

Where consent is the basis for processing, it is free, specific, informed, unconditional, and unambiguous, given through a clear affirmative action (such as ticking the acceptance box for this Policy when activating your account), and limited to the personal data necessary for the specified purpose.

You may withdraw consent at any time, to the same extent to which it was given, by writing to our Grievance Officer at the contact details in Section 15. Withdrawal does not affect the lawfulness of processing carried out before withdrawal and may mean you are unable to continue using some or all of the Service; we will inform you of the consequences before acting on your withdrawal request.

7. How We Share Information

We do not sell personal data. Information may be shared only:

• With administrators and Project Managers of your Organisation, to the extent necessary for them to manage their account, users and projects, including access to emails and Email Action Items in accordance with the access rules configured in the Service;

• With the recipients chosen by you or your Organisation, when an Entity comment is sent as an email (including Client Visible comments and External Participants). Emails once sent cannot be recalled, and we are not responsible for how recipients use them;

• With our sub-processors — including our infrastructure/hosting provider, our email and SMS delivery providers, and one or more AI providers used for the AI Features described in Section 13. A current list of our sub-processors, including the specific AI models in use, is available on written request to the contact details in Section 17, and forms part of our Data Processing Addendum, Schedule A (available to Organisation Admins via Org Settings); and

• Where required by law, regulation, or a valid order of a court, regulator, or the Data Protection Board of India.

The email service provider that hosts an Organisation's connected mailbox is engaged by the Organisation, not by us, and is not our sub-processor. The Organisation's arrangements with that provider govern its handling of mailbox data.

Our sub-processors are established cloud and AI providers. Each processes data under its own standard terms and conditions, including data-protection terms, which impose data-protection obligations on it. We remain responsible to the Organisation for processing carried out by our sub-processors on its behalf (see our Data Processing Addendum, Section 7.1).

8. Cross-Border Data Transfer

Personal data processed through the Service is primarily hosted and processed within India, on Google Cloud Platform infrastructure in the Mumbai (asia-south1) region.

Where you use an AI Feature (Section 13), the content you submit is first passed through an automated redaction/masking process, and the masked content is then transmitted to our AI sub-processor(s) for processing, which may take place outside India. Because this masking is reversible, the masked content remains personal data under the DPDP Act. This transfer is subject to the data-protection obligations in that sub-processor's standard terms and conditions, and is limited to jurisdictions not restricted by the Central Government under Section 16 of the DPDP Act.

The identity of our current AI sub-processor(s), the specific models used, and their processing location(s) are set out in our Data Processing Addendum, Schedule A, and are available to individual Users on written request to the contact details in Section 17.

Our email and SMS delivery providers process limited personal data, such as your name, email address or mobile number, in order to deliver account-related messages. Where any such provider processes that data outside India, the transfer is limited to jurisdictions not restricted under Section 16 of the DPDP Act and is subject to the provider's standard terms and conditions. The location of each of our sub-processors is set out in our Data Processing Addendum, Schedule A.

Any other cross-border transfer (for example, to a future sub-processor) will be made only to a country or territory not restricted under Section 16 of the DPDP Act and will be subject to equivalent contractual safeguards.

The location in which an Organisation's email provider stores and processes mailbox data depends on that provider and the Organisation's own arrangements, and is outside our control.

9. Data Retention

We retain personal data only for as long as necessary for the purposes it was collected, in line with the following typical periods:

• Active accounts: for the duration of your access to the Service.

• Financial and billing records: 8 years, to meet statutory accounting and tax requirements.

• Usage and log data: up to 2 years.

• Chatbot conversation history: retained for the duration of your access to the Service.

• Deleted documents: held in the Service's Recycle Bin for 90 days, a platform-wide period that we may change from time to time, with notice to Organisations, before permanent deletion.

• Emails and attachments: held as part of Organisational Data and deleted in accordance with the Organisation's instructions and, on termination, our Data Processing Addendum. Mailbox authorisation tokens are deleted when the mailbox is disconnected or the Organisation's account terminates

These periods may be extended where required by law, an active legal claim, or a litigation hold. Retention and deletion of Organisational Data on termination of an Organisation's account is further governed by our Data Processing Addendum.

Emails sent from the Service cannot be recalled, and deleting content in the Service does not delete copies held in recipients' mailboxes or in the Organisation's own mailbox (including emails labelled "Intauryx"), which remain under the control of the Organisation and those recipients.

10. Data Security and Breach Notification

We implement technical and organisational measures designed to protect personal data against unauthorised access, loss, or misuse, including secure authentication (including multi-factor authentication), encrypted data transmission, role-based access controls, and system monitoring and audit logging. Mailbox credentials (OAuth 2.0 tokens or, where OAuth 2.0 is not available, application-specific or account passwords) are stored in encrypted form and are accessible only to authorised application processes. Access through OAuth 2.0 is limited to the permissions granted by the Organisation, and the Organisation can revoke any mailbox credential at any time through its email provider.

Where we act as Data Fiduciary — for Account Information and Usage Information (Sections 4.1–4.2) — and a breach is likely to cause harm, we will notify the Data Protection Board of India and affected Data Principals in the manner and within the timelines prescribed under the DPDP Act and Rules.

Where we act as Data Processor — for Organisational Data (Section 4.3) — we will notify the relevant Organisation without undue delay and provide reasonable cooperation; the Organisation, as Data Fiduciary, is responsible for notifying the Data Protection Board and affected Data Principals. Further detail is set out in our Data Processing Addendum.

11. Processing of Children's Personal Data

The Service is intended for professional use by individuals aged 18 years or over. Organisations must not permit any individual below the age of 18 to access or use the Service under their account. If we are informed, or become aware, that an individual below 18 has an account, we will delete that account and the personal data we have collected from that individual. We do not knowingly carry out tracking, behavioural monitoring, or targeted advertising directed at children, and do not process children's personal data in a manner likely to cause them detrimental effect. Organisational Data may incidentally include personal data of children (for example, a client's family members); the Organisation, as Data Fiduciary, is responsible for obtaining verifiable parental consent and otherwise complying with the DPDP Act in respect of it.

12. Cookies and Similar Technologies

The platform uses cookies and similar technologies for two purposes:

• Essential cookies: required for authentication, session management, and core security functions. These are set automatically and cannot be disabled without affecting the functionality of the Service.

• Non-essential cookies: used for analytics or improving user experience. These are activated only after you provide consent, which you may withdraw at any time through your browser or in-app cookie settings.

13. AI and Automated Processing

The Service includes features that use artificial intelligence and machine learning ("AI Features"), including:

• An AI-powered chatbot (text and voice) that can query firm data, draft notices, legal documents, and client emails, provide regulatory or procedural guidance, and, at your request and only after you confirm, create or update Entities and upload documents to Entities;

• Analysing or generating summaries of Documents uploaded to the chatbot;

• Where and when made available, automatic summarisation of long emails and comments within an Entity; and

• AI-assisted drafting of, and replies to, emails in Entity comments, which are sent only when a User chooses to send them.

Identifying which Entity an email relates to is done by rule-based matching of the key in the email subject, not by AI. At present, emails are shown as their opening lines with an option to expand the full email. If AI summarisation of emails is made available, personal identifiers will be masked while the summary is generated, and the resulting summary will form part of Organisational Data. Other AI outputs, such as chatbot responses, are kept as chatbot conversation history (Section 4.2) and are not stored on an Entity unless a User chooses to save them there.

These AI Features are powered by AI models operated by one or more third-party AI providers, who act as our sub-processors. Different AI Features and use cases may be routed to different underlying models depending on the task (for example, general chat and drafting, structured data queries, or document/image analysis). The current AI provider(s) and the specific models in use are set out in our Data Processing Addendum, Schedule A, and are available to individual Users on written request to the contact details in Section 17.

Before content is transmitted to an AI provider, we apply an automated redaction/masking process designed to replace personal identifiers with reversible tokens. Because this masking is reversible, the masked content remains personal data under the DPDP Act; the safeguards described in Section 8 (Cross-Border Data Transfer) apply to it where the relevant AI provider processes data outside India.

We do not permit our AI sub-processors to use content submitted through the Service to train their models. We will not train our own machine learning models on your Organisational Data without your Organisation's explicit, separately obtained consent.

AI Features are designed to assist Users and do not replace human review. See the Terms and Conditions, Section 4 (AI Features and Disclaimer), for the scope and limitations of these features and your responsibilities when using them. Full detail on our AI sub-processors and the redaction process is set out in our Data Processing Addendum, Sections 7.2–7.3 and Schedule A.

14. Your Rights as a Data Principal

Subject to the DPDP Act and its Rules, and to the extent the Company is the relevant Data Fiduciary for the personal data concerned, you have the right to:

• Access information: obtain a summary of the personal data we hold about you and the processing activities undertaken with respect to it.

• Correction and completion: request correction of inaccurate or misleading personal data, and completion of incomplete personal data.

• Erasure: request erasure of personal data that is no longer necessary for the purpose for which it was collected, unless retention is required by law.

• Grievance redressal: raise a grievance regarding the processing of your personal data and receive a response within the timeline prescribed under the DPDP Rules.

• Nomination: nominate another individual to exercise these rights on your behalf in the event of your death or incapacity.

• Withdraw consent: as described in Section 6 above.

To exercise these rights, contact our Grievance Officer using the details in Section 15. We may need to verify your identity before acting on a request. If your Organisation is the Data Fiduciary for the personal data in question (see Section 3), we may direct your request to your Organisation Admin, who is responsible for responding to it.

15. Grievance Redressal

In accordance with the DPDP Act, the Company has appointed a Grievance Officer to address complaints and requests relating to the processing of personal data.

Grievance Officer: Grievance Officer (Intauryx)

Email: support@intauryx.com 

We will acknowledge and respond to grievances within the timeline prescribed under the DPDP Rules. If you are not satisfied with our response, you may escalate your complaint to the Data Protection Board of India.

16. Changes to this Privacy Policy

This Privacy Policy may be updated periodically. Updates will be reflected by revising the "Last Updated" date. Where changes materially affect how we process your personal data, we will seek fresh consent or provide notice as required under the DPDP Act.

17. Contact Us

If you have any questions about this Privacy Policy, please contact us at:

Email: support@intauryx.com