Privacy Policy (India)

Last updated: 25 July 2026

Note: This is a drafted starting point, not a substitute for review by a qualified lawyer or data protection professional familiar with India's Digital Personal Data Protection Act, 2023 (DPDP Act). It has not yet received legal review.

1. Who we are

StipuloReady is provided by Stipulo AI Ltd, a company registered in England and Wales (company number 17272510), registered office at 128 City Road, London, EC1V 2NX. Under India's Digital Personal Data Protection Act, 2023, Stipulo AI Ltd acts as the Data Fiduciary for the personal data of Indian users described below (you, as the individual whose data this is, are the Data Principal).

2. Where your data is processed

StipuloReady's infrastructure — servers, database, and file storage — is hosted in the United Kingdom. This means your personal data is processed outside India as a routine part of using the Service, not as an exception. India's DPDP Act permits cross-border transfer of personal data except to countries specifically restricted by the Indian government (none currently apply to the UK) — see Section 7 below for more on this.

3. What we collect

Account information: email address, password (stored as a secure hash, never in plain text), company name, sector, registration number, and region.
Company profile information you choose to add: company overview, case studies, and standard policy text used to inform AI-drafted proposals.
Compliance documents you upload, and their associated category and expiry date — for India-registered vendors, this may include GST registration, MSME/Udyam certificates, and PAN details.
Tender requirement text you paste or upload when generating an AI draft, and the resulting draft content.
Billing information: handled directly by Stripe, our payment processor — we do not store your card details ourselves.
Basic technical/log data generated in the ordinary course of running the Service.

4. How we use it

We use this data to provide the Service: storing and tracking your compliance documents, sending expiry reminder emails (which you can turn off in Settings), generating AI-assisted draft proposals, processing subscription payments, and maintaining account security.

5. Consent

By creating an account and using the Service, you provide consent for us to process your personal data as described in this policy, for the specific purposes of providing the Service. You may withdraw consent at any time by closing your account, subject to Section 9 below.

6. Who we share data with

We use the following processors to provide the Service:

Neon — hosts our database (account data, document metadata, draft content).
Microsoft Azure — hosts our application and stores your uploaded compliance documents (in a private, non-public storage container).
Google (Gemini API) — processes the tender requirement text and company profile information you submit, to generate AI-drafted proposal content.
Stripe — processes subscription payments; we do not receive or store your full card details.
Google (Gmail) — sends transactional emails (verification, expiry reminders).

We do not sell your personal data.

7. Cross-border data transfer

As noted in Section 2, your data is processed in the United Kingdom. India's detailed cross-border transfer rules under the DPDP Act (including any country-specific restrictions the government may notify) are, as of this policy's last update, still being finalised. We will update this section as those rules become clearer and adjust our practices if required.

8. Your rights as a Data Principal

Under the DPDP Act, you have the right to:

Obtain a summary of your personal data being processed and the processing activities.
Request correction, completion, updating, or erasure of your personal data.
Nominate another individual to exercise these rights on your behalf in the event of death or incapacity.
Withdraw consent at any time.
File a complaint with us, and if unresolved, escalate to the Data Protection Board of India.

To exercise any of these rights, contact us at hello@stipuloai.com.

9. Data retention

We retain your account and document data for as long as your account is active. If you close your account, we will delete or anonymise your personal data within a reasonable period, except where we're required to retain certain records for legal, tax, or accounting purposes.

10. Security

Passwords are stored as secure hashes, not plain text. Uploaded documents are stored in a private container and only ever accessed via short-lived, signed URLs. We use industry-standard practices to protect your data, though no system can be guaranteed 100% secure.

11. Children's data

StipuloReady is a business-to-business service intended for use by adults acting on behalf of a business. It is not directed at children, and we do not knowingly collect data from anyone under 18.

12. Changes to this policy

We may update this Privacy Policy from time to time, including as India's DPDP Act rules and enforcement guidance continue to develop. Material changes will be reflected by an updated "Last updated" date above.

13. Contact / Grievance Officer

Questions about this policy, your data, or grievances under the DPDP Act: hello@stipuloai.com. (Note: this uses our general contact address; whether DPDP compliance expects a named Grievance Officer specifically is an open item for legal review.)