Privacy Policy
How We Handle Your Data
This Privacy Policy explains how Twiraa Creatives Private Limited (CIN U62099HR2025PTC130178) — "Twiraa", "we", "us" — collects, uses, shares, and protects personal data in connection with ADRITHM, our AI-powered marketing platform.
It is issued under the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Information Technology Act, 2000.
Two Types of Data, Two Different Roles
ADRITHM handles two different kinds of personal data, and our obligations differ for each:
Your Account Data (You Control It)
When you create an account, you give us: name, email, phone, company, payment method. You decide whether we collect this. You can ask us for it, correct it, delete it (subject to legal hold), or port it. We will do this within 30 days.
Customer Data (You Upload It, You Control It)
When you upload data about other people — customer lists, CRM exports, leads, WhatsApp contacts — you are responsible for having lawful basis and consent. We process it only on your instructions, only to help you run your campaigns. If a customer asks us about their data, we refer them to you.
What We Collect
You Give Us
- Identity: Name, email, phone, company
- Payment: Card processed by Razorpay (we don't store it)
- Usage: Campaigns created, approvals made, when you log in
- Communications: Support emails, chat, surveys
- Your uploads: Customer lists, CRM files, audience data, WhatsApp contacts
We Collect Automatically
- Device: Device type, browser, OS, IP address
- Cookies: Login sessions, preferences, analytics
- Interactions: Pages visited, features used, errors
How We Use Your Data
| Purpose | Legal Basis | Duration |
|---|---|---|
| Account & login | Contract | While account exists |
| Billing & payments | Contract & tax law | 7 years (tax hold) |
| Security & fraud detection | Legitimate interest | As needed |
| Analytics & improvement | Your consent (cookie) | 1-2 years |
| Support & help | Contract & legitimate interest | 1 year after resolution |
| Legal compliance | Legal obligation | As mandated |
Your Rights Under the DPDP Act
You have the right to:
- Access: Ask what personal data we have about you
- Correction: Fix information you know is wrong
- Erasure: Ask us to delete it (with legal hold exceptions)
- Portability: Download your data in structured format
- Withdraw consent: Control analytics & marketing cookies anytime
- Grievance: File a complaint if we mishandle your data
To exercise any right, email privacy@adrithm.com with your account details. We'll respond within 30 days.
Subprocessors & Cross-Border Transfers
We use third-party services that process personal data:
| Service | Provider | Location |
|---|---|---|
| Database & auth | Supabase | India (Gurugram) |
| Web hosting | Netlify | US (Ohio) |
| Payments | Razorpay | India |
| CDN | Cloudflare | Global |
| Text AI | Anthropic, Google | US |
| Image/Video AI | Google, Black Forest Labs | US |
| Voice AI | ElevenLabs | US |
Important: When you use AI features, your inputs are sent to these providers. Anthropic and Google confirmed they don't train on your data. For Black Forest Labs and ElevenLabs, confirmation is pending. Check the AI Disclaimer for details.
How Long We Keep Your Data
- Active accounts: For as long as you have an account
- After deletion: Within 30 days, with legal hold exceptions
- Analytics & cookies: 1-2 years
- Support tickets: 1 year after resolution
- Customer-uploaded data: As long as you keep it, then 90 days after account inactivity
Questions? Contact Us
- Privacy Officer: privacy@adrithm.com
- Legal/Grievance: legal@adrithm.com
We aim to respond within 30 days. If unresolved, you can lodge a complaint with the relevant data-protection authority under the DPDP Act.