Privacy Policy

How Clepto.in collects, uses, shares and protects personal information, and the rights you have under India's DPDP Act, the GDPR, U.S. state privacy laws and the UAE PDPL.

Clepto.in ("Clepto.in," "Clepto," "we," "us," or "our") designs, builds, deploys, and manages production-ready AI automation systems, n8n workflows, custom CRM applications, AI-enhanced websites and apps, voice and messaging agents, executive dashboards, and document intelligence solutions. This Privacy Policy describes how Clepto.in processes personal information that we collect through our website at clepto.in and any other digital or online properties, communications, or services that link to this Privacy Policy, as well as our sales, support, and marketing activities (collectively, the "Service").

1. Personal Information We Collect

A. Information You Provide to Us

Personal information you may provide to us through the Service or otherwise includes:

1. Contact data, such as your first and last name, email address, phone number, professional title/role, company name, company website, and city, state, or country.
2. Demographic and routing data, such as your city, state, country of residence, and time zone (used to route inquiries and schedule consultations in your local time zone).
3. Profile and account data, such as the username, hashed password, and access credentials you may set to access a client portal, dashboard, or managed system we provide as part of the Services, along with your account preferences.
4. Communications data based on our exchanges with you, including when you submit an inquiry via our website contact form, book a discovery or intro call, communicate with us via email, phone, WhatsApp, or voice/chat features, or interact with us on social media.
5. Transactional and project data, such as information relating to or needed to scope, deliver, and bill for services under a Master Service Agreement or Statement of Work, including project requirements, order/invoice numbers, and billing history.
6. Marketing data, such as your preferences for receiving our AI automation insights, newsletters, and marketing communications, and details about your engagement with them.
7. User-generated content and AI input data, such as prompts, questions, chat messages, voice inputs, files, or business documents that you voluntarily input, upload, or transmit when interacting with our website AI assistants, demos, or support channels, together with associated metadata (such as timestamps and formatting).
8. Other data not specifically listed here, which we will use as described in this Privacy Policy or as otherwise disclosed at the time of collection.

B. Third-Party Sources

We may combine personal information we receive from you with personal information falling within the categories identified above that we obtain from other lawful sources, such as:

• Public sources, such as professional networking platforms (e.g., LinkedIn), company websites, and publicly available business registries.
• Partners and referrals, such as business partners, existing clients, or event co-sponsors who refer prospective clients to us.
• Service providers that provide services on our behalf or help us operate the Service or our business (such as scheduling, CRM, analytics, and communication providers).
• Business transaction counterparties in connection with an actual or prospective business restructuring, financing, acquisition, or asset transfer.

C. Automatic Data Collection

We and our service providers may automatically log information about you, your computer or mobile device, and your interaction over time with the Service and our communications, such as:

1. Device data, such as your computer or mobile device's operating system type and version, browser type, screen resolution, device type (e.g., desktop, phone, tablet), IP address (used for security; not stored by our analytics), language settings, and general geographic area (e.g., city, state, or country).
2. Online activity data, such as pages or screens you viewed on Clepto.in, how long you spent on a page, the referring website visited before browsing to the Service, navigation paths between pages, and access timestamps.
3. Communication interaction data, such as whether you opened or clicked links within our transactional or newsletter emails (facilitated via standard email delivery logs from our email service providers).

Data About Others. If you share contact details of colleagues or team members with us (for example, when adding stakeholders to a project or scheduling a call), please ensure you have their permission to do so.

2. Tracking & Other Technologies

• Cookies and Other Technologies: Some of our automatic data collection is facilitated by cookies and similar local storage technologies. We use strictly necessary cookies and local storage (for security, Cloudflare edge protection, session integrity, and storing your cookie preferences) and analytics cookies (Google Analytics 4, which does not log or store IP addresses). You can turn analytics off at any time from the cookie banner, and we treat a Global Privacy Control signal from your browser as an opt-out. We store a record of your cookie preferences on the Service. For full details on the cookies we use and how to manage them, please see our Cookies Policy.
• Chat, Voice, and Artificial Intelligence ("AI") Technologies: Our demos and support channels (such as AI chat, voice, and WhatsApp assistants) use workflow automation powered by n8n, generative AI models provided by OpenAI, Anthropic, Google Gemini, Mistral, and Perplexity, and voice/messaging automation powered by Retell, ElevenLabs, and WATI. When you interact with our AI chatbot, voice agent, or automated messaging channels, these providers may process your text or voice inputs, IP address, general geographic region, and session metadata to generate responses and facilitate the Service. We contractually require these providers to maintain appropriate data protection safeguards and prohibit them from using personal data submitted through our commercial API integrations for generalized AI model training.

3. How We Use Your Personal Information

We use your personal information for the following purposes or as otherwise disclosed at the time of collection:

A. Service Delivery and Operations

We use your personal information to:

• Provide, operate, and maintain the Service;
• Respond to your contact form inquiries, schedule consultations, and scope or deliver projects under a Master Service Agreement and Statement of Work;
• Operate interactive website features, including our AI chat, voice, and WhatsApp/messaging support channels;
• Enable security and fraud-prevention features of the Service;
• Communicate with you about the Service, including sending service-related announcements, project updates, security alerts, and administrative messages; and
• Provide technical and customer support and respond to your questions and feedback.

B. Service Personalization

We may use your personal information to:

• Understand your business needs and automation interests;
• Route your inquiry to the appropriate team member and apply your local time zone; and
• Remember your cookie and communication preferences as you navigate our website.

C. Service Improvement and Analytics

We use personal information to analyze usage of the Service, review AI chat and voice logs from our demos and support channels for accuracy and quality assurance, improve our workflows and website experience, understand which pages are most and least visited, and develop new automation solutions. We use Google Analytics 4 (which does not log or store IP addresses) for website traffic analysis. You can learn more about Google Analytics and install the Google Analytics Opt-out Browser Add-on at tools.google.com/dlpage/gaoptout.

D. Direct Marketing and Newsletters

We may send you direct marketing communications or our curated AI automation newsletter (via Resend or Google Workspace) when you subscribe or where otherwise permitted by law. You may opt out at any time as described in the Your Choices section below. We do not sell your personal information or share it with third-party advertising networks for cross-context behavioral or interest-based advertising.

E. Compliance and Protection

We may use your personal information to:

• Comply with applicable laws (including India's DPDP Act, the GDPR, the FADP, and U.S. State Privacy Laws), lawful requests, and legal process;
• Protect our, your, or others' rights, privacy, safety, or property (including making and defending legal claims);
• Audit our internal processes for compliance with legal and contractual requirements and our internal security policies;
• Enforce our Terms of Use, Master Service Agreement, and Statements of Work; and
• Prevent, identify, investigate, and deter fraudulent, harmful, unauthorized, unethical, or illegal activity, including cyberattacks and abuse.

F. Aggregated, De-Identified, and/or Anonymized Data

We may create aggregated, de-identified, and/or anonymized data from personal information by removing information that makes the data identifiable to any individual, and we will not attempt to re-identify any such data. We may use and share such aggregated, de-identified, or anonymized data for lawful business purposes, such as analyzing performance trends and improving our services. We do not use your identifiable personal information to train, fine-tune, or develop generalized artificial intelligence or machine learning models.

G. Further Uses

If we ever need to use your personal information for a purpose not compatible with the initial purpose for which it was collected, we will request your prior consent.

4. Retention

We retain personal information only for as long as necessary to fulfill the purposes for which we collected it, including satisfying legal, tax, accounting, or reporting requirements, establishing or defending legal claims, and maintaining security. To determine the appropriate retention period, we consider the amount, nature, and sensitivity of the data, potential risk of harm from unauthorized use or disclosure, the purposes of processing, and applicable legal requirements.

Specifically, we apply the following standard retention periods for data where Clepto.in is the Controller:

When we no longer require your personal information, we delete it, anonymize it, or—where immediate deletion from encrypted backups is not technically feasible—securely isolate it from further processing until automated backup rotation purges it.

5. How We Share Your Personal Information

We do not sell your personal information. We may share your personal information only with the following categories of recipients and for the purposes described in this Privacy Policy:

1. Service Providers and Subprocessors: We engage trusted third-party service providers that operate infrastructure, databases, AI models, automation engines, communications, and CRM tools on our behalf. Consistent with our Subprocessors page and Data Processing Addendum, our core service providers across categories are:

(Note: Tools set up in a client's own account are not Clepto's subprocessors. Extra tools used for a specific client project are listed in that project's Statement of Work.)

2. Website Tools: We use Google Analytics 4 to understand aggregate website usage (unless you opt out from the cookie banner), and Web3Forms as a backup service for delivering contact-form enquiries to our inbox. These tools are used only on clepto.in, not for client data.
3. Third Parties Designated by You: We share personal information with third parties where you have instructed us or provided your consent to do so.
4. Professional Advisors: Lawyers, auditors, accountants, bankers, and insurers, where necessary in the course of the professional services they render to us.
5. Authorities and Legal Compliance: Law enforcement, regulatory bodies (such as the Data Protection Board of India or European Supervisory Authorities), courts, and other parties as we believe in good faith to be necessary or appropriate for the Compliance and Protection purposes described in Section 3(E).
6. Business Transferees: Prospective or actual acquirers, successors, assignees, or counterparties in connection with any business restructuring, financing, merger, sale, or transfer of all or part of our business or assets.

6. Your Choices

In this section, we describe the rights and choices available to all users. Additional statutory disclosures for users in India, U.S. States, and Europe are set out in Sections 14, 15, and 16 below.

• Access, Update, or Delete Your Information: You may request access to, correction of, or deletion of personal information we hold about you (including your website inquiry records or AI chat history) at any time by emailing privacy@clepto.in.
• Opt-Out of Marketing Communications: You may opt out of marketing or newsletter emails at any time by clicking the Unsubscribe link at the bottom of the email or by emailing privacy@clepto.in with the word "Unsubscribe" or "Withdraw". You may continue to receive service-related or transactional communications regarding active projects or inquiries.
• No AI Model Training on Identifiable Data: We do not use your identifiable personal information to train or fine-tune generalized AI or machine learning models, and we contractually prohibit our AI service providers from doing so via our commercial API integrations.
• Cookies and Tracking Technologies: You can opt out of analytics from the cookie banner on Clepto.in (clear this site's data in your browser to see the banner again), through your browser settings, or by installing the Google Analytics Opt-out Browser Add-on. See our Cookies Policy for details.
• Global Privacy Control (GPC) and Do Not Track: While we do not sell or share personal information for cross-context behavioral advertising, we honor Global Privacy Control ("GPC") signals: if your browser sends one, we do not load Google Analytics. Learn more at globalprivacycontrol.org.
• Declining to Provide Information: We need certain basic contact details (such as your name, email address, and message) to respond to your inquiries or deliver services. If you decline to provide mandatory information, we may not be able to respond to your request or provide the Services.

7. Other Sites and Services

The Service may contain links to websites, applications, and online services operated by third parties (such as LinkedIn, X/Twitter, Instagram, Facebook, Telegram, or AI provider documentation). These links are not an endorsement of, or representation that we are affiliated with, any third party. We do not control third-party websites or services and are not responsible for their privacy practices. We encourage you to review the privacy policies of any third-party sites you visit.

8. Security

We employ technical, organizational, and administrative safeguards designed to protect the personal information we collect—including TLS 1.2/1.3 encryption in transit, encryption at rest in managed databases (Supabase), Cloudflare network and WAF protection, role-based access control (RBAC), row-level security (RLS), cryptographic password hashing, and a 48-hour security incident notification protocol for client workflows under our DPA. However, security risk is inherent in all internet and information technologies, and we cannot guarantee absolute security of your personal information.

9. International Data Transfer

Clepto.in is based in Indore, Madhya Pradesh, India, and utilizes service providers operating in India, the European Union, the United States, and globally (as listed in Section 5 and on our Subprocessors page). As a result, your personal information may be transferred to and processed in India, the European Union, the United States, or other jurisdictions where privacy laws may differ from those in your state, province, or country.

When we transfer personal information across borders, we implement appropriate legal and technical safeguards—including the European Commission's Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum, Swiss FADP transfer safeguards, Transfer Impact Assessments (TIAs), and encryption in transit and at rest. Users in Europe should review Section 16 (Notice to European Users) below for further details.

10. Children

The Service is intended for business and professional use and is not intended for use by anyone under 18 years of age (or under 16 years of age where a lower threshold applies under GDPR). We do not knowingly collect personal information from children under 18. If you are a parent or guardian and believe we have collected personal information from a child in a manner prohibited by law, please contact us at privacy@clepto.in, and we will promptly delete the information.

11. Changes to This Privacy Policy

We reserve the right to modify this Privacy Policy at any time. If we make material changes to this Privacy Policy, we will notify you by updating the "Last Updated" date at the top of this Privacy Policy and posting the updated version on clepto.in/privacy (or by email notification where appropriate). Your continued use of the Service after the effective date of an updated Privacy Policy constitutes your acknowledgment of the modified terms. Previous versions are available upon request at privacy@clepto.in.

12. Governing Law and Jurisdiction

Except where mandatory provisions of applicable data protection laws (such as the GDPR, UK GDPR, Swiss FADP, or U.S. State Privacy Laws) require otherwise—or where EU Restricted Transfers under our DPA are governed by the laws and courts of Ireland—this Privacy Policy and any general disputes arising out of or relating to it shall be governed by the laws of India, with exclusive jurisdiction vested in the courts at Indore, Madhya Pradesh, India.

13. How to Contact Us

If you have questions about our privacy practices or wish to exercise any privacy right available to you, please contact us:

• Data Protection Contact: Clepto Data Protection Team — privacy@clepto.in
• Grievances (India / DPDP Act): grievance@clepto.in
• General Inquiries: contact@clepto.in
• Location: Clepto.in, Indore, Madhya Pradesh, India
• Phone: +91-8383898958 / +353-899877801

14. Notice to Indian Users (DPDP Act, 2023)

India's Digital Personal Data Protection Act, 2023 (the "DPDP Act") governs how we handle digital personal data in India. Under the DPDP Act, you are the Data Principal, and Clepto.in is the Data Fiduciary in respect of personal data collected directly through our website and marketing channels.

A. Consent and Withdrawal of Consent

Before submitting our website contact form or subscribing to our newsletter, we ask for your free, specific, informed, unconditional, and unambiguous consent. You have the right to withdraw your consent at any time as easily as you gave it by emailing privacy@clepto.in with the word "Withdraw" from the email address you used. Upon withdrawal, we will cease processing your personal data and delete it within 30 days, unless retention is required under applicable Indian law (such as tax or accounting regulations).

B. Your Rights as a Data Principal (Sections 11–14 of the DPDP Act)

Under the DPDP Act, you have the right to request that we:

1. Access Information (Section 11): Provide a summary of your personal data being processed by us, the processing activities undertaken, and the identities of all other Data Fiduciaries and Data Processors with whom your personal data has been shared.
2. Correction and Erasure (Section 12): Correct inaccurate or misleading personal data, complete incomplete personal data, update your personal data, or erase personal data that is no longer necessary for the purpose for which it was collected (unless legal retention applies).
3. Grievance Redressal (Section 13): Have readily available means of grievance redressal provided by us in respect of any act or omission regarding the performance of our obligations in relation to your personal data or the exercise of your rights.
4. Right to Nominate (Section 14): Nominate any other individual who shall, in the event of your death or incapacity, exercise your rights in accordance with the DPDP Act.

To exercise any of these rights free of charge, email privacy@clepto.in. We will respond within 30 days.

C. Grievance Redressal Mechanism

In accordance with Section 13 of the DPDP Act, if you have any grievance regarding the processing of your personal data or the exercise of your rights, please contact:

• Grievance Redressal Contact: Clepto Data Protection Team
• Email: grievance@clepto.in (Please include "Grievance" in the subject line)
• Location: Indore, Madhya Pradesh, India

We acknowledge grievances within 7 working days and resolve them within 30 days of receipt. If you are not satisfied with our resolution, or if we do not respond within the prescribed period, you have the right to lodge a complaint with the Data Protection Board of India.

D. Duties of Data Principals (Section 15 of the DPDP Act)

In accordance with Section 15 of the DPDP Act, Data Principals are required to comply with applicable laws while exercising their rights, not impersonate another person when providing personal data, not suppress material information, and not register false or frivolous grievances or complaints.

15. State Privacy Rights Notice (United States)

Except as otherwise provided, this section applies to residents of U.S. states (including California, Virginia, Colorado, Connecticut, Texas, Oregon, Montana, Delaware, Iowa, New Hampshire, New Jersey, Nebraska, and other states) to the extent they have comprehensive state privacy laws applicable to us that grant their residents the rights described below (collectively, the "State Privacy Laws").

For purposes of this section, "Personal Information" has the meaning given to "personal data," "personal information," or similar terms, and "Sensitive Personal Information" has the meaning given to "sensitive personal information" or "sensitive data" under the State Privacy Laws.

A. Your U.S. State Privacy Rights

Subject to statutory exceptions and applicability thresholds under the State Privacy Laws, you may have the following rights:

• Information / Right to Know: You can request information about the categories of Personal Information we have collected, the categories of sources, the business or commercial purposes for collecting Personal Information, the categories of third parties to whom we disclose Personal Information for a business purpose, and the specific pieces of Personal Information we have collected about you.
• Access and Portability: You can request a machine-readable copy of the Personal Information that we have collected about you.
• Correction: You can ask us to correct inaccurate Personal Information that we maintain about you.
• Deletion: You can ask us to delete the Personal Information that we have collected from you.
• Appeal: You can appeal our denial of any request validly submitted by emailing privacy@clepto.in with the subject line "Privacy Rights Appeal."
• Opt-Out Disclosures:
  • Targeted Advertising: We do not process your Personal Information for third-party cross-context behavioral or targeted advertising purposes.
  • Sales of Personal Information: We do not "sell" or "share" your Personal Information within the meaning of the CCPA or other State Privacy Laws (including for residents of California, Nevada, and Texas).
  • Profiling / Automated Decision-Making: We do not use your Personal Information to engage in profiling or perform automated decision-making that results in legal or similarly significant impacts on financial standing, housing, education, employment, health care, or criminal justice.
  • Consumers Under 16 / 18: We do not have actual knowledge that we collect, sell, or share the Personal Information of consumers under 16 (or under 18) years of age.
  • Sensitive Personal Information: We do not intentionally collect or process Sensitive Personal Information from website visitors, nor do we process Sensitive Personal Information for the purpose of inferring characteristics about consumers under the CCPA.
• Nondiscrimination: You are entitled to exercise the rights described above free from unlawful discrimination.

B. Exercising Your U.S. State Privacy Rights & Verification

You may submit a request to exercise your state privacy rights by emailing privacy@clepto.in or calling +91-8383898958. We also honor Global Privacy Control ("GPC") signals broadcast by your browser.

Verification of Identity & Authorized Agents: To protect your privacy, we will verify your identity before fulfilling access, correction, or deletion requests—typically by confirming control of the email address associated with your inquiry or asking you to confirm details of your prior interaction with us. If an authorized agent submits a request on your behalf, we may require written, signed permission from you authorizing the agent (or a valid power of attorney) and independent verification of your identity.

C. Notice at Collection & 12-Month CCPA Disclosures

The table below summarizes the Personal Information we collect, the corresponding statutory categories under the CCPA (Cal. Civ. Code § 1798.140), our business/commercial purposes for collection, and the categories of third parties to whom we disclose Personal Information for a business purpose currently and during the preceding 12 months:

California "Shine the Light" Law (Cal. Civ. Code § 1798.83): We do not disclose personal information to third parties for their own direct marketing purposes. California residents may direct any questions regarding this policy to privacy@clepto.in with the subject line "Shine the Light Request."

16. Notice to European Users (EEA, UK, and Switzerland)

A. Scope and Controller Details

This Notice to European Users applies to individuals located in the European Economic Area (EEA), the United Kingdom (UK), and Switzerland (collectively, "Europe"). References to "personal information" in this Privacy Policy include "personal data" as defined under the EU GDPR, the UK GDPR, and the Swiss Federal Act on Data Protection ("FADP").

• Controller: Clepto.in (located in Indore, Madhya Pradesh, India) is the controller in respect of the personal data covered by this Privacy Policy.
• Data Protection Contact: You may contact the Clepto Data Protection Team directly at privacy@clepto.in (or by phone at +353-899877801 / +91-8383898958).

B. Legal Bases for Processing Under the GDPR

In respect of each purpose for which we use your personal data, the GDPR requires us to ensure that we have a valid legal basis:

• Contractual Necessity (Art. 6(1)(b) GDPR): Where we need to perform a contract we are about to enter into or have entered into with you, or take steps at your request prior to entering into a contract.
• Legitimate Interests (Art. 6(1)(f) GDPR): Where it is necessary for our legitimate business interests and your interests and fundamental rights do not override those interests.
• Compliance with Law (Art. 6(1)(c) GDPR): Where we need to comply with a legal or regulatory obligation.
• Consent (Art. 6(1)(a) GDPR): Where we have obtained your specific, freely given consent (which you may withdraw at any time).

The table below sets out the legal bases we rely on for each purpose described in Section 3:

C. Sensitive Personal Data and Automated Decision-Making

• No Sensitive Personal Data: We ask that you do not provide us with any special categories of personal data (e.g., government ID numbers, racial or ethnic origin, political opinions, religious beliefs, health or medical data, biometric or genetic data, criminal history, or trade union membership) through our website or chat features.
• No Automated Decision-Making / Profiling: We do not engage in automated decision-making or profiling (including in our website AI chatbot) that produces legal or similarly significant effects on individuals under Article 22 of the GDPR.

D. Your European Data Protection Rights

If you are located in Europe, you have the right to ask us to take the following actions regarding your personal data:

1. Access (Art. 15 GDPR): Provide information about our processing of your personal data and give you access to a copy of your personal data.
2. Rectification / Correct (Art. 16 GDPR): Update or correct inaccuracies in your personal data.
3. Erasure / Delete (Art. 17 GDPR): Delete your personal data where there is no lawful reason for us to continue processing it or where you have exercised your right to object.
4. Data Portability / Transfer (Art. 20 GDPR): Transfer a machine-readable copy (CSV/JSON) of your personal data to you or a third party of your choice.
5. Restriction (Art. 18 GDPR): Restrict the processing of your personal data (for example, while we verify its accuracy).
6. Objection (Art. 21 GDPR): Object to our processing of your personal data where we rely on Legitimate Interests, or at any time where we process your data for direct marketing.
7. Withdraw Consent (Art. 7(3) GDPR): Withdraw any consent you previously provided at any time, without affecting the lawfulness of processing prior to withdrawal.

Exercising These Rights: Submit your request by emailing privacy@clepto.in. We respond to formal GDPR requests within 30 days.

Right to Lodge a Complaint with a Supervisory Authority: If you are not satisfied with our response or how we process your personal data, you have the right to lodge a complaint with your local data protection authority:

• European Economic Area (EEA): Find your national Data Protection Authority at edpb.europa.eu/about-edpb/about-edpb/members_en, or contact Ireland's Data Protection Commission at dataprotection.ie (info@dataprotection.ie).
• United Kingdom (UK): Contact The Information Commissioner's Office (ICO) at Water Lane, Wycliffe House, Wilmslow, Cheshire SK9 5AF, Tel: +44 303 123 1113, Website: ico.org.uk.
• Switzerland: Contact the Federal Data Protection and Information Commissioner (FDPIC) at edoeb.admin.ch.

E. Data Processing Outside Europe

Because Clepto.in is based in India and uses certain service providers located in the United States and globally (as listed in Section 5), using the Service involves transferring your personal data outside Europe to jurisdictions that may not be subject to a general adequacy decision by the European Commission, the UK Government, or the Swiss Federal Council.

Where we transfer personal data outside Europe to a jurisdiction without an adequacy decision, we ensure a comparable degree of protection by implementing:

1. Standard Contractual Clauses (SCCs) & Addenda: We incorporate the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914, governed by the laws of Ireland), the UK International Data Transfer Addendum, and Swiss FADP variations into our Data Processing Addendum and our agreements with non-EEA service providers (such as OpenAI, Anthropic, Google, Resend, Retell, ElevenLabs, WATI, and Zoho), alongside Transfer Impact Assessments (TIAs).
2. EU-Hosted Infrastructure & Data Minimization: Where configured (such as EU database regions on Supabase and Cloudflare's European edge nodes), we prioritize European regional processing, enforce TLS 1.2/1.3 and at-rest encryption, and minimize the personal data transmitted to third-party AI APIs.
3. Derogations (Art. 49 GDPR): In limited circumstances, such as where you explicitly consent to a transfer or where transfer is necessary to perform a contract or pre-contractual request initiated by you.

You may request further information or a copy of the applicable transfer safeguards by emailing privacy@clepto.in.

17. Notice to Users in the United Arab Emirates

If you are located in the United Arab Emirates, Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "PDPL") may apply to our processing of your personal data. Subject to the PDPL, you may ask us to:

• Access the personal data we hold about you and information about how we process it;
• Correct inaccurate personal data or complete incomplete personal data;
• Erase personal data that is no longer needed for the purpose for which it was collected;
• Restrict or object to processing, including processing for direct marketing; and
• Transfer a copy of your personal data to you or another controller in a structured, machine-readable format.

To exercise these rights, email privacy@clepto.in. We respond within 30 days. Cross-border transfers are protected as described in Section 9. If you are not satisfied with our response, you may complain to the UAE Data Office.