Privacy Policy

At ResourcePlan Solution Private Limited, protecting your personal data is our priority. Whether you use the Kaptured.AI platform (the "Platform") as our client (the "Client"), we may collect personal data about you as part of managing our contractual relationship. This policy informs you how we process your personal data in compliance with applicable data protection laws, including Regulation (EU) 2016/679 of 27 April 2016 (General Data Protection Regulation or GDPR), India's Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and relevant federal and state privacy laws in the United States, such as the California Consumer Privacy Act (CCPA), as applicable (together, the "Applicable Regulations").

---

1. Who is the data controller?

The data controller is ResourcePlan Solution Private Limited, an Indian private limited company with its head office at 45-46, Shiv Marg, Guru Jhambeshwar Nagar A, Block E, Vaishali Nagar, Jaipur, Rajasthan 302021 when you browse our Platform or use an account on the Platform as our Client.

---

2. What personal data do we collect?

"Personal data" means any information that identifies an individual, directly or indirectly. We may collect:

• Identification data (e.g. full name, email addresses)
• Professional data (e.g. company name, position/function, company size, website, logo)
• Order data
• Login data (e.g. logs, IP address)
• If you sign in with a third-party service (Google, Microsoft, etc.), we collect the name and email shared by that service. We never receive your third-party password.
• Browsing data (pages viewed, date/time, browser, OS, user ID)
• Location data
• Call recordings / metadata with our customer-care service
• Payment data (billing name and address, GST number, payment method type and the last four digits of a card, and bank details for bank transfers). Full card numbers are entered on Stripe's secure payment page and are never received or stored by us.
• Any other information you voluntarily provide in a contact request.

Where certain data are mandatory, we will tell you at the point of collection.

---

3. Legal basis, purposes and retention periods

The table below summarises how we use your data, on what legal basis, and for how long we keep it:

---

4. Who we share your data with, and how

We do not sell or rent your personal data. We share it only where it is needed for the purposes above, with:

• Our internal staff, on a need-to-know basis
• Our payment service provider, Stripe, which processes card and online payments, prevents fraud and meets its own legal obligations. Stripe handles this data under its own privacy policy at https://stripe.com/privacy.
• Our other processors: AI model providers that generate your images and videos, cloud hosting and storage, email and newsletter services, analytics, invoicing and cookie-management tools
• Professional advisers such as auditors and lawyers, under a duty of confidentiality
• Public authorities, courts or regulators, where the law requires it

How we disclose it. We send data to these parties electronically, over encrypted connections (HTTPS/TLS) or through their secure APIs, and we share only the data each one needs for its task. Our processors act on our instructions under written contracts that require them to keep the data confidential and secure and not to use it for their own purposes. Disclosures to authorities are made only in response to a valid legal request.

---

5. International transfers of personal data

We host data on AWS servers located in the US and EU. Where our processors transfer data outside the US and EU, we ensure appropriate safeguards, such as:

• Transfer to countries recognised by the European Commission as providing adequate protection (GDPR Art. 45); or
• Standard Contractual Clauses, Binding Corporate Rules, approved certification, or other safeguards under GDPR Art. 46; or
• Another lawful derogation under GDPR Chapter V.

---

6. How we keep your data secure

We follow reasonable security practices and procedures, as required by section 43A of the Information Technology Act, 2000 and the rules made under it, including:

• Encryption in transit (HTTPS/TLS) for everything sent to and from our website, client app and team
• Encryption at rest for files and data stored with our cloud providers
• Least-privilege access: only the team members working on your project can open your files, and only while the work needs it
• Established cloud infrastructure on hardened, professionally maintained servers
• Payment card data handled only by Stripe, a PCI DSS certified provider, so full card details never reach our systems
• Account sign-in through email or trusted third-party sign-in (such as Google), without us receiving your third-party password
• Deleting data when its retention period ends, or sooner when you ask

No system is completely secure. If a breach affects your personal data, we will tell you and the relevant authorities as the law requires. More detail is on our Data Security page.

---

7. Your rights over your personal data

You may exercise the following rights at any time, subject to the conditions and scope set out in the applicable data protection laws, including the GDPR (EU), the Digital Personal Data Protection Act, 2023 (India), and relevant U.S. privacy regulations such as the CCPA:

• Right to be informed
• Right of access
• Right to rectification
• Right to restriction of processing
• Right to erasure / "right to be forgotten"
• Right to lodge a complaint with the competent supervisory authority
• Right to define post-mortem instructions for retention, deletion, communication of your data
• Right to withdraw consent at any time, without affecting prior processing
• Right to data portability
• Right to object to processing

To exercise your rights, contact us using the details in Section 9. We may request proof of identity.

---

8. Cookies

Our website and client app use cookies and similar technologies to keep you signed in, remember your settings, keep payments secure (Stripe sets cookies for fraud prevention) and, with your consent, measure how visitors use the site. You can block or delete cookies in your browser settings; the site still works, though you may need to sign in again.

---

9. Contact and Grievance Officer

Email: magic@kaptured.ai
Address: ResourcePlan Solution Private Limited, 45-46, Shiv Marg, Guru Jhambeshwar Nagar A, Block E, Vaishali Nagar, Jaipur, Rajasthan 302021, India

Grievance Officer: Aarushi Jain, Co-founder & COO, aarushi@kaptured.ai, at the address above. Complaints are acknowledged within 48 hours and resolved within one month of receipt.

---

10. Modifications

We may update this privacy policy at any time to reflect regulatory, case-law, editorial or technical changes. The new version will apply from its entry-into-force date. Please consult this page regularly for the latest version. We will notify you of any significant changes.