Privacy Policy

1. Scope

This Privacy Policy describes how we handle your personal information for our Service on the Ostrya AI websites and tools. It applies generally to information collected on the ostryaai.com website and content (collectively, the "Site" or "Sites") or through the use of our Service. Capitalized terms used in this Privacy Policy shall have the meaning set forth herein or in the User Agreement posted on the Site.

This Privacy Policy constitutes the privacy notice provided by Abscissa AI LLP ("Ostrya") to Data Principals in accordance with the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Digital Personal Data Protection Rules, 2025 ("DPDP Rules"), to the extent applicable to the relevant processing.

If you established an Ostrya AI account before the "last revised" date above, this Privacy Policy is effective as of 21 August 2026. For all other individuals, this Privacy Policy is effective immediately.

2. Types of data we collect

We may collect and store the following Personal Data.

DPDP notice — what data we collect and why

Personal Data	Purpose	Service/use enabled
Name, email, phone, account ID	Account creation, authentication and support	Creation and use of Ostrya account
Payment/transaction data	Payments, refunds and settlements	Purchases/refunds
Creator/KYC/tax information	Creator onboarding, verification and payouts	Creator monetisation
Buyer/learner information	Delivery of Creator Content	Courses/digital products
Device/IP/log data	Security, fraud prevention and Platform operation	Secure Platform use
AI inputs (text prompts and files)	AI functionality requested by user	AI-assisted creation tools
Prompts/files/images/PDFs	AI processing requested by user	AI outputs/features
Marketing preferences	Marketing communications	Promotional communications
Connected ad-account data (Creators who connect Meta or Google Ads only)	Showing the Creator their own ad spend, results and marketing return inside Ostrya	Ad-platform integrations (section 12A)
Zoom connection and session data (Creators who connect Zoom, and people who book or register for those Creators' Zoom sessions)	Running the Creator's sessions on the Creator's own Zoom account, sending each attendee their join link, and showing the Creator attendance and engagement for those sessions	Zoom integration (section 12B)

Information you provide to us

Contact information, such as name, user ID, e-mail address, and phone number.
Information necessary for us to remit payments to creators, such as financial account transactional information based on your activities on the Site as a creator (such as item and content you generate or that relates to your account); community discussions, chats, dispute resolution, correspondence through our Site, and correspondence sent to us.
Marketing information, such as your preferences for receiving marketing communications and details about how you engage with marketing communications.
Other personal information you choose to submit to us for a specified purpose disclosed to you.

Information we collect about buyers from or on behalf of our creators

We may collect information about buyers from or on behalf of our creators. The creators determine the scope of the information we collect on their behalf, that they transfer to us, or that we otherwise collect, and the information we receive may vary by creator.
Transactional information based on your activities on the Site as a buyer (such as item and content you purchase).
Your contact information (such as your name, user ID, email address, and billing and other information you provide to purchase a Digital Product).
Other Personal Data that a Creator provides about you where reasonably necessary for a specified and disclosed purpose and permitted under Applicable Data Protection Law.
Where a creator runs a session you book or register for on Zoom through Ostrya, information about your participation that we receive from Zoom, such as when you joined and left and any in-meeting chat messages you sent, as described in section 12B, "Zoom integration".

Our role under Applicable Data Protection Law

Depending on the nature and purpose of the relevant processing activity, Ostrya may act as a Data Fiduciary, Data Processor, or in another capacity recognised under Applicable Data Protection Law.

Where Ostrya determines the purpose and means of processing Personal Data for its own purposes, including account administration, operation and security of the Platform, fraud prevention, payment facilitation, KYC and regulatory compliance, customer support and other purposes described in this Privacy Policy, Ostrya acts as a Data Fiduciary or equivalent entity under Applicable Data Protection Law.

Where Ostrya processes Personal Data solely on behalf of a Creator and in accordance with the Creator's lawful instructions, including certain learner, customer or buyer information processed for delivery of Creator Content, Ostrya may act as a Data Processor or equivalent service provider.

The applicable role depends on the specific processing activity and purpose and does not necessarily apply uniformly to all Personal Data processed through the Platform.

How we use Personal Data

Personal Data	Purpose of processing	Applicable processing basis	Recipients / categories of recipients
Name, email address, phone number and account information	Account creation, authentication, account administration, customer support and provision of Services	Consent or other legitimate use permitted under Applicable Data Protection Law applicable to the relevant processing	Ostrya, hosting and authentication service providers
Payment, transaction, banking, tax and KYC information	Payment processing, settlements, refunds, fraud prevention, KYC, tax and regulatory compliance	Processing necessary for the relevant transaction, legal or regulatory obligation, or other applicable legitimate use permitted under Applicable Data Protection Law	Payment processors, banks, KYC providers, tax and regulatory service providers
Creator information and business information	Creator onboarding, verification, account administration, payouts and compliance	Consent or other applicable legitimate use permitted under Applicable Data Protection Law	Ostrya, payment, KYC and compliance service providers
Learner, buyer or customer information provided by or on behalf of a Creator	Delivery and administration of Creator Content and related services	Creator's lawful instructions and applicable legitimate use permitted under Applicable Data Protection Law	Relevant Creator, Ostrya and authorised service providers
Device, log, IP address and usage information	Platform operation, security, fraud prevention, troubleshooting, analytics and service improvement	Applicable legitimate use permitted under Applicable Data Protection Law, including where permitted for provision and security of the Services	Ostrya, hosting, security and analytics providers
Text prompts, uploaded files and AI inputs	Providing AI-powered features requested by the user	Consent where required and other applicable legitimate use permitted under Applicable Data Protection Law	Ostrya and its AI service provider (Microsoft Azure OpenAI Service)
Marketing preferences and communication information	Sending marketing communications where permitted	Consent where required under Applicable Data Protection Law	Ostrya and authorised communication service providers
Identifier of the Meta or Google account that granted access, and ad-account data a Creator chooses to connect	Reporting the Creator's own advertising spend, performance and attribution inside the Creator's workspace (section 12A)	Consent given by connecting the account, withdrawable at any time by disconnecting	Ostrya and its hosting provider (Microsoft Azure); retrieved from Meta Platforms or Google, and not disclosed to anyone else
Zoom access tokens and account details of a Creator who connects Zoom; names, email addresses, join links, attendance, time in the meeting and in-meeting chat messages of people who book or register for that Creator's Zoom sessions	Creating and managing the Creator's Zoom meetings, registering attendees with Zoom and emailing them their join links, and reporting attendance and engagement to the Creator (section 12B)	For the Creator's own account details: consent given by connecting Zoom, withdrawable at any time by disconnecting. For attendees: the Creator's lawful instructions and applicable legitimate use permitted under Applicable Data Protection Law	The Creator; Zoom Video Communications, Inc.; Ostrya's email service provider (Resend) and hosting provider (Microsoft Azure)

We collect only such Personal Data as is reasonably necessary for the purposes specified in this Privacy Policy or otherwise permitted by applicable law.

Information automatically collected

Your computer or mobile device operating system type and version number, manufacturer and model, device identifier (such as the Google Advertising ID or Apple ID for Advertising), browser type, screen resolution, IP address, the website you visited before browsing to our Site, general location information such as city, state or geographic area; and information about your use of and actions on our Sites, such as pages you viewed, how long you spent on a page, navigation paths between pages, information about your activity on a page, access times, and length of access.

Our service providers and business partners may collect this type of information to help us operate and improve the Platform. We do not use this information to deliver cross-site or behavioural advertising. This information is collected using cookies and similar technologies. Please refer to the Cookies and Similar Technologies section for more details.

We may offer single sign-on services that allow you to use third party login credentials to sign into the Service. With your permission, Ostrya AI may also collect profile information contained in your third-party profile. Ostrya AI may also, for your use, enable you to import information about who you are connected to, as well as enable you to share information with those third-party sites. If you wish to discontinue such sharing, please refer to the settings on the third-party service or your preference page on Ostrya AI.

We may also maintain pages for our company and our products on a variety of third-party platforms, such as Facebook, Twitter, Google+, YouTube, Instagram, and other social networking services. When you interact with our pages on those third-party platforms, the third-party's privacy policy will govern your interactions on the relevant platform. If the third party platform provides us with information about our pages on those platforms or your interactions with them, we will treat that information in accordance with this Privacy Policy.

Sensitive personal information

Personal Data you should not provide. You should not provide Personal Data that is unnecessary for the relevant Service, including highly sensitive or confidential information that Ostrya has not specifically requested, unless specifically requested for a stated purpose.

Where Ostrya requests Personal Data that requires additional safeguards or consent under Applicable Data Protection Law, Ostrya will provide an appropriate notice and obtain any consent or authorisation required before processing such information.

If you voluntarily provide Personal Data that is not reasonably necessary for the relevant Service, Ostrya may delete or restrict such information where permitted by law.

3. Cookies and similar technologies

What are cookies? Cookies are small data files stored on your computer or mobile device by a website. Our Sites may use both session cookies (which expire once you close your web browser) and persistent cookies (which stay on your computer or mobile device until you delete them) to provide you with a more personal and interactive experience on our Site.

We use two broad categories of cookies: (1) first party cookies, served directly by us to your computer or mobile device, which we use to recognize your computer or mobile device when it revisits our Sites; and (2) third party cookies, which are served by service providers or business partners on our Sites, and can be used by such service providers or business partners to recognise your computer or mobile device when it visits other websites.

Cookies we use

Essential cookies — These cookies are essential to provide you with services available through our Site and to enable you to use some of its features. Without these cookies, the services that you have asked for cannot be provided, and we only use these cookies to provide you with those services.
Functionality cookies — These cookies allow our Sites to remember choices you make when you use our Sites. The purpose of these cookies is to provide you with a more personal experience and to avoid you having to re-select your preferences every time you visit our Site.
Analytics and performance cookies — These cookies collect information about traffic to our Sites and about how individuals use our Sites. The information gathered may include the types of information described above in the section titled "Information automatically collected". We use this information to help operate our Site more efficiently, to gather broad demographic information, monitor the level of activity on our Site, and improve the Site, by PostHog. Further information about PostHog can be found at posthog.com.
Social media cookies — These cookies are used when you share information using a social media sharing button or "like" (or similar) button on our Site or you link your account or engage with our content on or through a social networking website such as Facebook or Twitter. The social network will record that you have done this. Social networks use their own cookies.

Advertising and targeting technologies

Ostrya uses the Meta Pixel and Meta Conversions API to measure whether its own advertising on Facebook and Instagram works. On Ostrya's own pages at ostryaai.com (never on a creator's storefront or custom domain), the Pixel records page views, a view of our pricing, and the account sign-up, checkout, free-trial start and subscription payment steps. From our servers we send the same sign-up, checkout, trial and payment events with the plan, the amount and our own order reference, together with Meta's _fbp and _fbc cookie values, your IP address and browser user agent, and a one-way hash of your workspace identifier, so Meta can match the event to the ad you saw. We do not send your name, email address, phone number, payment details or anything you create on the Platform. If you decline analytics in our cookie banner, neither the Pixel nor our servers send these events for you. We keep your IP address and user agent for this purpose for at most 30 days. We do not use Google Ads or other third-party advertising technologies to advertise to you. This is separate from the optional integrations that let a Creator connect the Creator's own Meta or Google Ads ad accounts to Ostrya, which only read that Creator's advertising reports and are described in section 12A, "Connected ad-platform integrations".

If Ostrya introduces such technologies in the future, it will update this Privacy Policy and, where required under Applicable Data Protection Law, provide appropriate notice and obtain any consent required before processing Personal Data for such purposes.

Disabling cookies

You can typically remove or reject cookies via your browser settings. In order to do this, follow the instructions provided by your browser (usually located within the "settings," "help," "tools" or "edit" menus). Many browsers are set to accept cookies until you change your settings.

For further information about cookies, including how to see what cookies have been set on your computer or mobile device and how to manage and delete them, visit allaboutcookies.org.

If you do not accept our cookies, you may experience some inconvenience in your use of our Site. For example, we may not be able to recognize your computer or mobile device and you may need to log in every time you visit our Site.

4. Use of your Personal Data

To provide our Sites and Services

facilitate the creation of and secure your account on our network;
identify you as a User in the system;
send you a welcome e-mail to verify ownership of the e-mail address provided when your account was created;
respond to your inquiries related to employment opportunities or other requests;
provide the Service and customer support you request;
resolve disputes, collect fees, and troubleshoot problems;
prevent, detect, and investigate potentially prohibited or illegal activities, and enforce our User Agreement;
customize, measure and improve our Service and content;
tell you about our Service, service updates, and promotional offers based on your communication preferences;
compare information for accuracy, and verify it with third parties; and other uses as described when we collect the information.

To communicate with you

If you request information from us (such as signing up for our newsletter), register on the Sites, or participate in our contests or promotions, we may send you Ostrya-related marketing communications as permitted by law. You will have the ability to opt out of such communications.

Use of Personal Data about buyers on behalf of our creators

We use personal information we collect about buyers from or on behalf of our creators to provide services only as directed or authorized by the creator. We do not use this information for our own purposes. Typically, our clients direct or authorize us to use personal information collected on their behalf to enable ecommerce and payments functionality on our clients' websites, to manage the delivery of electronic goods, and to deliver communications from the creators to their buyers.

Where Ostrya processes Personal Data solely on behalf of a Creator, Ostrya will process such Personal Data only in accordance with the documented instructions of the Creator and for the purposes for which the Creator has engaged Ostrya. The Creator remains responsible for providing any privacy notice and obtaining any consent required for processing for which the Creator acts as Data Fiduciary. Ostrya will not use such Personal Data for an unrelated independent purpose unless Ostrya is permitted to do so under applicable law and provides any notice or obtains any consent required.

To comply with law

We use your personal information as we believe necessary or appropriate to comply with applicable laws, lawful requests and legal process, such as to respond to requests from government authorities.

For compliance, fraud prevention and safety

We use your personal information as we believe necessary or appropriate to (a) enforce the terms and conditions that govern the Sites; (b) protect our rights, privacy, safety or property, and/or that of you or others; and (c) protect, investigate and deter against fraudulent, harmful, unauthorized, unethical or illegal activity.

We will request your consent to use your personal information where required by law, such as where we would like to send you certain marketing messages. If we request your consent to use your personal information, you have the right to withdraw your consent any time in the manner indicated when we requested the consent or by contacting us. If you have consented to receive marketing communications from our third party partners, you may withdraw your consent by contacting those partners directly.

Where consent is required, Ostrya will obtain consent through a clear affirmative action. Consent will be specific, informed and limited to the specified purpose for which it is requested. Ostrya will not treat acceptance of this Privacy Policy or User Agreement as consent to processing for an unrelated purpose where separate consent is legally required.

Withdrawal of consent. Where processing of Personal Data is based on consent, the Data Principal may withdraw such consent at any time by contacting raghav@ostryaai.com.

To create anonymous data

We may create Anonymous Data records from Personal Data by excluding information that makes the data personally identifiable to you. We use this Anonymous Data to analyze request and usage patterns so that we may enhance the content of our Service and improve site navigation. We reserve the right to use Anonymous Data for analytics and to improve our Services, provided that such data has been anonymised in accordance with applicable law so that no individual is, or can reasonably be, identified from it.

Required information

Where particular Personal Data is required to provide a service, complete a transaction, comply with law or enable a particular feature, Ostrya will identify such information as required at or before the time of collection. Failure to provide required Personal Data may prevent Ostrya from providing the relevant service or feature.

5. Our disclosure of your Personal Data

We may disclose Personal Data to respond to legal requirements, enforce our policies, respond to claims that content violates the rights of others, or protect anyone's rights, property, or safety. Such information will be disclosed in accordance with applicable laws and regulations.

We may also share your Personal Data with:

Service providers under contract who help with our business operations (such as fraud investigations, bill collection, affiliate and rewards programs).
Our subsidiaries and corporate affiliates for purposes consistent with this Privacy Policy.
Our creators, when you make a purchase with them using our Services.
Other third parties to whom you explicitly ask us to send your information (or about whom you are otherwise explicitly notified and consent to when using a specific service).
A third party payments processor to process payments made to us. Currently, we use Razorpay to process our payments. Razorpay may use personal information it collects when processing our payments as directed by us and for certain additional purposes. The information that Razorpay obtains in connection with processing our payments is subject to Razorpay's Privacy Policy.
Third-party artificial intelligence service providers that power the AI-assisted creation features on our Platform. When you use these features, we transmit the relevant inputs you provide, for example, the text prompts and the files (such as PDFs or images) you submit, to our AI service provider so that it can process your request and generate a draft on your behalf. We currently use Microsoft (Azure OpenAI Service) for these features. This provider processes this data under contract solely to provide the feature to you and is required to provide the same or equal level of protection for your data as described in this Privacy Policy. See the "AI service providers" section below for details.
Meta Platforms and Google, only where a Creator has connected an ad account under section 12A, and only to the extent of the read-only API requests needed to retrieve that Creator's own reports and to revoke our access when the Creator disconnects. We do not send these platforms any other Personal Data through the integration.
Zoom Video Communications, Inc., only where a Creator has connected a Zoom account under section 12B, to create and manage that Creator's meetings on the Creator's own Zoom account. This includes the name and email address of each person who books or registers for that Creator's Zoom session, so that Zoom can issue them a join link. Zoom handles this information under its own terms and privacy statement.
Professional advisors, such as lawyers, bankers, auditors and insurers, where necessary in the course of the professional services that they render to us.
Law enforcement, governmental agencies, or authorized third-parties, in response to a verified request relating to a criminal investigation or alleged illegal activity or any other activity that may expose us, you, or any other Ostrya User to legal liability. In such events, we will disclose information relevant to the investigation, such as name, city, state, ZIP code, telephone number, e-mail address, User ID history, IP address, fraud complaints, transaction history, and anything else we may deem relevant to the investigation.
Other business entities with which we perform a business transaction (or potential business transaction), such as a merger, consolidation, or acquisition, in which case we will make reasonable efforts to require that the recipient follow this Privacy Policy with respect to your Personal Data. In the event of an insolvency, bankruptcy or receivership, your Personal Data may also be transferred as a business asset.

6. Account protection

Your password is the key to your account. Use unique numbers, letters and special characters, and do not disclose your Ostrya AI password to anyone. If you do share your password or your Personal Data with others, remember that you are responsible for all actions taken in the name of your account. If you lose control of your password, you may lose substantial control over your Personal Data and may be subject to legally binding actions taken on your behalf. Therefore, if your password has been compromised for any reason, you should immediately notify Ostrya AI and change your password.

7. Your choices

Accessing, reviewing and changing your Personal Data

You may change any of your Personal Data in your account by editing your profile within your account or by sending an e-mail to us at the e-mail address set forth below. You may request deletion of your Personal Data by us, but please note that we may be required to keep this information and not delete it (or to keep this information for a certain time, in which case we will comply with your deletion request only after we have fulfilled such requirements).

Upon your request, we will close your account and remove your Personal Data from view as soon as reasonably possible, based on your account activity and in accordance with applicable law. We do retain Personal Data from closed accounts to comply with law, prevent fraud, collect any fees owed, resolve disputes, troubleshoot problems, assist with any investigations, enforce our User Agreement, and take other actions otherwise permitted by law.

Marketing communications

You may opt out of marketing-related emails by clicking on a link at the bottom of our marketing emails, or by contacting us at raghav@ostryaai.com. You may continue to receive service-related and other non-marketing emails.

Targeted online advertising

Ostrya AI uses the Meta Pixel and Meta Conversions API only to measure and improve its own advertising, as described under "Advertising and targeting technologies" above. Meta may use this information under its own policies, including to show you Ostrya's ads. We do not use Google Ads or similar services to advertise to you, and we do not place advertising technologies on creators' storefronts. Data that a Creator imports by connecting the Creator's own ad accounts (section 12A) is never used for advertising, targeting or building audiences.

We use analytics tools, including PostHog, to understand how users interact with the Platform, improve our services, monitor performance, and enhance the user experience. These analytics are not used to deliver personalised advertisements across third-party websites or applications.

If we introduce targeted advertising or advertising technologies in the future, we will update this Privacy Policy accordingly and, where required by applicable law, provide appropriate notice and obtain any necessary consent before processing your personal information for such purposes.

You may also manage cookies and similar technologies through your browser settings or device settings. Please note that disabling certain cookies may affect the functionality of some features of the Platform.

Do Not Track signals

At present, Ostrya does not respond to browser "Do Not Track" signals because no uniform industry standard currently exists. Some Internet browsers may be configured to send "Do Not Track" signals to the online services that you visit. We currently do not respond to Do Not Track signals. To find out more about "Do Not Track", please visit allaboutdnt.com.

Where we are required by law to collect your personal information, or where we need your personal information in order to provide our services to you, if you do not provide this information when requested (or you later ask to delete it), we may not be able to provide you with our services. We will tell you what information you must provide to receive the services by designating it as required in or on the Sites or through other appropriate means.

8. Security

Ostrya implements reasonable technical and organisational measures appropriate to the nature of the Personal Data and the risks associated with its processing, including access controls, authentication, confidentiality measures, security monitoring and appropriate safeguards for storage and transmission.

Ostrya does not collect or store your full card number, CVV, UPI PIN or banking login credentials; such payment credentials are collected, processed and stored securely by the applicable Payment Provider (such as Razorpay) in accordance with applicable security standards and Reserve Bank of India requirements.

Ostrya maintains procedures for identifying, assessing, containing, investigating and responding to Personal Data breaches and for making notifications to affected Data Principals and competent authorities where required under Applicable Data Protection Law.

No method of electronic transmission or storage can be guaranteed to be completely secure. However, this does not limit or exclude any obligation imposed on Ostrya under Applicable Data Protection Law.

9. International transfers

Ostrya AI is operated by Abscissa AI LLP, an Indian entity. In order to provide our services, your personal information may be transferred to, stored in, or processed in countries other than the country in which you reside. Our primary infrastructure is hosted on Microsoft Azure. Content uploaded to the Platform may be stored and processed on this infrastructure. AI prompts, inputs, and related data submitted when using AI-powered features may be processed by our AI service provider, Microsoft (Azure OpenAI Service), whose processing infrastructure may be located in the United States or other countries where it operates.

Where a Creator connects an ad account (section 12A), the reports are retrieved from Meta's or Google's servers, which may be located outside India, and stored on our Microsoft Azure infrastructure.

Where a Creator connects Zoom (section 12B), the names and email addresses of people who book or register for that Creator's Zoom sessions are sent to Zoom, and meeting, attendance and chat information is received from Zoom. Zoom's servers may be located outside India. We store this information on our Microsoft Azure infrastructure.

We also use other trusted service providers, such as payment processors, email service providers, and content delivery providers, that may process personal information in jurisdictions outside your country of residence.

Where personal information is transferred internationally, we take reasonable steps to ensure that appropriate contractual, technical, and organisational safeguards are implemented to protect your information and that such transfers are carried out in accordance with applicable data protection laws, including the Digital Personal Data Protection Act, 2023 (India) and other applicable legal requirements. Ostrya will comply with any restrictions, requirements or directions issued by the Central Government concerning transfers of Personal Data outside India.

International processing and transfers

Personal Data may be stored or processed in India and other jurisdictions where Ostrya or its authorised service providers operate. For example, Ostrya's infrastructure is provided through Microsoft Azure, and its AI service provider may process relevant AI inputs in jurisdictions in which it operates.

Where Personal Data is processed outside India, Ostrya will comply with Applicable Data Protection Law and any restrictions, requirements or directions applicable to such transfers. Ostrya will take reasonable contractual, technical and organisational measures appropriate to protect Personal Data during such processing.

Where separate notice or consent is required for a particular international processing activity, Ostrya will provide such notice or obtain such consent through the applicable mechanism.

If you have questions regarding our international data transfer practices, you may contact us using the details provided in the Contact us section of this Privacy Policy.

10. Third parties

This Privacy Policy applies only to information collected and processed by Ostrya. The Platform may contain links to third-party websites, applications, payment gateways, AI service providers, advertising platforms whose accounts a Creator chooses to connect (Meta and Google), video-conferencing services a Creator chooses to connect (Zoom), or other services that are not operated or controlled by Ostrya. We are not responsible for the privacy practices or content of such third parties, and users should review the applicable privacy policies before providing personal information to them.

11. Changes to this Privacy Policy

Changes to this Privacy Policy will become effective from the date specified in the updated Privacy Policy or, where no date is specified, upon posting. However, where a change materially affects the purposes, manner or scope of processing of Personal Data and separate notice, consent or other affirmative action is required under Applicable Data Protection Law, Ostrya will provide the required notice and obtain the required consent or affirmative action before undertaking such processing.

Continued use of the Platform following publication of an updated Privacy Policy shall not, by itself, constitute consent to processing for which separate consent is required under Applicable Data Protection Law.

We may (and, where required by law, will) also provide notification of changes in another way that we believe is reasonably likely to reach you, such as via e-mail (if you have an account where we have your contact information) or another manner through the Sites. Any modifications to this Privacy Policy will be effective upon our posting of the new terms and/or upon implementation of the new changes on the Sites (or as otherwise indicated at the time of posting).

12. AI service providers

This section describes what data our AI-assisted creation features collect, how it is collected, how it is used, and the third parties with whom it is shared.

What we collect — When you use an AI-assisted feature, we collect the text prompts and instructions you submit, any files you choose to upload for processing (such as PDFs or images), and the content generated in response to your request (such as a draft course or product title, description, outline, chapters, website copy or generated images).
How we collect it — This data is collected only from the prompts, instructions and files that you actively submit while using an AI-assisted feature. We do not collect any voice, audio, microphone or camera input, and we do not collect any content in the background or outside a session you initiate.
How we use it — We use this data solely to provide the feature to you: to process your request and generate a draft that you can review, edit and choose to publish. We do not use this data for advertising or to train our own models.
Who we share it with — To provide these features we transmit the relevant inputs and the generated content to our AI service provider, Microsoft (Azure OpenAI Service), through Ostrya AI's servers. The provider processes this data under contract solely to provide the service to us and is contractually required to provide the same or an equivalent level of protection for your data as set out in this Privacy Policy. Its processing is also governed by its own privacy terms (Microsoft privacy statement).
Your consent and control — The AI-assisted features operate only on the prompts, instructions and files that you choose to submit. Before your inputs are processed, we present a clear in-app disclosure identifying what is sent and to whom. You may choose not to use these features, and you may stop using them at any time.
Retention — We retain this data only for as long as necessary to provide the feature to you and to meet any legal, accounting or reporting requirements, after which it is deleted or anonymised. This applies to all users regardless of location. You may request deletion of your data by contacting us at raghav@ostryaai.com.

AI-generated outputs are produced solely in response to your requests and are not used by Ostrya to train its own artificial intelligence models.

12A. Connected ad-platform integrations

This section applies only to Creators who choose to connect their own advertising accounts to Ostrya: a Meta ad account (Facebook and Instagram ads), through the Meta Marketing API, or a Google Ads account, through the Google Ads API. It does not apply to buyers or learners. It is also separate from Ostrya's measurement of its own advertising described in section 3, "Advertising and targeting technologies". Connecting an ad account is optional, and nothing in Ostrya requires it.

What we access

When you connect an ad account, Ostrya reads the following from the platform. Access is read-only.

Ad account details — the ad account's identifier, name, currency and reporting time zone and, for Google Ads, the identifier of any manager account through which you reach it.
Campaign structure — the identifiers, names, status and objective (or, for Google Ads, the campaign type) of your campaigns, ad sets or ad groups, and ads.
Daily performance figures — for each campaign, ad set or ad group, and ad, per day: amount spent, impressions, clicks, link clicks, landing-page views, reach, video views, conversions and conversion value, as reported by the platform. These are totals that the platform reports for your ads. Ostrya does not request or receive information identifying the individual people who saw or interacted with your ads.
The connection itself — the identifier that Meta or Google assigns to the account or system user that granted access, which Ostrya user connected it, the permissions granted, and when access expires. For Google we request only the Google Ads permission and a basic sign-in identifier (the OpenID "sub" identifier). We do not request your email address, name or profile from Google.

When you first link an ad account, Ostrya retrieves up to the previous 90 days of performance figures. After that, it refreshes them about once a day. Each refresh re-reads the most recent few weeks, because Meta and Google revise recent figures after the fact.

How we access it

You grant access on Meta's or Google's own consent screen (Facebook Login for Business, or Google's OAuth consent screen). You choose which accounts Ostrya may read, and Ostrya never sees your Meta or Google password. The platform gives Ostrya an access token (for Google, also a refresh token). We encrypt these tokens with AES-256-GCM before storing them, keep the encryption key separately from the database, and never write tokens to logs. Access granted through Facebook Login for Business may not expire on its own. Ostrya therefore keeps the token until you disconnect or remove Ostrya's access at Meta, as described below.

Meta's ads_read permission is read-only. Google does not offer a read-only version of its Google Ads permission, so the permission Google shows you also covers making changes. Ostrya's integration uses it only to read reports. Ostrya does not create, edit, pause or delete campaigns, ads, audiences or budgets, and does not make or change payments, in either platform.

Why we use it

We use this data only to show you your own advertising spend and results in your Ostrya workspace, next to your Ostrya sales, leads and sign-ups. This lets you see your marketing return and which campaigns led to results (attribution). The reports are visible only to people with access to your workspace.

What we do not do with it

We do not sell, rent or license it, and we do not share it with other Creators, advertisers, data brokers or any other third party. The only exceptions are our hosting provider (Microsoft Azure), which stores it on our behalf, and disclosure required by law.
We do not use it for advertising. That means we do not use it to target or retarget ads, build audiences, or advertise Ostrya to you or anyone else.
We do not combine it with other Creators' data, use it to profile individuals, or use it to make decisions about anyone's eligibility for housing, employment, credit, insurance or similar opportunities.
We do not use it to develop, improve or train artificial intelligence or machine-learning models, whether our own or anyone else's.
Ostrya personnel do not read it except with your permission (for example, when you ask support to look at a report), where needed for security or to investigate abuse, to comply with law, or in aggregated form for internal operations.

Google API Services User Data Policy (Limited Use)

Ostrya's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we use information received from the Google Ads API only to provide and improve the user-facing reporting features described in this section. We transfer it to others only as necessary to provide or improve those features, to comply with applicable law, or as part of a merger, acquisition or sale of assets after giving you notice. We never use it to serve advertisements, never sell it, and never use it to develop, improve or train generalised artificial intelligence or machine-learning models. Humans do not read it except as described in "What we do not do with it" above. Our access to the Google Ads API is also subject to the Google Ads API Terms and Conditions.

Meta Platform Terms

Data that Ostrya receives from Meta through the Marketing API is "Platform Data" under Meta's Platform Terms and Developer Policies, and Ostrya processes it in accordance with them. We use it only for the purpose described in this section, we do not sell, license or purchase it, and we do not transfer it except as this section allows. We delete it when you ask us to, as described below, and we support Meta's requirements for data deletion requests.

How long we keep it, and what disconnecting does

While connected — we keep the reports while your workspace is active so that your reports can show history.
Disconnecting in Ostrya (Settings → Integrations → Meta ads or Google Ads → Disconnect) — Ostrya stops reading from the platform immediately, asks Meta or Google to revoke Ostrya's access, and permanently deletes the stored access and refresh tokens. We keep a record that the connection existed (the platform, the granting account's identifier, who connected it, and when) as an audit record of the grant.
Unlinking a single ad account — Ostrya stops refreshing that account. Nothing is deleted, and you can link it again later.
Reports already imported — by default, disconnecting or unlinking does not delete reports Ostrya has already imported. They stay in your workspace so that your historical reports keep working, until you delete them or your workspace is deleted.
Deleting imported reports when you disconnect Meta — if you tick Also delete imported ad data when you disconnect Meta, we permanently delete the linked ad-account records, campaign structure and daily performance figures imported through that Meta connection, together with the tokens. This cannot be undone.
Removing Ostrya's access at Meta — when you remove Ostrya from your Meta business integrations and Meta notifies Ostrya of the removal, we permanently delete the stored tokens for that Meta account. Imported reports are kept as described above. If you also ask Meta to send us a data deletion request, we delete the reports imported through that Meta account as well.
Removing Ostrya's access at Google — Google does not notify Ostrya. The next time Ostrya tries to refresh your reports, Google refuses the request, Ostrya stops refreshing, and your workspace shows that the connection needs to be reconnected. The stored tokens then no longer work, but they remain encrypted in our database until you disconnect in Ostrya or ask us to delete them.

Deleting your ad-account data

For Meta, you can delete imported reports yourself when you disconnect, as described above. To have Ostrya delete everything it holds from a connected ad platform, including imported reports, campaign names, linked-account records and the connection record, email raghav@ostryaai.com from the email address on your Ostrya account. Step-by-step instructions, including how to remove Ostrya's access at Meta and at Google, are on our Data Deletion Instructions page. We will delete the data except where we are required by law to keep something. Where that happens, we will tell you what we kept and why.

12B. Zoom integration

This section applies to Creators who choose to connect their own Zoom account to Ostrya, and to people who book or register for a session that such a Creator runs on Zoom through Ostrya ("attendees"). It also covers information Zoom sends Ostrya about other participants in meetings hosted on that Creator's Zoom account, as described below. Connecting Zoom is optional, and nothing in Ostrya requires it. Meetings are hosted on the Creator's own Zoom account, not on an Ostrya account. Where Ostrya handles attendees' information for a Creator's sessions, it does so on that Creator's behalf, as described in section 2, "Our role under Applicable Data Protection Law". Zoom's own handling of this information is governed by Zoom's terms and privacy statement.

What Ostrya does at Zoom

The Creator grants access on Zoom's own consent screen, and Ostrya never sees the Creator's Zoom password. With that access, Ostrya does the following on the Creator's Zoom account:

Identifies the connected account — reads the connecting Zoom user's user ID, account ID, email address, name and licence type (for example, whether the user has a paid Zoom licence), and settings that show what the account can do: its meeting capacity, and whether the Zoom Webinars add-on and cloud recording are available. Ostrya reads these again from time to time when it renews its access. It does not store the name.
Manages meetings for sessions scheduled through Ostrya — when the Creator schedules a session with Zoom as the meeting platform, Ostrya creates a meeting on the Creator's account with the session's title, start time and duration and an Ostrya reference, with registration required and Zoom's own registration emails turned off. Ostrya changes the meeting's time if the session is rescheduled, and deletes the meeting if the session is cancelled. If an earlier attempt to create a meeting may have failed part-way, Ostrya reads the list of upcoming meetings on the account to find and reuse the meeting it created instead of creating a duplicate. It ignores, and does not store, the other meetings in that list.
Registers attendees — when someone books or registers, Ostrya adds them to the meeting as a registrant, sending Zoom their name and email address, and receives a join link that is personal to them. If the booking is cancelled or moved to a different session, Ostrya removes them as a registrant from the old meeting. Ostrya does this only when Zoom reports that the Creator's Zoom user has a paid (licensed) account. Otherwise attendees receive the meeting's shared join link, and Ostrya sends Zoom nothing about them.
Reads attendance after a session — reads the finished meeting's start and end times and its participant list: each participant's name, email address where Zoom provides it, Zoom's identifiers for them (including their registrant ID), and their join and leave times.
Receives notifications from Zoom — Zoom notifies Ostrya when a meeting hosted by the connected Zoom user starts or ends, when a participant joins or leaves, when an in-meeting chat message is sent, and when the Ostrya app is removed from the Zoom account. These notifications cover meetings hosted by the connected Zoom user, including meetings not scheduled through Ostrya.
Gives up its access when the Creator disconnects — when the Creator disconnects Zoom in Ostrya, Ostrya asks Zoom to remove Ostrya's access to the Creator's Zoom account.

Ostrya does not request access to recordings, transcripts, audio or video, or to the Creator's Zoom contacts.

What Ostrya stores from Zoom

The connection — the access and refresh tokens Zoom issues to Ostrya. We encrypt them with AES-256-GCM before storing them, keep the encryption key separately from the database, and never write tokens to logs. Alongside them we store the connecting Zoom user's account ID, user ID and email address, the licence type and settings described above, the permissions granted, which Ostrya user connected Zoom, and when.
Meeting links — for each session, the Zoom meeting's identifiers and join link. For each attendee registered with Zoom, their registrant ID and personal join link.
Attendance — for each registered attendee of a group session or webinar: when they first joined and last left, their total time in the meeting, how many times they joined, and how many chat messages they sent. Ostrya also marks the attendee's booking as attended or absent. It never overwrites a mark the Creator set by hand.
Participants Ostrya cannot match to a booking — for example, someone who joined with a forwarded link: the name they used in Zoom, their email address if Zoom provides it, and their join and leave times.
In-meeting chat — for each chat message Zoom reports in a group session or webinar: the sender's name, the sender's email address if Zoom provides it, the message text, the recipient type Zoom reports, and when it was sent.
Zoom's notifications as received — each notification described above is stored as Zoom sent it, so that one arriving before Ostrya has finished setting up a session is not lost. These notifications include participants' names, their email addresses where Zoom provides them, join and leave times, and chat message text. Zoom sends them for meetings hosted by the connected Zoom user, including meetings that were not scheduled through Ostrya. Ostrya stores all of them as received, but builds attendance, engagement and chat records only for group sessions and webinars scheduled through Ostrya.

How Ostrya uses Zoom data

To run the Creator's Zoom sessions: creating and updating meetings, registering attendees, and emailing each attendee their join link, with a note when the link is personal and should not be forwarded.
To show the Creator, in the Creator's workspace, who registered and who attended, for how long, whether they rejoined, and how many chat messages they sent, next to Ostrya's own records of whether they went on to visit checkout or buy. Ostrya's screens currently show the number of chat messages for each attendee, not the message text.
To show when a session is live.
To add people who attended a session to the Creator's Leads list, using the name, email address and phone number from their booking and the session's title.
To include webinar registration and attendance totals in the Creator's Analytics reports.

The data is visible only to people with access to the Creator's workspace. Ostrya links each Zoom notification to a workspace using the Zoom account ID recorded when the Creator connected, and rejects notifications from Zoom accounts it does not recognise.

Who Ostrya shares Zoom data with

Zoom Video Communications, Inc., the platform the Creator connected: the session details and attendees' names and email addresses described above, sent to the Creator's own Zoom account.
Our email service provider (currently Resend), which delivers the emails containing each attendee's join link.
Our hosting provider (Microsoft Azure), which stores the data on our behalf.

We do not sell, rent or license Zoom data. Apart from the providers listed above and the AI processing described below, we do not share it with other Creators, advertisers, data brokers or anyone else, except where disclosure is required by law.

What Ostrya does not do with Zoom data

We do not use it for advertising. That means we do not use it to target or retarget ads, build audiences, or advertise Ostrya to anyone.
We do not use it to develop, improve or train artificial intelligence or machine-learning models.
We do not send in-meeting chat messages, participants' names or email addresses, or join and leave times to any AI service provider. If a Creator uses Ostrya's AI assistant and asks it about their bookings or analytics, the assistant can read whether a particular booking was marked as attended (without the attendee's name or email address) and totals such as the number of webinar attendees and their total time attended, some of which Ostrya derives from Zoom. These are processed by our AI service provider (section 12) only to answer the Creator's question.
Ostrya personnel do not read chat messages or attendance records except with the Creator's permission (for example, when the Creator asks support to look into a session), where needed for security or to investigate abuse, or to comply with law.

How long Ostrya keeps Zoom data, and what disconnecting does

While the workspace is active — Ostrya keeps meeting links, attendance, chat messages and stored Zoom notifications, including notifications about meetings that were not scheduled through Ostrya, for as long as the Creator's workspace is active. There is currently no shorter automatic deletion period. This data is deleted when the workspace is deleted or when the Creator asks us to delete it. The stored notifications and the other Zoom-sourced records listed below are also deleted when the app is removed in Zoom while the Zoom account is still connected to Ostrya, unless the Creator allowed Ostrya to keep their data.
Cancelled bookings — when a booking for a Zoom session is cancelled, Ostrya deletes the attendee's registrant ID and personal join link from the booking and asks Zoom to remove them as a registrant. For a one-to-one call, Ostrya asks Zoom to delete the whole meeting.
Disconnecting in Ostrya (Settings → Integrations → Zoom → Disconnect) — Ostrya immediately and permanently deletes the stored access and refresh tokens and the connection record: the Zoom account ID, user ID and email address, licence details and granted permissions. Ostrya then also asks Zoom to remove its access, which normally removes the Ostrya app from the Creator's Zoom account. From then on Ostrya can no longer act on the Creator's Zoom account, and it ignores further notifications from it. Disconnecting does not delete meetings already created on the Creator's Zoom account, which Ostrya can no longer change or cancel. It also does not delete the meeting links, registrations, attendance, chat messages or stored notifications Ostrya already holds. To have those deleted, ask us as described below.
Removing the app in Zoom while it is still connected (Zoom App Marketplace → Manage → Added Apps → Remove) — Zoom notifies Ostrya, and Ostrya permanently deletes the stored tokens and the connection record. Unless Zoom tells Ostrya that the Creator allowed Ostrya to keep their data, Ostrya also permanently deletes, for that workspace, the stored Zoom notifications, chat messages, time-in-meeting records and records of participants it could not match to a booking. Ostrya keeps: the attended or absent marks on bookings, which are part of the Creator's own booking records and can be edited by hand; the Zoom meeting identifiers and join links of sessions, and attendees' registrant IDs and personal join links, so that attendees who have already paid can still join; and leads already added to the Creator's Leads list. This deletion happens only when the app is removed in Zoom while the Zoom account is still connected to Ostrya. Once a Creator has disconnected in Ostrya, Zoom's notices can no longer be linked to a workspace, so to have this data deleted after disconnecting, ask us as described below.
Deleting the workspace — when a Creator's Ostrya workspace is deleted, all the Zoom data described in this section that Ostrya holds for it is deleted with it.
Data held by Zoom — meetings and registrants on the Creator's Zoom account, and Zoom's own records of them, are kept by Zoom under Zoom's terms. Deleting data in Ostrya does not delete them at Zoom.

Deleting your Zoom data

A Creator can have Ostrya delete the Zoom data it holds for the Creator's workspace, including chat messages, attendance and time-in-meeting records, records of unmatched participants, stored notifications and Zoom meeting and registrant details, by emailing raghav@ostryaai.com from the email address on the Creator's Ostrya account. An attendee can ask us to delete Zoom data about them, such as their chat messages or attendance records, by emailing the same address. Because we hold that data on the Creator's behalf, we may refer the request to the Creator as described in section 15. Step-by-step instructions are on our Data Deletion Instructions page. We will delete the data except where we are required by law to keep something. Where that happens, we will tell you what we kept and why.

13. Children's privacy

Where the Services are made available to children, Ostrya will process Children's Personal Data in accordance with Applicable Data Protection Law and the additional requirements applicable to the processing of Children's Personal Data.

Where required by Applicable Data Protection Law, Ostrya will obtain and verify consent from the parent or lawful guardian before processing the Personal Data of a child.

Ostrya will not knowingly undertake tracking, behavioural monitoring, targeted advertising or other processing of Children's Personal Data where such processing is prohibited or restricted under Applicable Data Protection Law.

Where a Creator makes courses, Digital Products or other Services available to children, the Creator shall cooperate with Ostrya and provide all information, declarations, consents and verification reasonably required for compliance with Applicable Data Protection Law.

If Ostrya becomes aware that Children's Personal Data has been collected or processed without the required consent or other legitimate use permitted under Applicable Data Protection Law, Ostrya may restrict processing, suspend the relevant account or delete the relevant Personal Data, subject to applicable law.

For purposes of the DPDP Act, a Child means an individual who has not completed eighteen years of age. Where required by applicable law, Ostrya will obtain verifiable consent of the parent or lawful guardian before processing the Personal Data of a Child. Ostrya will not undertake tracking or behavioural monitoring of Children or direct targeted advertising at Children except where permitted by applicable law.

Parents or lawful guardians may contact Ostrya through the privacy contact mechanism identified in this Privacy Policy to raise a concern or exercise any applicable rights.

14. Retention

We will only retain your personal information for as long as necessary to fulfill the purposes for which we collected it, including for the purposes of satisfying any legal, accounting, or reporting requirements.

To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means, and the applicable legal requirements.

We may retain Personal Data for longer than the period otherwise necessary only where continued retention is required or permitted under Applicable Data Protection Law, including for compliance with legal, tax, accounting or regulatory obligations, prevention or investigation of fraud or security incidents, resolution of disputes, enforcement of contractual rights, or establishment, exercise or defence of legal claims.

Where Personal Data is no longer required for the relevant purpose and no lawful retention requirement applies, Ostrya will delete, erase or anonymise the Personal Data in accordance with its applicable retention and deletion procedures.

When we no longer require the personal information we have otherwise collected about you, we will dissociate such information from the information attached to your content. In some circumstances we may anonymize your personal information (so that it can no longer be associated with you), in which case we may use this information indefinitely without further notice to you.

Data	Retention
Account data	While account active + specified period
Transaction records	Statutory/accounting period
KYC records	Applicable regulatory period
Support records	Defined period
AI inputs	Defined AI retention period
Connected ad-platform access tokens	Until the Creator disconnects the integration, or Meta tells us access was removed (section 12A)
Connected ad-account reports	While the workspace is active, until the Creator asks us to delete them (section 12A)
Zoom access tokens and connection details	Until the Creator disconnects Zoom in Ostrya, or Zoom tells us the app was removed (section 12B)
Zoom meeting, attendance and chat data, and stored Zoom notifications (including those about meetings not scheduled through Ostrya)	While the workspace is active, until the workspace is deleted or the Creator or the attendee asks us to delete it. The Zoom-sourced records are also deleted when the app is removed in Zoom while still connected to Ostrya, unless the Creator allowed Ostrya to keep them (section 12B)
Marketing data	Until withdrawal/inactivity threshold
Security logs	Defined security period

Personal Data will be retained in accordance with Ostrya's Data Retention Schedule and applicable law.

15. Your privacy and data protection rights

Subject to applicable law, including the Digital Personal Data Protection Act, 2023 (India), you have the right to request access to, correction, updating or erasure of your personal data, withdraw your consent (where processing is based on consent), seek redress of your grievances, and exercise any other rights available to you under applicable data protection laws.

Subject to Applicable Data Protection Law and the nature of the relevant processing, you may have rights in relation to your Personal Data, including:

(a) obtaining information about the Personal Data processed by or on behalf of Ostrya and the manner in which it is processed;
(b) requesting correction or updating of inaccurate or incomplete Personal Data;
(c) requesting erasure of Personal Data where the applicable legal requirements for erasure are satisfied;
(d) withdrawing consent where processing is based on consent;
(e) exercising any other rights available to you under Applicable Data Protection Law; and
(f) obtaining grievance redressal in relation to the processing of your Personal Data.

You may exercise applicable rights through the privacy or data-rights mechanism made available by Ostrya or by contacting us at raghav@ostryaai.com. Where a request relates to Personal Data processed by Ostrya solely on behalf of a Creator, Ostrya may refer the request to the relevant Creator where required or permitted by Applicable Data Protection Law.

Ostrya may take reasonable steps to verify your identity before processing a privacy request. We will respond to valid requests within the timelines prescribed by Applicable Data Protection Law. We may retain or continue processing certain information where required or permitted by law, for legitimate business purposes, or to establish, exercise or defend legal claims.

Where a request is declined or cannot be fully actioned because continued processing or retention is required or permitted by law, Ostrya will provide an explanation to the extent permitted by law.

Where applicable, you may also nominate another individual to exercise your rights on your behalf in accordance with the mechanism and requirements prescribed by Applicable Data Protection Law.

16. Use for new purposes

Ostrya will process Personal Data only for the purposes described in this Privacy Policy, applicable privacy notices, or otherwise permitted under Applicable Data Protection Law.

Where Ostrya proposes to process Personal Data for a new or materially different purpose that is not reasonably connected with the purpose for which the Personal Data was collected, Ostrya will provide an appropriate notice and, where required under Applicable Data Protection Law, obtain the consent or other authorisation required for such processing before commencing the relevant processing.

Where processing is based on consent, the relevant consent will be obtained through a clear affirmative mechanism and will be limited to the specified purpose for which it is provided.

Ostrya will not rely solely on continued use of the Platform or acceptance of an updated Privacy Policy as consent where separate consent is required under Applicable Data Protection Law.

17. Grievance redressal

Grievance Officer: Raghav Mandhana, Abscissa AI LLP, J-130, Third Floor, Kirti Nagar, New Delhi-110015. Email: raghav@ostryaai.com. In accordance with the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and other applicable law, the Grievance Officer will acknowledge grievances within 24 to 48 hours and endeavour to resolve them within the timelines prescribed under applicable law.

If you have a concern or grievance regarding Ostrya's processing of your Personal Data, you may submit a privacy-related grievance through the privacy or grievance mechanism made available on the Platform or by contacting Ostrya at the privacy contact details provided in this Privacy Policy.

Ostrya will acknowledge and address grievances in accordance with the timelines and procedures prescribed under Applicable Data Protection Law.

Where a grievance relates to Personal Data processed by Ostrya solely on behalf of a Creator, Ostrya may refer the grievance to the relevant Creator where appropriate and permitted by Applicable Data Protection Law.

Nothing in this section limits any right available to a Data Principal to approach the Data Protection Board or other competent authority where permitted under Applicable Data Protection Law.

18. Contact us

If you have any questions or concerns at all about our Privacy Policy, please feel free to email us at raghav@ostryaai.com.