Privacy Policy

1. Scope

This Privacy Policy describes how we handle your personal information for our Service on the Ostrya AI websites and tools. It applies generally to information collected on the ostryaai.com website and content (collectively, the "Site" or "Sites") or through the use of our Service. Capitalized terms used in this Privacy Policy shall have the meaning set forth herein or in the User Agreement posted on the Site.

This Privacy Policy constitutes the privacy notice provided by Abscissa AI LLP ("Ostrya") to Data Principals in accordance with the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Digital Personal Data Protection Rules, 2025 ("DPDP Rules"), to the extent applicable to the relevant processing.

If you established an Ostrya AI account before the "last revised" date above, this Privacy Policy is effective as of 21 August 2026. For all other individuals, this Privacy Policy is effective immediately.

2. Types of data we collect

We may collect and store the following Personal Data.

DPDP notice — what data we collect and why

Personal Data	Purpose	Service/use enabled
Name, email, phone, account ID	Account creation, authentication and support	Creation and use of Ostrya account
Payment/transaction data	Payments, refunds and settlements	Purchases/refunds
Creator/KYC/tax information	Creator onboarding, verification and payouts	Creator monetisation
Buyer/learner information	Delivery of Creator Content	Courses/digital products
Device/IP/log data	Security, fraud prevention and Platform operation	Secure Platform use
AI inputs (text prompts and files)	AI functionality requested by user	AI-assisted creation tools
Prompts/files/images/PDFs	AI processing requested by user	AI outputs/features
Marketing preferences	Marketing communications	Promotional communications

Information you provide to us

Contact information, such as name, user ID, e-mail address, and phone number.
Information necessary for us to remit payments to creators, such as financial account transactional information based on your activities on the Site as a creator (such as item and content you generate or that relates to your account); community discussions, chats, dispute resolution, correspondence through our Site, and correspondence sent to us.
Marketing information, such as your preferences for receiving marketing communications and details about how you engage with marketing communications.
Other personal information you choose to submit to us for a specified purpose disclosed to you.

Information we collect about buyers from or on behalf of our creators

We may collect information about buyers from or on behalf of our creators. The creators determine the scope of the information we collect on their behalf, that they transfer to us, or that we otherwise collect, and the information we receive may vary by creator.
Transactional information based on your activities on the Site as a buyer (such as item and content you purchase).
Your contact information (such as your name, user ID, email address, and billing and other information you provide to purchase a Digital Product).
Other Personal Data that a Creator provides about you where reasonably necessary for a specified and disclosed purpose and permitted under Applicable Data Protection Law.

Our role under Applicable Data Protection Law

Depending on the nature and purpose of the relevant processing activity, Ostrya may act as a Data Fiduciary, Data Processor, or in another capacity recognised under Applicable Data Protection Law.

Where Ostrya determines the purpose and means of processing Personal Data for its own purposes, including account administration, operation and security of the Platform, fraud prevention, payment facilitation, KYC and regulatory compliance, customer support and other purposes described in this Privacy Policy, Ostrya acts as a Data Fiduciary or equivalent entity under Applicable Data Protection Law.

Where Ostrya processes Personal Data solely on behalf of a Creator and in accordance with the Creator's lawful instructions, including certain learner, customer or buyer information processed for delivery of Creator Content, Ostrya may act as a Data Processor or equivalent service provider.

The applicable role depends on the specific processing activity and purpose and does not necessarily apply uniformly to all Personal Data processed through the Platform.

How we use Personal Data

Personal Data	Purpose of processing	Applicable processing basis	Recipients / categories of recipients
Name, email address, phone number and account information	Account creation, authentication, account administration, customer support and provision of Services	Consent or other legitimate use permitted under Applicable Data Protection Law applicable to the relevant processing	Ostrya, hosting and authentication service providers
Payment, transaction, banking, tax and KYC information	Payment processing, settlements, refunds, fraud prevention, KYC, tax and regulatory compliance	Processing necessary for the relevant transaction, legal or regulatory obligation, or other applicable legitimate use permitted under Applicable Data Protection Law	Payment processors, banks, KYC providers, tax and regulatory service providers
Creator information and business information	Creator onboarding, verification, account administration, payouts and compliance	Consent or other applicable legitimate use permitted under Applicable Data Protection Law	Ostrya, payment, KYC and compliance service providers
Learner, buyer or customer information provided by or on behalf of a Creator	Delivery and administration of Creator Content and related services	Creator's lawful instructions and applicable legitimate use permitted under Applicable Data Protection Law	Relevant Creator, Ostrya and authorised service providers
Device, log, IP address and usage information	Platform operation, security, fraud prevention, troubleshooting, analytics and service improvement	Applicable legitimate use permitted under Applicable Data Protection Law, including where permitted for provision and security of the Services	Ostrya, hosting, security and analytics providers
Text prompts, uploaded files and AI inputs	Providing AI-powered features requested by the user	Consent where required and other applicable legitimate use permitted under Applicable Data Protection Law	Ostrya and its AI service provider (Microsoft Azure OpenAI Service)
Marketing preferences and communication information	Sending marketing communications where permitted	Consent where required under Applicable Data Protection Law	Ostrya and authorised communication service providers

We collect only such Personal Data as is reasonably necessary for the purposes specified in this Privacy Policy or otherwise permitted by applicable law.

Information automatically collected

Your computer or mobile device operating system type and version number, manufacturer and model, device identifier (such as the Google Advertising ID or Apple ID for Advertising), browser type, screen resolution, IP address, the website you visited before browsing to our Site, general location information such as city, state or geographic area; and information about your use of and actions on our Sites, such as pages you viewed, how long you spent on a page, navigation paths between pages, information about your activity on a page, access times, and length of access.

Our service providers and business partners may collect this type of information to help us operate and improve the Platform. We do not use this information to deliver cross-site or behavioural advertising. This information is collected using cookies and similar technologies. Please refer to the Cookies and Similar Technologies section for more details.

We may offer single sign-on services that allow you to use third party login credentials to sign into the Service. With your permission, Ostrya AI may also collect profile information contained in your third-party profile. Ostrya AI may also, for your use, enable you to import information about who you are connected to, as well as enable you to share information with those third-party sites. If you wish to discontinue such sharing, please refer to the settings on the third-party service or your preference page on Ostrya AI.

We may also maintain pages for our company and our products on a variety of third-party platforms, such as Facebook, Twitter, Google+, YouTube, Instagram, and other social networking services. When you interact with our pages on those third-party platforms, the third-party's privacy policy will govern your interactions on the relevant platform. If the third party platform provides us with information about our pages on those platforms or your interactions with them, we will treat that information in accordance with this Privacy Policy.

Sensitive personal information

Personal Data you should not provide. You should not provide Personal Data that is unnecessary for the relevant Service, including highly sensitive or confidential information that Ostrya has not specifically requested, unless specifically requested for a stated purpose.

Where Ostrya requests Personal Data that requires additional safeguards or consent under Applicable Data Protection Law, Ostrya will provide an appropriate notice and obtain any consent or authorisation required before processing such information.

If you voluntarily provide Personal Data that is not reasonably necessary for the relevant Service, Ostrya may delete or restrict such information where permitted by law.

3. Cookies and similar technologies

What are cookies? Cookies are small data files stored on your computer or mobile device by a website. Our Sites may use both session cookies (which expire once you close your web browser) and persistent cookies (which stay on your computer or mobile device until you delete them) to provide you with a more personal and interactive experience on our Site.

We use two broad categories of cookies: (1) first party cookies, served directly by us to your computer or mobile device, which we use to recognize your computer or mobile device when it revisits our Sites; and (2) third party cookies, which are served by service providers or business partners on our Sites, and can be used by such service providers or business partners to recognise your computer or mobile device when it visits other websites.

Cookies we use

Essential cookies — These cookies are essential to provide you with services available through our Site and to enable you to use some of its features. Without these cookies, the services that you have asked for cannot be provided, and we only use these cookies to provide you with those services.
Functionality cookies — These cookies allow our Sites to remember choices you make when you use our Sites. The purpose of these cookies is to provide you with a more personal experience and to avoid you having to re-select your preferences every time you visit our Site.
Analytics and performance cookies — These cookies collect information about traffic to our Sites and about how individuals use our Sites. The information gathered may include the types of information described above in the section titled "Information automatically collected". We use this information to help operate our Site more efficiently, to gather broad demographic information, monitor the level of activity on our Site, and improve the Site, by PostHog. Further information about PostHog can be found at posthog.com.
Social media cookies — These cookies are used when you share information using a social media sharing button or "like" (or similar) button on our Site or you link your account or engage with our content on or through a social networking website such as Facebook or Twitter. The social network will record that you have done this. Social networks use their own cookies.

Advertising and targeting technologies

Ostrya does not currently use third-party advertising technologies, including Google Ads, Meta Pixel or similar technologies, to deliver targeted or behavioural advertising based on your activity on the Platform.

If Ostrya introduces such technologies in the future, it will update this Privacy Policy and, where required under Applicable Data Protection Law, provide appropriate notice and obtain any consent required before processing Personal Data for such purposes.

Disabling cookies

You can typically remove or reject cookies via your browser settings. In order to do this, follow the instructions provided by your browser (usually located within the "settings," "help," "tools" or "edit" menus). Many browsers are set to accept cookies until you change your settings.

For further information about cookies, including how to see what cookies have been set on your computer or mobile device and how to manage and delete them, visit allaboutcookies.org.

If you do not accept our cookies, you may experience some inconvenience in your use of our Site. For example, we may not be able to recognize your computer or mobile device and you may need to log in every time you visit our Site.

4. Use of your Personal Data

To provide our Sites and Services

facilitate the creation of and secure your account on our network;
identify you as a User in the system;
send you a welcome e-mail to verify ownership of the e-mail address provided when your account was created;
respond to your inquiries related to employment opportunities or other requests;
provide the Service and customer support you request;
resolve disputes, collect fees, and troubleshoot problems;
prevent, detect, and investigate potentially prohibited or illegal activities, and enforce our User Agreement;
customize, measure and improve our Service and content;
tell you about our Service, service updates, and promotional offers based on your communication preferences;
compare information for accuracy, and verify it with third parties; and other uses as described when we collect the information.

To communicate with you

If you request information from us (such as signing up for our newsletter), register on the Sites, or participate in our contests or promotions, we may send you Ostrya-related marketing communications as permitted by law. You will have the ability to opt out of such communications.

Use of Personal Data about buyers on behalf of our creators

We use personal information we collect about buyers from or on behalf of our creators to provide services only as directed or authorized by the creator. We do not use this information for our own purposes. Typically, our clients direct or authorize us to use personal information collected on their behalf to enable ecommerce and payments functionality on our clients' websites, to manage the delivery of electronic goods, and to deliver communications from the creators to their buyers.

Where Ostrya processes Personal Data solely on behalf of a Creator, Ostrya will process such Personal Data only in accordance with the documented instructions of the Creator and for the purposes for which the Creator has engaged Ostrya. The Creator remains responsible for providing any privacy notice and obtaining any consent required for processing for which the Creator acts as Data Fiduciary. Ostrya will not use such Personal Data for an unrelated independent purpose unless Ostrya is permitted to do so under applicable law and provides any notice or obtains any consent required.

To comply with law

We use your personal information as we believe necessary or appropriate to comply with applicable laws, lawful requests and legal process, such as to respond to requests from government authorities.

For compliance, fraud prevention and safety

We use your personal information as we believe necessary or appropriate to (a) enforce the terms and conditions that govern the Sites; (b) protect our rights, privacy, safety or property, and/or that of you or others; and (c) protect, investigate and deter against fraudulent, harmful, unauthorized, unethical or illegal activity.

We will request your consent to use your personal information where required by law, such as where we would like to send you certain marketing messages. If we request your consent to use your personal information, you have the right to withdraw your consent any time in the manner indicated when we requested the consent or by contacting us. If you have consented to receive marketing communications from our third party partners, you may withdraw your consent by contacting those partners directly.

Where consent is required, Ostrya will obtain consent through a clear affirmative action. Consent will be specific, informed and limited to the specified purpose for which it is requested. Ostrya will not treat acceptance of this Privacy Policy or User Agreement as consent to processing for an unrelated purpose where separate consent is legally required.

Withdrawal of consent. Where processing of Personal Data is based on consent, the Data Principal may withdraw such consent at any time by contacting raghav@ostryaai.com.

To create anonymous data

We may create Anonymous Data records from Personal Data by excluding information that makes the data personally identifiable to you. We use this Anonymous Data to analyze request and usage patterns so that we may enhance the content of our Service and improve site navigation. We reserve the right to use Anonymous Data for analytics and to improve our Services, provided that such data has been anonymised in accordance with applicable law so that no individual is, or can reasonably be, identified from it.

Required information

Where particular Personal Data is required to provide a service, complete a transaction, comply with law or enable a particular feature, Ostrya will identify such information as required at or before the time of collection. Failure to provide required Personal Data may prevent Ostrya from providing the relevant service or feature.

5. Our disclosure of your Personal Data

We may disclose Personal Data to respond to legal requirements, enforce our policies, respond to claims that content violates the rights of others, or protect anyone's rights, property, or safety. Such information will be disclosed in accordance with applicable laws and regulations.

We may also share your Personal Data with:

Service providers under contract who help with our business operations (such as fraud investigations, bill collection, affiliate and rewards programs).
Our subsidiaries and corporate affiliates for purposes consistent with this Privacy Policy.
Our creators, when you make a purchase with them using our Services.
Other third parties to whom you explicitly ask us to send your information (or about whom you are otherwise explicitly notified and consent to when using a specific service).
A third party payments processor to process payments made to us. Currently, we use Razorpay to process our payments. Razorpay may use personal information it collects when processing our payments as directed by us and for certain additional purposes. The information that Razorpay obtains in connection with processing our payments is subject to Razorpay's Privacy Policy.
Third-party artificial intelligence service providers that power the AI-assisted creation features on our Platform. When you use these features, we transmit the relevant inputs you provide, for example, the text prompts and the files (such as PDFs or images) you submit, to our AI service provider so that it can process your request and generate a draft on your behalf. We currently use Microsoft (Azure OpenAI Service) for these features. This provider processes this data under contract solely to provide the feature to you and is required to provide the same or equal level of protection for your data as described in this Privacy Policy. See the "AI service providers" section below for details.
Professional advisors, such as lawyers, bankers, auditors and insurers, where necessary in the course of the professional services that they render to us.
Law enforcement, governmental agencies, or authorized third-parties, in response to a verified request relating to a criminal investigation or alleged illegal activity or any other activity that may expose us, you, or any other Ostrya User to legal liability. In such events, we will disclose information relevant to the investigation, such as name, city, state, ZIP code, telephone number, e-mail address, User ID history, IP address, fraud complaints, transaction history, and anything else we may deem relevant to the investigation.
Other business entities with which we perform a business transaction (or potential business transaction), such as a merger, consolidation, or acquisition, in which case we will make reasonable efforts to require that the recipient follow this Privacy Policy with respect to your Personal Data. In the event of an insolvency, bankruptcy or receivership, your Personal Data may also be transferred as a business asset.

6. Account protection

Your password is the key to your account. Use unique numbers, letters and special characters, and do not disclose your Ostrya AI password to anyone. If you do share your password or your Personal Data with others, remember that you are responsible for all actions taken in the name of your account. If you lose control of your password, you may lose substantial control over your Personal Data and may be subject to legally binding actions taken on your behalf. Therefore, if your password has been compromised for any reason, you should immediately notify Ostrya AI and change your password.

7. Your choices

Accessing, reviewing and changing your Personal Data

You may change any of your Personal Data in your account by editing your profile within your account or by sending an e-mail to us at the e-mail address set forth below. You may request deletion of your Personal Data by us, but please note that we may be required to keep this information and not delete it (or to keep this information for a certain time, in which case we will comply with your deletion request only after we have fulfilled such requirements).

Upon your request, we will close your account and remove your Personal Data from view as soon as reasonably possible, based on your account activity and in accordance with applicable law. We do retain Personal Data from closed accounts to comply with law, prevent fraud, collect any fees owed, resolve disputes, troubleshoot problems, assist with any investigations, enforce our User Agreement, and take other actions otherwise permitted by law.

Marketing communications

You may opt out of marketing-related emails by clicking on a link at the bottom of our marketing emails, or by contacting us at raghav@ostryaai.com. You may continue to receive service-related and other non-marketing emails.

Targeted online advertising

At present, Ostrya AI does not use third-party advertising technologies such as Google Ads, Meta Pixel, or similar services to deliver targeted or behavioural advertising based on your activity on our Platform.

We use analytics tools, including PostHog, to understand how users interact with the Platform, improve our services, monitor performance, and enhance the user experience. These analytics are not used to deliver personalised advertisements across third-party websites or applications.

If we introduce targeted advertising or advertising technologies in the future, we will update this Privacy Policy accordingly and, where required by applicable law, provide appropriate notice and obtain any necessary consent before processing your personal information for such purposes.

You may also manage cookies and similar technologies through your browser settings or device settings. Please note that disabling certain cookies may affect the functionality of some features of the Platform.

Do Not Track signals

At present, Ostrya does not respond to browser "Do Not Track" signals because no uniform industry standard currently exists. Some Internet browsers may be configured to send "Do Not Track" signals to the online services that you visit. We currently do not respond to Do Not Track signals. To find out more about "Do Not Track", please visit allaboutdnt.com.

Where we are required by law to collect your personal information, or where we need your personal information in order to provide our services to you, if you do not provide this information when requested (or you later ask to delete it), we may not be able to provide you with our services. We will tell you what information you must provide to receive the services by designating it as required in or on the Sites or through other appropriate means.

8. Security

Ostrya implements reasonable technical and organisational measures appropriate to the nature of the Personal Data and the risks associated with its processing, including access controls, authentication, confidentiality measures, security monitoring and appropriate safeguards for storage and transmission.

Ostrya does not collect or store your full card number, CVV, UPI PIN or banking login credentials; such payment credentials are collected, processed and stored securely by the applicable Payment Provider (such as Razorpay) in accordance with applicable security standards and Reserve Bank of India requirements.

Ostrya maintains procedures for identifying, assessing, containing, investigating and responding to Personal Data breaches and for making notifications to affected Data Principals and competent authorities where required under Applicable Data Protection Law.

No method of electronic transmission or storage can be guaranteed to be completely secure. However, this does not limit or exclude any obligation imposed on Ostrya under Applicable Data Protection Law.

9. International transfers

Ostrya AI is operated by Abscissa AI LLP, an Indian entity. In order to provide our services, your personal information may be transferred to, stored in, or processed in countries other than the country in which you reside. Our primary infrastructure is hosted on Microsoft Azure. Content uploaded to the Platform may be stored and processed on this infrastructure. AI prompts, inputs, and related data submitted when using AI-powered features may be processed by our AI service provider, Microsoft (Azure OpenAI Service), whose processing infrastructure may be located in the United States or other countries where it operates.

We also use other trusted service providers, such as payment processors, email service providers, and content delivery providers, that may process personal information in jurisdictions outside your country of residence.

Where personal information is transferred internationally, we take reasonable steps to ensure that appropriate contractual, technical, and organisational safeguards are implemented to protect your information and that such transfers are carried out in accordance with applicable data protection laws, including the Digital Personal Data Protection Act, 2023 (India) and other applicable legal requirements. Ostrya will comply with any restrictions, requirements or directions issued by the Central Government concerning transfers of Personal Data outside India.

International processing and transfers

Personal Data may be stored or processed in India and other jurisdictions where Ostrya or its authorised service providers operate. For example, Ostrya's infrastructure is provided through Microsoft Azure, and its AI service provider may process relevant AI inputs in jurisdictions in which it operates.

Where Personal Data is processed outside India, Ostrya will comply with Applicable Data Protection Law and any restrictions, requirements or directions applicable to such transfers. Ostrya will take reasonable contractual, technical and organisational measures appropriate to protect Personal Data during such processing.

Where separate notice or consent is required for a particular international processing activity, Ostrya will provide such notice or obtain such consent through the applicable mechanism.

If you have questions regarding our international data transfer practices, you may contact us using the details provided in the Contact us section of this Privacy Policy.

10. Third parties

This Privacy Policy applies only to information collected and processed by Ostrya. The Platform may contain links to third-party websites, applications, payment gateways, AI service providers, or other services that are not operated or controlled by Ostrya. We are not responsible for the privacy practices or content of such third parties, and users should review the applicable privacy policies before providing personal information to them.

11. Changes to this Privacy Policy

Changes to this Privacy Policy will become effective from the date specified in the updated Privacy Policy or, where no date is specified, upon posting. However, where a change materially affects the purposes, manner or scope of processing of Personal Data and separate notice, consent or other affirmative action is required under Applicable Data Protection Law, Ostrya will provide the required notice and obtain the required consent or affirmative action before undertaking such processing.

Continued use of the Platform following publication of an updated Privacy Policy shall not, by itself, constitute consent to processing for which separate consent is required under Applicable Data Protection Law.

We may (and, where required by law, will) also provide notification of changes in another way that we believe is reasonably likely to reach you, such as via e-mail (if you have an account where we have your contact information) or another manner through the Sites. Any modifications to this Privacy Policy will be effective upon our posting of the new terms and/or upon implementation of the new changes on the Sites (or as otherwise indicated at the time of posting).

12. AI service providers

This section describes what data our AI-assisted creation features collect, how it is collected, how it is used, and the third parties with whom it is shared.

What we collect — When you use an AI-assisted feature, we collect the text prompts and instructions you submit, any files you choose to upload for processing (such as PDFs or images), and the content generated in response to your request (such as a draft course or product title, description, outline, chapters, website copy or generated images).
How we collect it — This data is collected only from the prompts, instructions and files that you actively submit while using an AI-assisted feature. We do not collect any voice, audio, microphone or camera input, and we do not collect any content in the background or outside a session you initiate.
How we use it — We use this data solely to provide the feature to you: to process your request and generate a draft that you can review, edit and choose to publish. We do not use this data for advertising or to train our own models.
Who we share it with — To provide these features we transmit the relevant inputs and the generated content to our AI service provider, Microsoft (Azure OpenAI Service), through Ostrya AI's servers. The provider processes this data under contract solely to provide the service to us and is contractually required to provide the same or an equivalent level of protection for your data as set out in this Privacy Policy. Its processing is also governed by its own privacy terms (Microsoft privacy statement).
Your consent and control — The AI-assisted features operate only on the prompts, instructions and files that you choose to submit. Before your inputs are processed, we present a clear in-app disclosure identifying what is sent and to whom. You may choose not to use these features, and you may stop using them at any time.
Retention — We retain this data only for as long as necessary to provide the feature to you and to meet any legal, accounting or reporting requirements, after which it is deleted or anonymised. This applies to all users regardless of location. You may request deletion of your data by contacting us at raghav@ostryaai.com.

AI-generated outputs are produced solely in response to your requests and are not used by Ostrya to train its own artificial intelligence models.

13. Children's privacy

Where the Services are made available to children, Ostrya will process Children's Personal Data in accordance with Applicable Data Protection Law and the additional requirements applicable to the processing of Children's Personal Data.

Where required by Applicable Data Protection Law, Ostrya will obtain and verify consent from the parent or lawful guardian before processing the Personal Data of a child.

Ostrya will not knowingly undertake tracking, behavioural monitoring, targeted advertising or other processing of Children's Personal Data where such processing is prohibited or restricted under Applicable Data Protection Law.

Where a Creator makes courses, Digital Products or other Services available to children, the Creator shall cooperate with Ostrya and provide all information, declarations, consents and verification reasonably required for compliance with Applicable Data Protection Law.

If Ostrya becomes aware that Children's Personal Data has been collected or processed without the required consent or other legitimate use permitted under Applicable Data Protection Law, Ostrya may restrict processing, suspend the relevant account or delete the relevant Personal Data, subject to applicable law.

For purposes of the DPDP Act, a Child means an individual who has not completed eighteen years of age. Where required by applicable law, Ostrya will obtain verifiable consent of the parent or lawful guardian before processing the Personal Data of a Child. Ostrya will not undertake tracking or behavioural monitoring of Children or direct targeted advertising at Children except where permitted by applicable law.

Parents or lawful guardians may contact Ostrya through the privacy contact mechanism identified in this Privacy Policy to raise a concern or exercise any applicable rights.

14. Retention

We will only retain your personal information for as long as necessary to fulfill the purposes for which we collected it, including for the purposes of satisfying any legal, accounting, or reporting requirements.

To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means, and the applicable legal requirements.

We may retain Personal Data for longer than the period otherwise necessary only where continued retention is required or permitted under Applicable Data Protection Law, including for compliance with legal, tax, accounting or regulatory obligations, prevention or investigation of fraud or security incidents, resolution of disputes, enforcement of contractual rights, or establishment, exercise or defence of legal claims.

Where Personal Data is no longer required for the relevant purpose and no lawful retention requirement applies, Ostrya will delete, erase or anonymise the Personal Data in accordance with its applicable retention and deletion procedures.

When we no longer require the personal information we have otherwise collected about you, we will dissociate such information from the information attached to your content. In some circumstances we may anonymize your personal information (so that it can no longer be associated with you), in which case we may use this information indefinitely without further notice to you.

Data	Retention
Account data	While account active + specified period
Transaction records	Statutory/accounting period
KYC records	Applicable regulatory period
Support records	Defined period
AI inputs	Defined AI retention period
Marketing data	Until withdrawal/inactivity threshold
Security logs	Defined security period

Personal Data will be retained in accordance with Ostrya's Data Retention Schedule and applicable law.

15. Your privacy and data protection rights

Subject to applicable law, including the Digital Personal Data Protection Act, 2023 (India), you have the right to request access to, correction, updating or erasure of your personal data, withdraw your consent (where processing is based on consent), seek redress of your grievances, and exercise any other rights available to you under applicable data protection laws.

Subject to Applicable Data Protection Law and the nature of the relevant processing, you may have rights in relation to your Personal Data, including:

(a) obtaining information about the Personal Data processed by or on behalf of Ostrya and the manner in which it is processed;
(b) requesting correction or updating of inaccurate or incomplete Personal Data;
(c) requesting erasure of Personal Data where the applicable legal requirements for erasure are satisfied;
(d) withdrawing consent where processing is based on consent;
(e) exercising any other rights available to you under Applicable Data Protection Law; and
(f) obtaining grievance redressal in relation to the processing of your Personal Data.

You may exercise applicable rights through the privacy or data-rights mechanism made available by Ostrya or by contacting us at raghav@ostryaai.com. Where a request relates to Personal Data processed by Ostrya solely on behalf of a Creator, Ostrya may refer the request to the relevant Creator where required or permitted by Applicable Data Protection Law.

Ostrya may take reasonable steps to verify your identity before processing a privacy request. We will respond to valid requests within the timelines prescribed by Applicable Data Protection Law. We may retain or continue processing certain information where required or permitted by law, for legitimate business purposes, or to establish, exercise or defend legal claims.

Where a request is declined or cannot be fully actioned because continued processing or retention is required or permitted by law, Ostrya will provide an explanation to the extent permitted by law.

Where applicable, you may also nominate another individual to exercise your rights on your behalf in accordance with the mechanism and requirements prescribed by Applicable Data Protection Law.

16. Use for new purposes

Ostrya will process Personal Data only for the purposes described in this Privacy Policy, applicable privacy notices, or otherwise permitted under Applicable Data Protection Law.

Where Ostrya proposes to process Personal Data for a new or materially different purpose that is not reasonably connected with the purpose for which the Personal Data was collected, Ostrya will provide an appropriate notice and, where required under Applicable Data Protection Law, obtain the consent or other authorisation required for such processing before commencing the relevant processing.

Where processing is based on consent, the relevant consent will be obtained through a clear affirmative mechanism and will be limited to the specified purpose for which it is provided.

Ostrya will not rely solely on continued use of the Platform or acceptance of an updated Privacy Policy as consent where separate consent is required under Applicable Data Protection Law.

17. Grievance redressal

Grievance Officer: Raghav Mandhana, Abscissa AI LLP, J-130, Third Floor, Kirti Nagar, New Delhi-110015. Email: raghav@ostryaai.com. In accordance with the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and other applicable law, the Grievance Officer will acknowledge grievances within 24 to 48 hours and endeavour to resolve them within the timelines prescribed under applicable law.

If you have a concern or grievance regarding Ostrya's processing of your Personal Data, you may submit a privacy-related grievance through the privacy or grievance mechanism made available on the Platform or by contacting Ostrya at the privacy contact details provided in this Privacy Policy.

Ostrya will acknowledge and address grievances in accordance with the timelines and procedures prescribed under Applicable Data Protection Law.

Where a grievance relates to Personal Data processed by Ostrya solely on behalf of a Creator, Ostrya may refer the grievance to the relevant Creator where appropriate and permitted by Applicable Data Protection Law.

Nothing in this section limits any right available to a Data Principal to approach the Data Protection Board or other competent authority where permitted under Applicable Data Protection Law.

18. Contact us

If you have any questions or concerns at all about our Privacy Policy, please feel free to email us at raghav@ostryaai.com.