Privacy notice.

This notice is given by ELAN1 AGENTIC TECHNOLOGIES PRIVATE LIMITED (“elan1”, “we”, “us”), the company that operates elan1.ai and provides elan1 Govern, elan1 Work, elan1 Decide and elan1 Run. It is our notice under the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Digital Personal Data Protection Rules, 2025.

Write to us about this notice at elango@elan1.ai, or to our grievance officer.

Our role depends on whose personal data it is and who runs the deployment.

• Data Fiduciary. For personal data elan1 collects for its own purposes (website visitors, contact and design-partner forms, account administration, billing, our own staff and marketing), elan1 is the Data Fiduciary. This notice describes that processing.
• Data Processor. For personal data in customers' systems that elan1 processes on the customer's instructions through elan1 Govern, Work, Decide and Run (hosted deployments), the customer is the Data Fiduciary and ELAN1 AGENTIC TECHNOLOGIES PRIVATE LIMITED acts as its Data Processor, under a data processing agreement. The customer’s own privacy notice governs that data; we process it only on the customer’s documented instructions.
• Customer-operated deployments. In customer-VPC, on-premises and sovereign deployments that the customer operates, elan1 does not process the personal data and is neither, except for any support access the customer grants, where it acts as Processor.
• Legal matters. Legal notices and any legal action under the DPDP Act, 2023, including correspondence with the Data Protection Board of India, are handled by Hariharan (hariharan@elan1.ai), who is also our grievance officer.

If your personal data is held by one of our customers, send requests about it to that customer. If you send them to us, we pass them to the customer and help it respond. How the product handles customer data — residency, keys and subprocessors — is set out on security, residency and data handling and India DPDP Act 2023.

• What you give us in a form. Contact form: name, work email, organisation, role, topic, phone (optional) and message (optional). Design partner application: name, work email, organisation, role, platform, the process you describe, and the role of its approver (optional).
• What you send by email. Your address and whatever you choose to include.
• Product updates. Your work email, if you ask to receive them.
• Account and billing data. For customers: the names, work emails and roles of the people who administer an account, and the billing contact and invoice details needed to bill for the service.
• Technical data. IP address, browser type, pages requested and timestamps in our server logs, used to run and secure the site.
• Preferences. Your cookie choice and reduced-motion setting, stored in your own browser. We do not receive them.
• Analytics. Only if you turn analytics on. See the cookie notice.

We do not ask for sensitive data and ask you not to include it in a message. We do not buy personal data or combine it with data from brokers.

We use personal data only for the purpose stated when we collect it.

We do not sell personal data, use it for advertising, or use it to train models.

When you withdraw consent, or the purpose is served, we stop processing and erase the data within a reasonable time unless the law requires us to keep it.

We store website personal data in India. The product’s residency domain is AWS ap-south-1 (Mumbai). Any processor we use for the website — for example an email provider — is listed in this section, with its location, before we use it.

We share personal data only with processors acting on our instructions under contract, or where the law requires it.

Under the DPDP Act you have the right to:

• Access a summary of the personal data we process about you and the processing we carry out (s.11).
• Correct, complete, update or erase your personal data (s.12).
• Grievance redressal through our grievance officer (s.13).
• Nominate another person to exercise your rights in the event of death or incapacity (s.14).
• Withdraw consent at any time, as easily as you gave it (s.6(4)). Withdrawal does not affect processing already done.

Write to elango@elan1.ai or to the grievance officer at hariharan@elan1.ai. We may ask you to confirm your identity. You may also give or withdraw consent through a consent manager registered with the Data Protection Board of India.

elan1.ai is a business website and is not directed at children. We do not knowingly process the personal data of anyone under 18. If you believe a child has sent us personal data, tell us and we will erase it.

We take reasonable security safeguards to prevent a personal data breach, including encryption in transit, access limited to the people who need it, and logging of access. If a breach occurs, we inform the Data Protection Board of India and each affected person, as the DPDP Act and Rules require. Where we act as a Data Processor, we inform the customer without delay so that it can meet its own duties.

Write first to our grievance officer. We acknowledge your grievance and resolve it within one week of receipt.

If you are not satisfied with the outcome, or we do not respond within one week, you may complain to the Data Protection Board of India. The DPDP Act asks you to use our grievance process first.

We version this notice. When it changes, the version and dates beside it change. If a change affects a purpose you consented to, we ask you again.