Privacy Policy

🏢 Who We Are

SetuVision is an AI-powered vision data annotation platform developed and operated by SetuLytix Private Limited, an AI-native business services company that develops intelligent systems to transform customer interactions and build advanced data annotation pipelines. Incorporated in December 2025, the company is headquartered in Anandpur kalu, Rajasthan, India.

This Privacy Policy covers the SetuVision marketing website (vision.setulytix.com) and the SetuVision application platform. When we say "SetuVision", "we", "us", or "our", we mean SetuLytix Private Limited and its SetuVision product.

📋 What Information We Collect

We collect information in the following situations:

• When you visit the website: Your browser may send your IP address to Google's servers when loading Google Fonts. We do not collect or store this ourselves.
• When you book a demo: Demo bookings are handled by cal.com. The information you provide there is governed by cal.com's privacy policy.
• When you use the SetuVision application: To use the platform, you may need to create an account. We collect the information needed to maintain your account, such as your name and email address.
• Images and datasets you upload: Any images, videos, or annotation data you upload to the SetuVision platform remain your property.
• Account Logs / Audit Logs: We may collect technical logs such as authentication events, IP addresses, browser information, API activity, and security-related logs to operate, secure, and troubleshoot the platform.
• Payment Processing: Payment information is processed by Razorpay. We do not store full payment card information.

We do not use analytics trackers, advertising pixels, or retargeting scripts on our marketing website.

⚙️ How We Use Your Information

We use your information only for the following purposes:

• To create and manage your SetuVision account
• To provide you with the annotation and dataset management features of the platform
• To respond to support requests or questions you send us
• To schedule a product demo if you request one
• To improve and maintain the platform
• To send you important product updates or security notices related to your account

We will never sell your personal information to any third party, and we will not use it for advertising purposes.

We process your personal data in accordance with applicable requirements under the GDPR and Indian DPDPA. Below is the list of processing activities, legal bases, and specific retention criteria:

🖼️ Data You Upload to the Platform (AI Transparency & Processor Boundaries)

Any images, videos, annotation labels, or datasets that you upload to SetuVision are your data. We process this data only to provide the platform's annotation and export features to you.

1. Processor vs Controller Relationship

When you upload visual datasets to SetuVision, you act as the Data Fiduciary (or Data Controller) and retain full legal responsibility for having obtained valid consents/legal bases to process that data. SetuLytix acts solely as a Data Processor, executing instructions on your behalf in isolated AWS environments.

Customer Responsibility: You are responsible for ensuring that you have the necessary rights, permissions, and legal basis to upload and process datasets through SetuVision.

2. AI Training Transparency

We are committed to data privacy for your machine learning workflows, recognizing customer ownership of uploaded datasets. We do not use customer-uploaded datasets, images, videos, or annotation labels to train, fine-tune, or improve SetuVision's or SetuLytix's own core proprietary models or algorithms, nor do we share them with third-party model providers. The AI features available on SetuVision (such as Grounding DINO and SAM) execute on secure virtual private cloud instances, ensuring that no customer data is used for training proprietary models.

3. Platform Data Deletion Timeline

You may request deletion of datasets or individual visual files inside your platform workspace. When you click delete:

• The data is immediately flagged as deleted in the application front-end and ceases to be accessible.
• It is physically purged from our active databases and production AWS S3 buckets within reasonable retention periods in compliance with applicable law.
• To ensure disaster recovery and business continuity, encrypted backups of our databases are retained for reasonable retention periods in compliance with applicable law, after which they are permanently overwritten and purged.

4. Support Access & Internal Access Controls

Support Access: Access to customer data is restricted to authorized personnel and only when necessary for support, security, maintenance, or legal obligations.

Restricted Internal Access: Access to customer datasets is limited to authorized personnel and only when required for support, maintenance, security investigations, legal compliance, or customer-requested assistance.

📜 Subprocessors & Data Processing Addendum (DPA)

As a Data Processor, SetuVision engages certain third-party subprocessors to deliver platform infrastructure. All subprocessors are bound by data protection obligations at least as restrictive as those in this Privacy Policy.

1. Core Subprocessor List:

• Amazon Web Services (AWS): Cloud hosting, server infrastructure, and secure dataset storage (S3).
• cal.com: Management of demonstration bookings.
• Web3Forms: Email processing for marketing website inquiry forms.

2. Subprocessor Notification Procedure

We will notify registered account administrators by email or via platform alerts at least thirty (30) days before engaging any new subprocessor. Customers may object to the appointment of a new subprocessor on reasonable data protection grounds by contacting us in writing.

3. Data Processing Addendum (DPA)

Our standard Data Processing Addendum (DPA) includes the Standard Contractual Clauses (SCCs) to govern data transfers from the EU/UK, and aligns with Section 16 of the DPDPA (India). The DPA is available for signature and can be requested by emailing us at info@setulytix.com.

🔗 Third-Party Services

To operate SetuVision, we use the following trusted third-party services:

• Amazon Web Services (AWS S3): Used to store your uploaded images and datasets securely using modern encryption at rest.
• Google Fonts: Used on the marketing website to load fonts. This may cause your browser to send your IP address to Google's servers.
• cal.com: Used for demo booking scheduling. cal.com's own privacy policy applies when you book via their platform.
• AI Models (Grounding DINO, SAM): When you use AI annotation features, your uploaded images are processed by these models within our infrastructure. Your images are not shared with the model providers.
• Razorpay: Used to securely process subscription payments. Your payment details are processed directly by Razorpay under their privacy policy.

🔐 Data Storage, Security & Incident Notification

We take data security seriously and implement industry-standard security controls, including modern encryption in transit and at rest:

• Encryption at rest: All datasets and files are stored securely using modern encryption at rest
• Encryption in transit: All data transmitted between your browser and our platform is encrypted using modern encryption in transit
• Access controls: We use JWT-based authentication to ensure only authorised users can access your account and data
• Role-based permissions: Within the platform, you can control which team members have access to which projects and datasets

No method of electronic transmission or storage is 100% secure. While we implement strong security measures, we cannot guarantee absolute security of your data.

🌍 Data Storage & Cross-Border Transfers

While SetuLytix Private Limited is located in India, we store and process data using global cloud infrastructure providers (primarily Amazon Web Services) located in the United States and other territories. By interacting with our website or platform, you acknowledge that your personal data may be transferred outside your country of residence.

We ensure that all cross-border data transfers comply with applicable local laws. For European users, we execute Standard Contractual Clauses (SCCs) with our sub-processors. For Indian users, we ensure transfers align with Section 16 of the Digital Personal Data Protection Act, 2023 (DPDPA).

🚨 Security Incident & Breach Notification

In the event of a security breach or technical incident affecting your personal data, we will assess the severity of the breach. If there is a risk of harm to you, we will notify you and the appropriate supervisory authorities (such as the Data Protection Board of India or European data protection authorities) within a reasonable timeframe in compliance with applicable law.

💼 Legal Disclosures & Business Transfers

We may disclose your personal information under the following corporate and legal circumstances:

• Legal Obligation: To comply with a subpoena, court order, or search warrant, or to establish, exercise, or defend our legal rights.
• Business Transfers: In the event of a corporate merger, acquisition, consolidation, restructuring, or the sale of all or substantially all of our assets. You acknowledge that your personal information may be transferred to the acquiring or successor entity in such transactions.

🙋 Your Rights & Duties (DPDPA & GDPR Compliance)

Depending on your jurisdiction (such as India under DPDPA or the EU/UK under GDPR), you possess specific rights as a Data Principal or Data Subject. To exercise these rights, email us at info@setulytix.com. We will respond within thirty (30) days.

1. Rights of the Data Principal / Data Subject:

• Access & Summary: Request a summary of the personal data we process and the third parties with whom it has been shared.
• Correction & Erasure: Ask us to update inaccurate data or erase your data once the purpose of collection is completed.
• Consent Withdrawal: Withdraw consent to data processing at any time.
• Right to Nominate (DPDPA): Nominate an individual to exercise your rights on your behalf in the event of death or incapacity.
• Right to Object & Restrict Processing (GDPR): You have the right to object to processing based on legitimate interests, and request the restriction of processing of your personal data under certain conditions.
• Right to Avoid Automated Profiling (GDPR): You have the right to not be subject to automated decision-making or profiling that has legal or significant effects on you.
• Escalation to DPBI (DPDPA): If you have an unresolved complaint, you have the right to escalate the matter to the Data Protection Board of India (DPBI). Please note that under DPDPA rules, you must first exhaust our internal grievance redressal mechanism before approaching the DPBI.

2. Duties of the Data Principal (Under Section 15 of DPDPA):

Under Indian law, you have the following duties when interacting with our platform:

• You must provide only authentic and correct personal information.
• You must not impersonate any other person or suppress material facts.
• You must not register any false or frivolous grievances or complaints. A breach of these duties may subject individuals to penalties under DPDPA rules.

🍪 Cookies & Browser Data

Our marketing website does not place cookies on your browser for tracking or advertising purposes.

The SetuVision application uses essential session cookies or tokens to keep you logged in while you use the platform. These are necessary for the platform to function and are not used for advertising.

Loading Google Fonts on the marketing website may cause your browser to interact with Google's servers. We are working towards self-hosting fonts to eliminate this.

Do Not Track (DNT) & Global Privacy Control (GPC): We do not track visitors across third-party websites or services, and therefore we do not respond to automated "Do Not Track" signals. However, we support and respect the Global Privacy Control (GPC) signal sent by web browsers, which serves as a request to limit data collection.

👶 Children's Privacy

SetuVision is an enterprise and professional tool and is not intended for use by individuals under the age of 18. We do not knowingly collect information from anyone under 18.

If you believe a minor has created an account or submitted information, please contact us and we will address it promptly.

📝 Changes to This Policy

We may update this Privacy Policy as our platform evolves. If we make material changes to this Privacy Policy, we will notify you by email or through a prominent notice on our platform prior to the change becoming effective. Your continued use of the platform after the effective date will be subject to the updated policy.

📬 Contact Us & Grievance Redressal

If you have questions, complaints, or wish to exercise your rights (including consent withdrawal), please reach out to our Grievance Officer designated in accordance with the Indian Digital Personal Data Protection Act, 2023 (DPDPA).

🌴 California Consumer Privacy Act (CCPA/CPRA) Notice

This section applies solely to California residents. It describes how we collect, use, and disclose personal information, and your rights under California law.

1. Information Collected, Sources, and Purposes (Past 12 Months)

In the preceding 12 months, we have collected the following categories of personal information:

• Identifiers: Name, email address, IP address, and unique online identifiers.
  Source: Directly from you (e.g., contact forms, account creation) and automatically from your browser (e.g., network logs).
  Business Purpose: Providing, maintaining, and protecting our services; responding to inquiries; and managing account access.
• Commercial Information: Details regarding demo bookings or services inquired about.
  Source: Directly from your interactions with our scheduling portal (cal.com).
  Business Purpose: Arranging product demonstrations and managing customer relationships.

Sensitive Personal Information: We do not collect or process Sensitive Personal Information (as defined under California law) for the purpose of inferring characteristics about consumers, and we do not use such information for any purposes other than those permitted by the CCPA/CPRA.

2. Disclosures to Third Parties

In the preceding 12 months, we have disclosed the above categories of personal information for business purposes to the following categories of third parties:

• Cloud Infrastructure Providers (AWS): For secure data hosting and application delivery.
• Scheduling Integration Services (cal.com): For booking and organizing demo requests.
• Form Processing Subprocessors (Web3Forms): For transmitting contact inquiries to our email systems.
• Payment Processors (Razorpay): For securely processing payments and transactions.

No Sale or Sharing: We do not sell your personal information to third parties, nor do we "share" it for cross-context behavioral advertising. We have not done so in the preceding 12 months.

3. Your California Rights

You have the right to request access, deletion, and correction of your data, the right to know what personal information has been collected and disclosed, and the right to non-discrimination for exercising these rights. To submit a request, email us at info@setulytix.com.

Authorized Agents: You may designate an authorized agent to submit requests on your behalf. To do so, you must provide the agent with signed written permission, and verify your identity directly with us or confirm that you provided the agent with power of attorney.