Priya Agency

AI Business Platform — Trio

Privacy Policy

Last updated: 8 May 2026 · Effective: 8 May 2026

This Privacy Policy describes how Priya Agency ("we", "us", or "Priya Agency") collects, uses, stores, and discloses information when you or your end users use the Priya Agency Trio platform ("the Service"). The Service includes the AI Business Manager (ABM), AI Department Manager (ADM), and Priya Marketplace (PMP) components, the Vikram marketing agent, the ARIA business advisor, and any mobile or progressive web applications operated under priyaagency.com or its subdomains.

1. Information We Collect

1.1 Account information

• Business name, owner name, email address, phone number
• Business address (city, state, country)
• Authentication credentials (password is stored hashed using Argon2)
• Optional profile information you provide (industry, team size, role)

1.2 Connected platform data (Meta / WhatsApp / Google)

When you connect an external platform — Facebook Pages, Instagram Business accounts, WhatsApp Business numbers, Google Workspace — we receive and store:

• OAuth access tokens (encrypted at rest using AES-256-GCM)
• Page identifiers, page names, and category metadata
• Posts, comments, messages, leads, and insights data that you authorize the Service to read or manage
• Webhook event payloads delivered by the platform provider

1.3 Operational data

• Audit logs (action, actor, timestamp, IP address, outcome)
• API call records for rate-limit and billing purposes
• Diagnostic logs (errors, response times) — these are scrubbed of access tokens and message bodies

1.4 AI processing data

When you use the Vikram or ARIA AI agents, the messages and content you submit are passed through large language model providers via our gateway. We retain prompts and responses in our observability system for up to 90 days for quality and safety review, after which they are automatically deleted.

2. How We Use Information

• To operate the Service: deliver posts, fetch leads, send messages, generate AI suggestions
• To authenticate you and authorize access to your tenant data
• To provide customer support and resolve incidents
• To detect and prevent abuse, spam, fraud, and security threats
• To meet legal obligations under Indian and applicable international law
• To improve product quality (using anonymized, aggregated metrics only)

We do not use your business or customer data to train any AI model. We do not sell, rent, or trade your data to third parties.

3. Legal Basis for Processing

We process your information on the following bases: (a) performance of our contract with you; (b) your explicit consent for connected-platform integrations; (c) our legitimate interest in operating and securing the Service; and (d) compliance with legal obligations.

4. Sharing & Disclosure

We share information only with:

• Platform providers — Meta (Facebook, Instagram, WhatsApp), Google, and others — strictly to deliver the actions you authorize
• Sub-processors — cloud hosting (Digital Ocean), email delivery (Resend), and AI/LLM providers, all bound by data-processing agreements
• Law enforcement — only when compelled by valid legal process under Indian law

A current list of sub-processors is available on request at smartai.admin@gmail.com.

5. Data Retention

Data category	Retention
Account information	For the life of your account + 30 days after deletion
Connected-platform tokens	Until you disconnect, then immediately purged
Posts / comments / messages cache	12 months, then archived; 24 months total before deletion
Audit logs	12 months
AI prompts / responses	90 days
Diagnostic logs	30 days

6. Security

• All connected-platform tokens are encrypted at rest with AES-256-GCM
• Passwords are hashed using Argon2id
• Sensitive PII fields are encrypted at the column level
• Database access uses Row-Level Security (RLS) enforcing tenant isolation
• All API requests over the public internet use HTTPS (TLS 1.2+)
• Multi-factor authentication available for owner accounts; OTP-gating on destructive operations
• Regular security audits and dependency scanning

7. Your Rights

You have the right to:

• Access — request a copy of the personal information we hold about you
• Correct — update inaccurate information directly in the platform or by contacting us
• Delete — request deletion of your account and associated data (see Data Deletion)
• Export — receive a machine-readable copy of your data
• Withdraw consent — disconnect any connected platform at any time, which immediately revokes our access
• Object / restrict — object to specific processing or restrict it

To exercise any of these rights, email smartai.admin@gmail.com. We respond within 30 calendar days.

8. International Data Transfers

Our primary infrastructure is located in India. Some sub-processors (e.g. AI providers, Meta, Google) operate globally. Where data is transferred outside India, we rely on standard contractual clauses or equivalent safeguards.

9. Children

The Service is not intended for individuals under 18. We do not knowingly collect personal information from minors. If you believe a minor has provided us information, contact smartai.admin@gmail.com and we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy as the Service evolves or as required by law. We will notify registered users by email of material changes at least 30 days before they take effect. The "Last updated" date at the top of this page always reflects the current version.

11. Grievance Officer (India — DPDP Act)

12. Contact

Questions about this Privacy Policy: smartai.admin@gmail.com