Introduction and Scope

Personal Information We Collect

1. Information You Provide Directly: When you interact with the Services or Sardine, you maygive us information such as:
2. Identity and Contact Details: For example, your name, email address, phone number, and other contact information. We collect these when you create an account, use the Services, or contact us for support.
3. Customer Support and Communications: The content of your communications withus (such as via email, chat, or phone) and any additional information you choose toprovide when giving us feedback, responding to surveys, or participating in promotions.
4. Information We Collect Automatically: When you use the Services and grant the necessarypermissions on your mobile phone or other device, we may automatically collect the followinginformation:
5. Call Logs: The Services may collect phone numbers associated with incoming andoutgoing calls.
6. Text Messages: The Services may collect information about incoming and outgoing text messages, including sender and recipient contact information and message contents.
7. Notifications: The Services may collect notifications, banners, and alerts displayed on your device, including the name of the app from which the notifications originated and the notification contents.
8. Web Addresses: When you click a hyperlink on your device the Services may collect the web address (also known as a “URL”) that the hyperlink points to.
9. Usage and Device Data: This includes details about your visits and activity on our website or the SardineShield app, such as your IP address, browser type, operating system, referral website (the page you visited before coming to our website), pages or features you access, the dates/times of access, and other information about how you interact   with   our   digital   services.   We   use   this   information   to   understand   user engagement and improve our Services. This data is generally collected via cookies, server logs, and similar tracking technologies.
10. Cookies and Similar Technologies: We use cookies (small text files stored on your browser or device) and related technologies to recognize you when you return to our website, remember your preferences, and gather analytics information. Cookies helpus analyze website traffic and usage patterns so we can enhance user experience. Most browsers automatically accept cookies, but you can modify your browser setting to block or alert you about cookies. Note that if you disable cookies, some features ofour website or Service may not function properly. (See the Cookies and Tracking Technologies section for more details.)
11. Information from Other Sources: In order to provide caller-ID features, detect potential scams and other types of fraud, we may obtain information about you from data vendors and other third parties, including, but not limited to SurePass and InstantPay.

Processing of Third-Party Personal Information

How We Use Personal Information

1. If we intend to use your personal information for a purpose not described in this Policy, we will provide you with additional notice. In some cases, we may also request your consent if required. We do not use your personal information for purposes that are unrelated to our business without telling you and obtaining your permission when required. We do not engage in automated decision-making or profiling that has legal or similarly significant effects without your knowledge and consent (if it ever becomes relevant, we will update you).

1. We do not sell, license, or trade your personal information to third parties for their own marketingor other purposes. All uses of personal data are limited to SardineAI’s internal purposes as described above, or as otherwise disclosed to you.

How We Share Personal Information

1. With Affiliated Companies and Contractors: We may share personal information with our subsidiaries, affiliates, and third-party contractors, including Cheeni Labs Pvt. Ltd., to provide our Services and operate our business.  All entities within our corporate group, as well as our contractors, follow this Policy and are bound to protect your information in the same manner. Access by our employees or personnel is controlled and subject to confidentiality obligations.
2. Service Providers and Data Processors: We work with third-party service providers and data processors that assist us with the provision of our Services. This includes service providers and vendors that provide us with IT support, hosting, fraud detection, identity verification providers, and related services. When we disclose information with third-party service providers in this capacity, we require them to use your information on our behalf in accordance with our instructions and terms and only process your personal information as necessary to provide the Services to you pursuant to the terms of a binding contract between them and SardineAI.
3. Legal Requirements and Safety: We may disclose personal information to courts, law enforcement, government authorities, or other third parties when we believe it is legally requiredto do so. Examples include:
4. Responding to a subpoena, court order, or other binding request from authorities (afterverifying its legitimacy);
5. Sharing information to comply with the law or regulatory obligations (such as reporting requirements to regulators or auditors);
6. Disclosing information if necessary to enforce our terms of service or other agreements, or to investigate and defend ourselves against any third-party claims or allegations;
7. Sharing information to protect against fraud, credit risk, or security vulnerabilities; and
8. In an emergency, sharing information if we believe it will help prevent physical harm or financial loss, or is necessary to protect someone’s vital interests (for instance, releasing information to law enforcement about a credible identity theft or cybercrime situation).
9. Business Transfers: If SardineAI undergoes a business transition, such as a merger, acquisition by another company, reorganization, or sale of all or part of our assets, personal information may be transferred to the successor or acquiring entity as part of that transaction. We would ensure any such transfer is subject to appropriate confidentiality arrangements and that your personal information remains protected. If a change of ownership occurs, we will provide notice on our website or by other means to inform you of any significant changes to how your personal information is handled (and if applicable, any choices you may have).
10. With Your Consent or at Your Direction: Apart from the cases above, we will share your personal information with third parties only if you specifically request or consent to such sharing.
11. No Third-Party Advertising Trackers: As stated in the Cookies section, we do not disclose your personal information to third-party ad networks or social media companies for advertising purposes. We also do not engage in “list sharing” with other companies for joint marketing.

Cookies and Tracking Technologies

1. Some cookies are essential for the website to operate, such as those that keep you logged inor enable core features.
2. Other cookies help us remember your preferences (for example, your language or region) topersonalize your experience.
3. We also use cookies (and similar technologies like local storage or pixels) to collect analytics
   data about website traffic and user interactions. For instance, cookies may record the pages
   you visited and the time you spent on the website. We use this information in aggregate form to analyze trends and statistics, so we can improve our website’s design and functionality. This
   helps us understand which features are popular or if users encounter errors.

Data Security

Data Retention

Your Rights and Choices

1. Right to Access: You have the right to request confirmation of whether we are processing your
   personal information, and if so, to access that information. This includes the right to ask for a copy of the personal data we hold about you. We will provide this in a reasonable format (usually electronic). We will respond to access requests as soon as possible, and within any timeframe required by law, if any. In some cases, we may charge a reasonable administrative fee if arequest is manifestly unfounded or excessive, or for additional copies as permitted by law, but we will inform you in advance if any fee applies.
2. Right to Correction: We want to ensure that the personal information we hold is accurate, up-to-date, and complete. If you believe any of your information is incorrect, incomplete, or out of date, you have the right to request that we correct or update it. If for some reason we cannot comply (for instance, if we disagree that the data is incorrect), we will explain why and how you can object.
3. Right to Erasure: You may have the right to request that we delete your personal information.The DPDPA provides a right of erasure, subject to certain conditions. If you request deletion,we will assess whether the data can be deleted. We will honor deletion requests provided: (a)the data is no longer needed for the purpose it was collected, (b) we have no other legal basis to keep it, and (c) no other exceptions apply. If we have shared your data with any service providers, we will take steps to notify them of the deletion request as well, and ensure that they have deleted your data (unless the above exceptions apply).
4. Right to Withdraw Consent: Where we rely on your consent to process personal information, you have the right to withdraw that consent at any time. Your withdrawal will not affect the lawfulness of any processing done before the withdrawal, but it will stop the relevant processing going forward. In the context of the DPDPA, consent can be withdrawn by the data principal, and we must honour that decision.  Additionally, we will make it as easy to withdraw consent as it is to give consent. To withdraw consent, simply contact us and specify which consent you are withdrawing. We will then cease processing your data for that purpose, unless we have an alternate legal basis to continue (which we will inform you about if applicable).
5. Right to Nominate a Representative: You may nominate a representative to exercise your rights on your behalf in case of your death or incapacity. If you choose to do so, please informus in writing (with appropriate verification and legal documentation, where applicable), and w ewill work with your nominee as required by law.
6. Right to Grievance Redressal: If you have any questions, concerns, or requests regarding this Policy or how we handle your personal information, you can use the contact information below to lodge your grievance.