Privacy

Effective date: 9 November 2026. Last updated: 9 November 2026.

1. Who we are and our role

1.1 Who we are

Prava AI is developed and operated by SwiftSafe Cybersecurity Technologies India Pvt Ltd, a private limited company incorporated in India and headquartered there ("SwiftSafe India"), together with its United States office, SwiftSafe LLC, a limited liability company registered in Wyoming, USA ("SwiftSafe LLC"). The two companies are affiliates. This Policy is issued by both of them. In this Policy, "SwiftSafe", "we", "us" and "our" mean the company responsible for your data as described in sections 1.2 to 1.4.

• Headquarters (India): SwiftSafe Cybersecurity Technologies India Pvt Ltd, a private limited company incorporated in India
• United States office: SwiftSafe LLC, a limited liability company registered in Wyoming, USA, serving customers in the Americas
• Product: Prava AI
• Legal notices: legal@prava.dev
• Privacy and data protection: privacy@prava.dev
• Grievance Officer: grievance@prava.dev
• Security and vulnerability reports: security@prava.dev

Capitalised terms have the meaning given in the Terms of Service. "Data Principal" means the individual to whom Personal Data relates (a "data subject" under the GDPR).

1.2 When we are the Data Fiduciary

We are the Data Fiduciary under the Digital Personal Data Protection Act, 2023 ("DPDP Act"), and the controller under the GDPR where it applies, for Personal Data that we collect and use for our own purposes. The SwiftSafe company responsible for that data is the one serving your region:

• SwiftSafe LLC, if you, or the Customer whose account you use, are based in the Americas (the United States, Canada, Mexico, Central and South America, and the Caribbean); and
• SwiftSafe India, if you or that Customer are based anywhere else, including India.

For a Customer's account, billing and contract data, this is the SwiftSafe company named in the Customer's Order Form. For website visitors, people who make enquiries and job applicants, it is the company serving the region you are in. This covers:

• account and Authorised User profile data;
• billing, payment and contract records;
• data collected through prava.dev, our enquiry and waitlist forms, and our correspondence with you;
• support tickets, to the extent they concern your account rather than Customer Data;
• our own usage analytics about how the Platform is used;
• event, marketing and recruiting data; and
• Service Data that we use, in de-identified, pseudonymised or aggregated form where reasonably possible, to secure, improve and develop Prava AI, as described in section 6.

1.3 When we are the Data Processor

When a Customer (an organisation) uses Prava AI to protect its devices, applications, networks, email, cloud accounts and other assets, the Customer decides what is monitored and why. For that Customer Data, including Telemetry, email and message content, forensic evidence and threat-intelligence results about the Customer, the Customer is generally the Data Fiduciary or controller and the SwiftSafe company that contracts with the Customer, as named in its Order Form, is the Data Processor. We process that data on the Customer's documented instructions under the Terms, the Order Form and our Data Processing Addendum.

If you are an employee, contractor or end user of one of our Customers and your device, account, email or activity is monitored by Prava AI, your employer or the organisation you deal with is responsible for telling you about that monitoring and, where required, for obtaining your consent. Please direct requests about that data to that organisation first; if you contact us, we will pass your request on and help them respond.

1.4 Sharing between SwiftSafe companies

SwiftSafe India and SwiftSafe LLC share Personal Data with each other only to the limited extent needed to provide, support and secure the Services and to run our business, for example where an engineer or incident responder at one company supports a customer of the other, or for group finance, legal and compliance purposes. This sharing is governed by an intra-group data processing agreement that requires each company to protect the data in line with this Policy and the Data Processing Addendum. It is also subject to our data residency commitment in section 9: your data stays stored and processed in data centres in your region, whichever company handles it, and any access from outside your region is limited as described in section 9.2. SwiftSafe LLC is an office, not a separate data location.

2. Scope of this Policy

This Policy applies to Personal Data processed in connection with:

• the website at prava.dev and its subdomains, including our blog, research pages, pricing page and the contact, waitlist, sign-up and sign-in pages;
• the Platform, meaning the Prava AI web application, dashboards, APIs, the Prava AI assistant and the Modules described in the Module Terms;
• the Agents, meaning the software we provide for installation on endpoints, servers, workloads and devices to collect Telemetry and carry out protective actions;
• support and professional services, including onboarding, incident response by our human responders, penetration testing engagements and security operations correspondence with soc@prava.dev;
• events, such as webinars, conferences, workshops and briefings we host or attend; and
• recruiting, meaning applications for jobs, internships and other roles at SwiftSafe.

Third-party websites linked from our Services have their own policies. How the website and Platform use cookies and browser storage is explained in our Cookie Policy. How we use data to train and improve models is explained in more detail in our AI and Data Use Policy.

3. Personal Data we collect

3.1 Data you provide to us

• Enquiries and waitlist: your name, work email address, company, role, the area you are interested in, a description of your needs, your message, and your confirmation that we may reply by email.
• Account data: name, work email address, password (stored only in hashed form), organisation and workspace names, team membership, role and permissions, multi-factor authentication settings, language and notification preferences.
• Billing data: billing contact name, email and address, tax identifiers such as GSTIN, plan, invoices and payment history. Card or bank details are handled by our payment provider and are not stored by us in full.
• Support and communications: the content of tickets, emails, chat messages, calls and meeting notes, and any files or screenshots you share with us.
• Assistant prompts and uploads: questions, instructions and files you submit to the Prava AI assistant, and the Outputs it returns.
• Events: registration details, attendance and any accessibility needs you tell us about.
• Recruiting: CV, cover letter, employment and education history, references, interview notes, right-to-work information and, with your consent where required, background verification results.
• Vulnerability reports: your contact details and report content when you write to security@prava.dev under our Responsible Disclosure process.

3.2 Data collected automatically

• Website: the public website does not set cookies and does not load third-party analytics or advertising scripts. It stores your colour-theme choice in your browser's local storage. Like any web service, our servers, hosted in data centres in your own region, receive technical data with each request, such as IP address, browser type, page requested and time, and record it in server and security logs.
• Platform: sign-in session tokens, workspace selection, interface and display preferences stored in your browser (see the Cookie Policy); sign-in events; IP address and device information; actions such as configuration changes and containment approvals, recorded in audit logs; and product usage analytics, such as features used, pages viewed, errors and performance. Product analytics are collected using [Product analytics provider].
• Third-party resources loaded by the Platform: the Platform loads fonts from Google Fonts and certain open-source libraries from the cdnjs content delivery network. When it does, your browser sends your IP address and browser information to those providers.
• Location: if you turn on a location-related setting in the Platform, your browser will ask for your permission. We may infer approximate location from your IP address to detect unusual sign-ins.

3.3 Telemetry from monitored assets

When a Customer deploys an Agent or connects an application, server, cloud account, network or IoT/OT device to Prava AI, we receive Telemetry. Depending on the Modules enabled, this can include process, file and network activity; hostnames, IP and MAC addresses; usernames and user sessions; command lines; URLs and domains visited; application and API logs and payloads; cloud audit logs and configuration; and IoT/OT network traffic. Telemetry often contains Personal Data of the Customer's employees, contractors, customers and other end users. We process it as a Data Processor on behalf of the Customer.

3.4 Email and message content for phishing defence

Where the phishing defence Module is enabled, we analyse inbound and internal emails and messages, including addresses, headers, body text, links and attachments, to identify phishing, impersonation and malware. This content may include Personal Data about anyone who sends or receives messages through the Customer's systems, including people outside the Customer's organisation.

3.5 Forensic images, memory captures and malware samples

For digital forensics and incident response, and for malware analysis, we may collect or receive disk images, memory captures, log archives, cloud artefacts, mailbox exports and file samples. These can contain any information on the affected systems, including documents, messages, credentials and sensitive Personal Data. We handle it under chain-of-custody controls, only for the related incident.

3.6 Dark-web and threat intelligence

Our threat intelligence Module monitors open, deep and dark-web sources, such as forums, marketplaces, paste sites, leak sites and messaging channels, for material relevant to our Customers. That material can include leaked credentials, email addresses, phone numbers, identity documents and other Personal Data of Data Principals who have no direct relationship with us, as well as information about threat actors. We use it to alert Customers to exposure of their people, systems and brand, and minimise it, for example by redacting or hashing credentials where feasible.

3.7 Data from third parties

• Your employer or organisation, when it creates an account for you or invites you to a workspace.
• Single sign-on providers and connected applications you authorise.
• Payment providers, which confirm the status of payments.
• Public sources and threat-intelligence feeds.
• Event partners and resellers, where you agreed they may share your details.
• Recruiters, referees and background verification agencies, for recruiting.

4. Purposes and lawful grounds

4.1 India: DPDP Act, sections 4 to 7

Under section 4 of the DPDP Act we process Personal Data for which we are the Data Fiduciary only for a lawful purpose, either with your consent under section 6 or for a legitimate use under section 7. When we ask for consent, we give you a notice under section 5, and your consent is free, specific, informed, unconditional, unambiguous and limited to the Personal Data needed for the stated purpose.

When you accept the Terms, create an account, install an Agent or use the Services, you are asked to agree, and agree, that we may:

• process Customer Data and Telemetry in real time to deliver the Services, including detection, investigation, alerting and containment;
• collect usage analytics about how you and your organisation use the Platform; and
• use Service Data to operate, secure, improve and develop Prava AI, including training, fine-tuning and evaluating its models, on the basis described in section 6 and in the AI and Data Use Policy.

The list below sets out each purpose and the ground we rely on.

• Providing the Services and your account: consent, and voluntary provision under section 7(a).
• Real-time security processing of Customer Data and Telemetry: on the Customer's instructions as Data Processor. The Customer is responsible for its own lawful ground, notices and consents.
• Billing, tax and accounting: consent and voluntary provision under section 7(a), and compliance with law under section 7(d), such as GST and Companies Act record-keeping for SwiftSafe India, and US tax record-keeping for SwiftSafe LLC.
• Usage analytics and service improvement: consent given when you accept the Terms or use the Platform.
• Model training, fine-tuning and evaluation: consent, using de-identified, pseudonymised or aggregated data where reasonably possible, subject to any restriction agreed in an Order Form or DPA.
• Security of our own systems and fraud prevention: consent, and compliance with law under section 7(d), including the CERT-In Directions and section 8(5).
• Responding to enquiries: consent given on the form, and voluntary provision under section 7(a).
• Marketing and events: consent, which you can withdraw at any time.
• Recruiting: consent and voluntary provision under section 7(a). If you join us, data is then processed for employment purposes under section 7(i).
• Legal claims, orders and requests from authorities: section 7(c) and 7(d), and other legitimate uses permitted by law.

4.2 Withdrawing consent

You may withdraw consent at any time, as easily as you gave it, by using the settings in the Platform, the unsubscribe link in our emails, or by writing to privacy@prava.dev. Withdrawal does not affect processing that was lawful before you withdrew. If you withdraw consent that is needed to provide a feature or the Services, that feature or the Services may stop working for you, and we may need to close your account. After withdrawal we will stop processing, and cause our processors to stop processing, your Personal Data for that purpose within a reasonable time, unless processing is required or authorised by law.

4.3 International users: GDPR Article 6

If the EU GDPR or UK GDPR applies to our processing of your Personal Data as controller, we rely on:

• Article 6(1)(b), contract: to provide your account and the Services and to bill for them;
• Article 6(1)(c), legal obligation: for tax, accounting, regulatory reporting and responses to lawful requests;
• Article 6(1)(f), legitimate interests: for security, fraud prevention, product analytics, improving our Services and models with de-identified, pseudonymised or aggregated data, collective defence and defending legal claims. You may object at any time; and
• Article 6(1)(a), consent: for marketing where consent is required, non-essential cookies or similar technologies, and any other processing where we ask for it.

For Customer Data, the Customer is the controller and chooses the lawful basis.

5. Real-time processing and automated decisions

5.1 How real-time processing works

Prava AI analyses Telemetry, email and other Customer Data as it arrives, using rules, machine-learning models and our proprietary large language model, because threats need to be detected and stopped within seconds.

5.2 Autonomous containment

Where a Customer enables it, Prava AI can take actions automatically, such as isolating a host from the network, ending a process, quarantining a file or email, disabling a session or blocking a domain. These can affect individuals, for example by temporarily cutting off an employee's device. Customers choose which actions are automatic and which need human approval, and every action is recorded in the audit log and can be reversed.

5.3 Risk scoring

Prava AI assigns risk scores to events, users, devices, emails and assets, for example to flag a sign-in as suspicious or a message as likely phishing. We do not use scores to make decisions about an individual's employment, credit or access to essential services, and Customers must not do so without meaningful human review. Outputs are probabilistic and may be wrong.

5.4 Human review

If you are affected by an automated action or score, you can ask for it to be reviewed by a human. If you are an employee or end user of a Customer, contact that Customer's security team, which can review, override and reverse actions in the Platform. You can also write to privacy@prava.dev and we will pass your request to the Customer and support its review. Where the GDPR applies and a decision has legal or similarly significant effects, you have the rights described in Article 22, including to obtain human intervention and contest the decision.

6. Analytics and model improvement

We use Service Data, which includes usage analytics, Telemetry metadata, detections, Outputs and feedback, to operate, secure, improve and develop Prava AI, including to train, fine-tune and evaluate our models. In summary:

• we de-identify, pseudonymise or aggregate data before using it for model improvement where reasonably possible;
• model training, fine-tuning and evaluation on a Customer's data, and on your account data, happen within that Customer's or your region, in the same in-region data centres that hold the data;
• only non-personal security artefacts, such as indicators of compromise, file hashes and detection signatures, stripped of Personal Data, may be used across regions and across our customer base for collective defence. Malware samples, attack data and any other artefact that may contain Personal Data stay in the region where they were collected;
• we never disclose a Customer's Confidential Information, or Personal Data in identifiable form, to other customers;
• we apply technical controls designed to stop models from reproducing Personal Data from training data; and
• enterprise Customers may agree restrictions in an Order Form or DPA, for example opting out of model training on their content.

The AI and Data Use Policy gives the full detail, including opt-outs.

7. Children's data

The Services are designed for organisations and are not intended for anyone under 18 years of age. We do not knowingly create accounts for, or collect Personal Data directly from, children. Section 9 of the DPDP Act requires verifiable consent from a parent or lawful guardian before processing a child's Personal Data and prohibits tracking, behavioural monitoring and targeted advertising directed at children. If we learn that we have collected Personal Data from a child without that consent, we will delete it.

Customer Data can sometimes include data about children, for example where a school or a family business monitors its devices. In those cases the Customer, as Data Fiduciary, is responsible for obtaining verifiable parental consent or relying on an applicable exemption under the DPDP Rules, 2025, and must tell us in writing before enabling Modules that process such data. We will not use identifiable data about children for model training.

8. Sharing and disclosure

We do not sell Personal Data, and we do not share it for cross-context behavioural advertising. We disclose Personal Data only as follows.

8.1 Sub-processors and service providers

We use carefully selected providers for hosting, storage, email delivery, payment processing, customer support tooling, product analytics and similar services. They process Personal Data only on our instructions, under written contracts that require confidentiality and security safeguards, and we engage them so that your data is stored and processed only in data centres in your own region, as described in section 9. Our current list, showing the region each sub-processor serves, is here: [Sub-processor list]. Customers will be notified of new sub-processors as described in the Data Processing Addendum.

8.2 Affiliates

We may share Personal Data between SwiftSafe India and SwiftSafe LLC, and with any other companies in SwiftSafe's group, to provide and support the Services, as described in section 1.4. This sharing is limited, governed by an intra-group data processing agreement and subject to the regional commitment in section 9.

8.3 Your organisation

If your account is part of a Customer workspace, administrators of that workspace can see your profile, activity and audit logs, and data associated with the devices and accounts they monitor.

8.4 Professional advisers

We may share Personal Data with our lawyers, auditors, accountants and insurers, who are bound by confidentiality, where needed for them to advise us.

8.5 Law enforcement, regulators and CERT-In

We may disclose Personal Data where required by law, a court order or a lawful request from a government authority, including CERT-In under section 70B of the Information Technology Act, 2000 and the CERT-In Directions of 28 April 2022, the Data Protection Board of India, and law enforcement agencies. We disclose only what is required and, where the law allows, notify the affected Customer. We may also share threat information, such as indicators of compromise, with CERT-In, sectoral CSIRTs and trusted security communities, without Personal Data in identifiable form unless this is necessary and lawful.

8.6 Corporate transactions

If SwiftSafe is involved in a merger, acquisition, restructuring, financing or sale of all or part of its business, Personal Data may be transferred to the other party, subject to confidentiality obligations and to continued protection in line with this Policy and Applicable Law.

8.7 With your instructions

We share Personal Data when you or your organisation direct us to, for example by connecting an integration or sharing a report link.

9. Data residency and cross-border transfers

9.1 Local data centres and zero foreign storage

We process and store your data only in local data centres within your own country or region, without storing your data in foreign countries. This strict residency applies to Customer Data, Telemetry, account data, Service Data, backups, and the model training, fine-tuning and evaluation described in section 6.

• Customers: the Customer's region is set at onboarding or in the Order Form. All Customer Data and Telemetry from the Customer's Agents, connected assets and Authorised Users is stored and processed in that region.
• Website visitors and individual account holders: your region is your home region, and data about you is stored and processed in data centres in that region.
• Sub-processors: we use only sub-processors and data-centre locations that keep your data in your region, as shown in our [Sub-processor list].

9.2 When data may leave your region

Data leaves your region only in these cases:

• At the Customer's explicit request: for example where a Customer asks us in writing to consolidate several regions, move its data to another region or share data with a recipient elsewhere.
• Support access: where an engineer or incident responder outside your region, including one at the other SwiftSafe company, needs remote access to resolve a support request or incident. Access is limited to what the task requires, is authorised, time-bound and logged, and data is viewed in place in your region rather than copied out wherever possible.
• Non-personal security artefacts: indicators of compromise, file hashes and detection signatures, stripped of Personal Data, may be shared across regions for collective defence. These are not Personal Data.
• Legal requirements: where Applicable Law requires us to disclose or keep data in a particular place, as described in sections 8.5 and 10.

9.3 Safeguards for any transfer

• India: any transfer of Personal Data out of India complies with section 16 of the DPDP Act, so no data goes to a country or territory restricted by notification of the Central Government, and with any conditions in the DPDP Rules, 2025 or sector-specific law, such as RBI data-localisation directions.
• EU, EEA and UK: where Personal Data subject to the GDPR goes to a country without an adequacy decision, we use the European Commission's Standard Contractual Clauses and, for the UK, the International Data Transfer Agreement or the UK Addendum, together with supplementary measures such as encryption.
• All transfers: encryption in transit and at rest, access controls and logging, and contractual confidentiality obligations. Details are in the Data Processing Addendum.

10. Retention

We keep Personal Data only for as long as it is needed for the purpose it was collected for, or as required by law. When it is no longer needed, we delete it or irreversibly anonymise it. Where the DPDP Rules, 2025 require it, we will tell you at least 48 hours before erasing your data for inactivity, so you can log in or contact us to keep it. Our default periods are below. A Customer's Order Form or DPA may set different periods for Customer Data, and those take priority.

• Website enquiries and waitlist: 24 months from our last interaction, unless you become a Customer.
• Account data: for the life of the account. After the account or subscription ends, for 30 days to allow export, then deleted from active systems within a further 30 days and from backups within 90 days.
• Billing and tax records: for SwiftSafe India, at least 8 years from the end of the relevant financial year, as required by Indian tax and company law; for SwiftSafe LLC, for the period required by US federal and state tax law.
• Telemetry and other Customer Data: for the retention period of the Customer's plan or as configured by the Customer, stored in the Customer's region throughout, and deleted from in-region systems and backups at the end of the subscription on the timeline above.
• Quarantined email and message content: 30 days by default, or as configured by the Customer.
• Dark-web intelligence results: for the term of the Customer's subscription. Raw source material that is not relevant to any Customer is not kept longer than needed to assess it.
• Security, access and system logs: held in the region of the data they relate to; for systems covered by the CERT-In Directions of 28 April 2022, at least 180 days within India, and for at least one year where the DPDP Rules, 2025 require logs and related Personal Data to be retained for detecting and investigating unauthorised access.
• Audit logs in the Platform: for the life of the Customer's subscription, so the Customer can review automated actions, then deleted with the Customer's other data.
• Forensic evidence: for the duration of the engagement and then for 12 months, unless the Customer instructs earlier deletion or return. Evidence subject to a legal hold, a regulatory or law-enforcement request or ongoing litigation is kept, with chain of custody preserved, until the hold is lifted.
• Malware samples: kept in the region where they were collected, for as long as they are useful for the Customer's defence and for in-region model improvement.
• Non-personal security artefacts: indicators of compromise, hashes and signatures, stripped of Personal Data, may be kept and shared across regions for as long as they are useful for collective defence.
• De-identified and aggregated data used for model improvement: kept in the region it came from for as long as it is useful. Once it is incorporated into model weights it cannot be extracted as Personal Data.
• Support records: 3 years after the ticket is closed.
• Marketing preferences: until you unsubscribe, and a suppression record after that so we respect your choice.
• Recruiting: 12 months after the recruitment process ends, unless you agree to a longer period or you join us.

11. Security safeguards

We take reasonable security safeguards, as required by section 8(5) of the DPDP Act, section 43A of the Information Technology Act, 2000, and Article 32 of the GDPR, to protect Personal Data against breach, loss, misuse and unauthorised access. These include:

• encryption of data in transit (TLS 1.2+) and at rest (AES-256), and the use of hashing, masking or tokenisation where appropriate;
• role-based access controls, strict least-privilege access, mandatory multi-factor authentication (MFA) and immutable logging of access to Personal Data;
• logical separation of each Customer's data across all compute, storage and AI context retrieval tiers;
• regular server and application security hardening, configuration baseline audits, and routine operating system patch management;
• continuous 24/7 logging and monitoring of our infrastructure, servers, applications and administrative systems, synchronised with NTP time sources;
• employee and personnel security governance, including background screening where legally permitted, strict confidentiality obligations, and continuous security and privacy training to prevent insider threats;
• rigorous security, privacy and compliance vetting of all third-party vendors and sub-processors, with continuous monitoring to strengthen supply-chain defense;
• chain-of-custody procedures and restricted access for forensic evidence and malware samples, with samples detonated only in isolated environments;
• secure software development lifecycle (SDLC), vulnerability management and regular testing, including through our Responsible Disclosure programme; and
• business continuity, disaster recovery drills, and a thoroughly tested incident response plan.

No system is perfectly secure. If you think your account has been compromised, contact soc@prava.dev straight away.

12. Personal data breach notification

12.1 Where we are the Data Fiduciary

If a personal data breach affects Personal Data for which we are the Data Fiduciary, we will, as required by section 8(6) of the DPDP Act and the DPDP Rules, 2025:

• inform the Data Protection Board of India without delay, and give it a detailed report within 72 hours of becoming aware of the breach, or any longer period the Board allows; and
• inform each affected Data Principal without delay, in plain language, through their account or by email, describing the breach, its likely consequences, what we are doing about it, what they can do to protect themselves and who to contact.

Where the GDPR applies, we will notify the supervisory authority within 72 hours, and affected individuals where there is a high risk to them, as required.

12.2 CERT-In

Where the CERT-In Directions apply, we will report cyber security incidents of the types listed in the CERT-In Directions of 28 April 2022 to CERT-In within 6 hours of noticing them or being told about them.

12.3 Where we are the Data Processor

If a breach affects Customer Data, we will notify the Customer without undue delay, give it the information it needs to meet its own notification duties, and help it to contain and investigate the breach, as set out in the Data Processing Addendum. The Customer, as Data Fiduciary, decides whether and how to notify the Board and affected individuals, unless the law requires us to do so directly.

13. Your rights

13.1 Rights under the DPDP Act

If the DPDP Act applies, you have the right to:

• access information (section 11): a summary of the Personal Data we process about you, our processing activities, and the Data Fiduciaries and Data Processors we have shared it with;
• correction, completion and updating (section 12);
• erasure (section 12): to have data erased when it is no longer needed for the purpose for which it was processed, unless we must keep it to comply with law;
• grievance redressal (section 13): to have your complaints about our processing heard and resolved by us, through our Grievance Officer, before approaching the Data Protection Board;
• nomination (section 14): to nominate another individual to exercise your rights if you die or become incapable. You can do this by writing to grievance@prava.dev with the nominee's name and contact details; and
• withdraw consent (section 6(4)) at any time, with the effect described in section 4.2.

Section 15 of the DPDP Act also places duties on Data Principals, such as not making false or frivolous complaints. These rights do not apply to processing exempt under section 17. Where we act as a Data Processor, we will direct your request to, and assist, the relevant Customer.

13.2 Rights under the EU and UK GDPR

If the GDPR applies, you have the right to access your Personal Data, to rectification, to erasure, to restriction of processing, to data portability, to object to processing based on legitimate interests (including profiling), to object at any time to direct marketing, not to be subject to solely automated decisions with legal or similarly significant effects (subject to the exceptions in Article 22), and to withdraw consent. You may also complain to your local supervisory authority.

13.3 Notice for California and other US residents (CCPA/CPRA)

This section applies to residents of California and, to the extent similar laws apply, other US states. For residents of the United States, the SwiftSafe company responsible for your Personal Data is generally SwiftSafe LLC, our United States office. SwiftSafe LLC is the "business" for the data described in section 1.2, and a "service provider" or "processor" for Customer Data it processes for a Customer in the Americas. If your data is held for a Customer outside the Americas, the same rights apply against SwiftSafe India. In the past 12 months we have collected the categories of personal information described in section 3: identifiers, commercial information, internet or network activity, approximate geolocation, professional or employment-related information, and inferences such as risk scores. Sources, purposes and recipients are described in sections 3, 4 and 8; we disclose personal information for business purposes only, and use sensitive personal information such as account credentials only to provide and secure the Services. We do not sell personal information or share it for cross-context behavioural advertising, and we have no actual knowledge of selling or sharing personal information of consumers under 16. You have the rights to know, delete and correct personal information, to opt out of sale or sharing and to limit use of sensitive personal information (neither of which we do beyond what the law permits), and not to be discriminated against for exercising your rights. To exercise these rights, write to privacy@prava.dev. You may use an authorised agent, whose authority we will verify.

14. How to exercise your rights

• In the Platform: you can view and update your profile, change preferences and notification settings, export some data and request account deletion from your account settings.
• By email: write to privacy@prava.dev for access, correction, erasure, portability, objection and consent withdrawal, or to grievance@prava.dev for complaints and nominations. Please say which right you are exercising and give enough detail for us to find your data.

Verification. To protect you, we will verify your identity before acting on a request, usually by confirming control of the email address on your account. We will use any information you give for verification only.

Response times. We aim to acknowledge requests within 7 days and to respond in full within 30 days. Grievances are resolved within the period prescribed by the DPDP Rules, 2025, which will not exceed 90 days. For GDPR requests we respond within one month, extendable by two further months for complex requests, and for CCPA requests within 45 days, extendable by a further 45 days, telling you if we need the extension and why. Requests are free of charge, unless they are manifestly unfounded or excessive and the law allows a reasonable fee.

Requests about Customer Data. If your request concerns data we process for a Customer, such as Telemetry from your work device, we will forward it to the Customer promptly and help it respond.

15. Consent managers

The DPDP Act allows you to give, manage, review and withdraw consent through a consent manager registered with the Data Protection Board of India. When registered consent managers are operational and we are able to integrate with them, you will be able to manage the consents you have given us through the consent manager of your choice, in addition to the options in section 14. We will update this Policy to name the consent managers we work with.

16. Grievance Officer, DPO and escalation

16.1 Grievance Officer

In accordance with the DPDP Act, the DPDP Rules, 2025 and the Information Technology Act, 2000 and rules made under it, you can contact our Grievance Officer at grievance@prava.dev. The Grievance Officer handles grievances for both SwiftSafe India and SwiftSafe LLC.

16.2 Data Protection Officer and privacy team

For questions about how we process Personal Data, contact our Data Protection Officer and privacy team at privacy@prava.dev. For legal notices, write to legal@prava.dev.

16.3 Escalation to the Data Protection Board of India

If you are not satisfied with how we resolve your grievance, or we do not respond within the prescribed period, you may complain to the Data Protection Board of India under the DPDP Act, using the process the Board makes available, including its digital platform. Under section 13(3) of the DPDP Act you must first use our grievance redressal process before approaching the Board. If you are in the EU or UK, you can also complain to your local supervisory authority at any time.

17. Changes to this Policy

We may update this Policy to reflect changes in our Services, our practices or the law. We will post the updated Policy on this page and change the "Last updated" date. If a change is material, for example a new purpose for using Personal Data that requires consent, we will notify you by email or in the Platform at least 30 days before it takes effect, and ask for fresh consent where the law requires. For other legal documents, see the Legal centre.