Privacy Policy

Woovly India Pvt Ltd (operating as Live2.ai)

Language. This Policy is available in English. Each consent request we make lets you read it in English or in any of the languages listed in the Eighth Schedule to the Constitution of India. You may also ask for this Policy in any of those languages by writing to privacy@live2.ai, and we will provide it within 14 days (Sections 5(3) and 6(3) of the Digital Personal Data Protection Act, 2023).

Companion document. Where we process personal data on behalf of a business customer, our Data Protection Addendum governs that processing and forms part of our Terms of Use. This Privacy Policy and the DPA are maintained together.

---

1. Who we are

Woovly India Pvt Ltd, a company incorporated in India, operating under the brand Live2.ai, is the data controller (under the EU and UK GDPR), the Data Fiduciary (under India's Digital Personal Data Protection Act, 2023) and the Business (under the CCPA) in respect of the personal data described in this Policy.

Our Data Protection Officer and Grievance Officer are based in India. We have appointed a Data Protection Officer voluntarily. They are the person able to answer your questions about how we process your personal data, under Section 8(9) of the DPDP Act and Rule 9 of the DPDP Rules, and their contact details are included in every response we send to a rights request. We aim to acknowledge every enquiry within three (3) business days and to give a substantive response within thirty (30) days.

2. When this Policy applies

This Policy explains how we handle personal data when:

1. you visit our website at https://www.live2.ai ("Website");
2. you are a customer, or a user authorised by a customer, of our platform ("Platform");
3. you view or interact with content displayed through our Platform on a customer's website, app or e-commerce store;
4. you register with us from a customer's website or store;
5. you are a creator, influencer or social media account holder whose published content is analysed through our Platform (see Section 3.6);
6. you contact us for support, or submit a request;
7. you meet us at a marketing event or give us your details for marketing;
8. you are a contact at one of our suppliers or customers; or
9. you interact with our social media profiles.

Where we act only as a processor. For use cases 3, 4 and 5, and for content that customers upload to the Platform, we usually act as a processor / Data Processor on behalf of our business customer, who decides what content is analysed and why. In those cases the customer is the controller and its own privacy notice governs; our role is set out in our DPA. We have still described that processing below so you can see what happens to your data.

3. What we collect, why, and on what basis

3.1 Website visitors

3.2 Platform customers and their authorised users

Content that you or your organisation upload to the Platform (video, images, captions, brand guidelines) is processed on the customer's behalf under our DPA, not under this Policy.

Payment card details are collected and processed directly by our payment gateway (Razorpay). We do not see or store them.

3.3 Viewers of content displayed through the Platform

3.4 People who register from a customer's website

3.5 Support, marketing, supplier and social media contacts

3.6 Creators and social media account holders whose content we analyse

This is the category most people do not expect, so we set it out plainly.

Our Platform analyses content that has already been published on social media. Where a customer connects its own accounts, or configures the Platform to monitor specified public accounts — for example, creators it has engaged, or accounts it benchmarks against — we ingest and analyse that published content.

If we become aware that content we ingested has been deleted or made private at source, we erase our copy within 30 days, unless the customer has another lawful basis for keeping it. To find out which customer is analysing your content, or to exercise your rights, contact us as described in Section 9.

What we do not do. We do not build profiles of individuals for sale, sell or share this data, enrich it with data from brokers, or use it to train AI models. See Sections 4 and 6.

3.7 All categories

We may also use any of the above personal data to detect and prevent fraud and illegal activity, fix errors, conduct audits, maintain security, comply with law, respond to lawful requests from authorities, and establish or defend legal claims. For individuals in India, these uses rely on consent where you have given it, or on Sections 7(d) and 7(e) and Sections 17(1)(a) and 17(1)(c) of the DPDP Act.

We also produce aggregated, de-identified statistics about how the Platform operates. These statistics cannot identify you or any customer, and we do not attempt to re-identify them.

3.8 A note on lawful basis in India

The DPDP Act does not recognise "legitimate interests" or "performance of a contract" as lawful bases. For individuals in India we rely on consent, or on one of the narrow "certain legitimate uses" in Section 7 of the DPDP Act, most often Section 7(a): data you have voluntarily given us for a specified purpose, where you have not told us you do not consent. Where this Policy cites legitimate interests or contract, that basis applies only under the EU and UK GDPR.

When we ask for your consent, we do so in a separate notice, in clear and plain language, at the point of collection. That notice lists the data we will collect and why, and links to how you can withdraw consent, exercise your rights and complain to the Data Protection Board of India (Section 5 of the DPDP Act and Rule 3 of the DPDP Rules). Consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the data necessary for the stated purpose (Section 6(1)). We do not make a service conditional on consent to processing that the service does not need. We keep a record of each notice we give and each consent given or withdrawn, as Section 6(10) requires. Where a Consent Manager registered with the Board is available to you, you may give, manage, review and withdraw your consent through it (Section 6(7)).

If you gave us consent before the DPDP Act's notice requirements came into force, we will send you a separate notice by email or in-app message, as Section 5(2) of the DPDP Act requires. You may withdraw that consent at any time, as described in Section 9.3.

3.9 What we do not collect

We do not seek, and ask you not to send us, special category data — data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, health data, or data about sex life or sexual orientation — nor government identification numbers or payment card numbers.

Published social media content can incidentally contain such information; for example, a person's appearance may be visible in an image. We do not derive, infer, classify, index or make searchable any such characteristic, and we operate no feature that identifies people by them.

4. AI and automated processing

Our Platform uses artificial intelligence to analyse published content. We think you should know exactly how that works.

What runs on our own systems. Image and video understanding, demographic inference, speech-to-text transcription and optical character recognition all run inside our own infrastructure in India. Raw images, video frames, audio and any facial imagery are processed there and are never sent to a third-party AI provider.

What leaves our systems. Only derived text — transcripts, text extracted from images, the structured output of our own vision model, and the customer's compiled brand rules — is sent to external language models for scoring and reasoning. These are:

We do not use your personal data or your content to train AI models — not our own, and not anyone else's. This is a contractual commitment, flowed down to every AI provider we use. We do not route data through consumer-tier AI services or third-party AI gateways.

Automated decisions. Our outputs are analytical and advisory, and are designed to be reviewed by a customer's team before anyone acts on them. We do not ourselves make decisions about individuals by automated means that produce legal or similarly significant effects (Article 22 GDPR), and our DPA requires customers to apply meaningful human review before relying on our outputs for such decisions. If you believe a decision about you was based solely on our output, contact the customer concerned or us, and we will help you obtain human review.

5. Cookies and tracking

We use cookies and similar technologies on our Website and Platform.

Where consent is required we ask for it before setting non-essential cookies, and you can change or withdraw your choice at any time through the cookie settings link in the Website footer. Withdrawing consent is as straightforward as giving it.

You can also block cookies in your browser, and opt out of Google Analytics specifically using Google's opt-out browser add-on.

6. Who we share personal data with

We do not sell personal data, and we do not share it for cross-context behavioural advertising.

We share personal data with the service providers below, each under a written data processing agreement that obliges them to protect it and to use it only for the purpose stated.

6.1 Infrastructure and operations

6.2 Monitoring, support and internal tools

6.3 Analytics

6.4 AI providers

6.5 Other sharing

We may also disclose personal data:

• to regulators, courts, law enforcement and competent authorities where required by law or to respond to a valid legal request — we challenge requests that are not legally valid, and disclose only the minimum required;
• to our staff, on a need-to-know basis;
• to a buyer or prospective buyer, in de-identified or aggregated form, and otherwise only under a scheme approved by a competent court or tribunal (Section 17(1)(e) of the DPDP Act) or with your consent; and
• where you have given consent.

Where our customer configures an integration with a third-party service, content is shared with that service at the customer's instruction and under the customer's control, not ours.

7. Where your data is stored, and international transfers

We store personal data primarily on Google Cloud Platform in India (asia-south1, Mumbai), with failover to asia-south2 (Delhi NCR). Our teams access it from our offices in India.

Some of the providers listed in Section 6 process personal data outside India, including in the United States and the EU.

Transfers out of the EU, UK and Switzerland. Where we transfer personal data from these regions to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses, as modified by the UK International Data Transfer Addendum for UK transfers and adapted for Switzerland. Details are in Section 8 of our DPA. You can request a copy of the relevant safeguards from privacy@live2.ai.

Transfers out of India. We comply with Section 16 of the DPDP Act and Rule 15 of the DPDP Rules. India permits transfers except to countries the Central Government restricts by notification; we monitor those notifications and will relocate processing if a provider's location becomes restricted.

8. How long we keep personal data

We delete or anonymise personal data once the purpose for which we collected it has been served and no legal obligation requires us to keep it, as required by Section 8(7) of the DPDP Act.

9. Your rights

9.1 Rights available to you

Your right to object to direct marketing. You may object at any time to our use of your personal data for direct marketing, and we will stop (Article 21(3) GDPR).

9.2 How to exercise them

Email privacy@live2.ai, or the Grievance Officer at grievance@live2.ai. So that we can find your data, please tell us the identifier we hold for you. These are the identifiers we require, published under Rule 14(1)(b) of the DPDP Rules:

• account holders — the email address or mobile number registered to your account;
• people who registered from a customer's website — the email address you registered with, and the website;
• creators and social media account holders — your platform and handle; and
• anyone else — the email address or phone number you used to contact us.

We may ask for further information to verify your identity, but only what we need for that purpose. We will acknowledge within three (3) business days and respond substantively within thirty (30) days. Thirty days is also the period within which we respond to grievances, as published under Rule 14(3) of the DPDP Rules and Section 13(2) of the DPDP Act. Deletion requests are actioned within thirty (30) days.

Where we process your data on behalf of a customer (Section 2), we will pass your request to that customer within five (5) business days and help it respond, and we will tell you that we have done so and which customer it is.

For individuals in India, we do not charge a fee or decline a request as excessive. For others, there is no charge, unless a request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or decline — and we will explain why.

9.3 Withdrawing consent

Where we rely on your consent, you can withdraw it at any time, and doing so is as easy as giving it — by emailing privacy@live2.ai, through the cookie settings link, or via the unsubscribe link in any marketing email. Withdrawal does not affect processing carried out before you withdrew.

9.4 Nominating someone to act for you (India)

Under Section 14 of the DPDP Act and Rule 14(4) of the DPDP Rules, you may nominate one or more individuals to exercise your rights if you die or become incapable of doing so. To nominate, email privacy@live2.ai from the address registered with us and give each nominee's full name, relationship to you, email address and phone number. You can change or cancel a nomination the same way. A nominee who wishes to act must write to us with proof of the death or incapacity and proof of their own identity.

9.5 Deleting your account

Email privacy@live2.ai. We will delete your account data within 30 days, subject to the retention exceptions in Section 8, including the one-year processing records required by Rule 8(3) of the DPDP Rules once that Rule is in force.

Note that if you have posted content publicly through a customer's site, that content may have been copied or cached by others beyond our control. We will delete our copies; we cannot delete theirs.

9.6 Marketing

Use the unsubscribe link in any marketing email, or email privacy@live2.ai. We action opt-outs promptly.

9.7 Complaints

Please come to us first, at privacy@live2.ai or grievance@live2.ai — we would rather fix it. You also have the right to complain to a regulator:

• India — the Data Protection Board of India, once you have raised the matter with our Grievance Officer (Section 13(3) of the DPDP Act). The Board works as a digital office, and you can file and track a complaint through its online platform. An appeal against a decision of the Board lies to the Telecom Disputes Settlement and Appellate Tribunal.
• EU — the supervisory authority in your country of residence, work, or where the issue arose.
• UK — the Information Commissioner's Office, https://ico.org.uk.
• Switzerland — the Federal Data Protection and Information Commissioner.

9.8 Your duties (India)

When you exercise your rights under the DPDP Act, Section 15 requires you to: comply with applicable law; not impersonate another person; not suppress material information when providing personal data for any document, unique identifier or proof of identity or address issued by the State; not register a false or frivolous grievance or complaint; and give only information that can be verified as authentic when you ask us to correct your data.

10. Children

Our Website, Platform and services are not intended for children (anyone under eighteen (18)).

Before any non-essential cookie is set, our cookie banner asks you to confirm that you are 18 or over. If you do not confirm, we set only strictly necessary cookies.

In line with Section 9(3) of the DPDP Act, we do not track or behaviourally monitor children, do not serve advertising directed at children, and operate no feature that estimates or infers a person's age. Our DPA prohibits customers from using the Platform to monitor accounts they know, or have reason to believe, are operated by children.

If you are under 18, please do not send us your personal data. We do not process the personal data of children, or of persons with a disability who have a lawful guardian, without verifiable consent from their parent or lawful guardian obtained as required by Section 9 of the DPDP Act and Rules 10 and 11 of the DPDP Rules. We do not currently seek such consent. If we learn that we hold a child's personal data without verifiable consent, we will delete it within thirty (30) days. If you believe we hold such data, contact privacy@live2.ai.

11. How we protect your data

We maintain an information security management system aligned to the requirements of ISO/IEC 27001:2022. Our measures include:

• encryption in transit (TLS 1.2 or higher) and at rest (AES-256);
• multi-factor authentication and single sign-on, least-privilege access, and quarterly access reviews;
• logging and monitoring of access to personal data, with logs retained for at least 12 months;
• regular vulnerability scanning and at least annual independent penetration testing;
• encrypted backups with restoration testing, and a tested disaster recovery programme;
• logical isolation of each customer's data in our multi-tenant environment; and
• a documented incident response process.

No system can be guaranteed secure. Please protect your own credentials and devices, and tell us at security@live2.ai if you suspect a problem.

If a personal data breach affects you, we will notify you and the relevant regulators as required:

• you — without delay, through your account or the contact details you registered with us. We will tell you what happened, the likely consequences for you, what we are doing about it, what you can do to protect yourself, and who to contact (Rule 7(1) of the DPDP Rules);
• the Data Protection Board of India — without delay, followed by a detailed report within 72 hours (Rule 7(2) of the DPDP Rules);
• CERT-In — within the time required by its directions under Section 70B of the Information Technology Act, 2000; and
• the competent supervisory authority — within 72 hours, under Article 33 of the GDPR.

Where we process your data on behalf of a customer, we notify that customer within 24 hours so that it, as Data Fiduciary, can notify you and the Board. The terms are in Section 5.10 of our DPA.

12. Third-party services

Our Website and Platform can link to or interact with services we do not control. We are not responsible for their privacy practices or content. Please read their own policies.

13. Changes to this Policy

We review this Policy at least annually and update it as our services or the law change. The version number and date at the top always tell you which version applies. If we make a significant change to how we use personal data, we will post a notice on the Website and Platform and, where required, contact you directly. Where a change adds a new purpose for data we process on the basis of your consent, we will give you a fresh notice and ask for your consent before we process your data for that purpose. Previous versions are available on request.

14. Contact us

Nothing in this Policy limits your statutory rights or your access to any remedy.