Privacy Notice

(a) Data Fiduciary. ORCHEWO PRIVATE LIMITED, a company registered in India (CIN U62091KA2026PTC223919), is responsible for the personal data described in this notice. We act as the "Data Fiduciary" under India's Digital Personal Data Protection Act, 2023 (the "DPDP Act") and as the "controller" under the EU and UK General Data Protection Regulation ("GDPR").

(b) When We Act for Our Customers. When a business uses our Services, it decides what data it puts into its workspace and why. For that Customer Data, we act as a Data Processor on the customer's behalf, and the customer's own privacy notice applies. If you are a User of a workspace managed by your employer or another organisation, please direct privacy requests to that organisation. We will help them respond.

We collect personal data about:

• visitors to orchewo.com, studiogen.store, and our other websites;
• customers and Users of our Services;
• people who contact us for support, sales, partnerships, or press;
• people who subscribe to our newsletters or product updates;
• job applicants; and
• staff of our partners, suppliers, and service providers.

We collect personal data directly from you (for example, when you sign up or contact us), automatically when you use our websites and Services, and from third parties such as sign-in providers, payment processors, and partners. The summary below sets out what we collect, why, and the legal basis we rely on.

Under the DPDP Act, we process personal data on the basis of your consent or for the legitimate uses the Act permits, such as where you have voluntarily provided the data for a specific purpose.

(a) Input and Output. We process the prompts, reference files, brand assets, and other materials you submit, and the content generated from them, to provide, maintain, secure, and improve the Services, as described in our Terms of Service.

(b) Third-Party AI Models. Some features use AI models operated by third parties. We share Input with those providers only to generate Output for you, under contracts that restrict how they may use it.

(c) Chat Assistant. The chat assistant on our websites is powered by an AI workflow. Messages you send are processed to generate replies and to handle your enquiry. Please do not share sensitive personal data in the chat.

We do not sell personal data. We share it only with:

• Service providers who host, store, deliver email for, analyse, or support the Services, under contracts that require them to protect the data and use it only on our instructions;
• AI model providers, as described in Section 4;
• Payment processors that handle transactions on our behalf;
• Resellers and partners through whom you purchase or use our Services;
• Professional advisers, such as lawyers, auditors, and accountants, under duties of confidentiality;
• Government and law enforcement authorities, where required by law or to protect our rights, our users, or the public; and
• A buyer or successor in a merger, acquisition, or sale of assets. We will notify you by email or on our website before your personal data becomes subject to a different privacy notice.

We are based in India and host Customer Data in India. Some of our service providers, including AI model providers, may process personal data in other countries. We transfer personal data outside India only as permitted by the DPDP Act and will not transfer it to any country restricted by the Government of India. Where GDPR applies, we protect transfers out of the EEA, UK, or Switzerland using Standard Contractual Clauses or another lawful safeguard.

We use reasonable security safeguards to protect personal data against unauthorised access, loss, or misuse. These include encryption in transit using TLS and at rest, access controls, monitoring, regular backups, and a disaster recovery plan. No system is completely secure, so we review our safeguards regularly. If a personal data breach occurs, we will notify affected individuals and the relevant authorities as required by law.

Under the DPDP Act, you have the right to:

• obtain a summary of the personal data we process about you and how we process it;
• know who we have shared your personal data with;
• have inaccurate or incomplete personal data corrected, completed, or updated;
• have your personal data erased when it is no longer needed, unless we must keep it by law;
• withdraw consent at any time, without affecting processing already carried out;
• nominate another person to exercise your rights if you die or become incapacitated; and
• have your grievances addressed by our Grievance Officer (Section 16).

If you are not satisfied with our response, you may complain to the Data Protection Board of India.

(a) EEA, UK, and Switzerland. You have the right to access, correct, or erase your personal data; to restrict or object to our processing; to data portability; to withdraw consent; and not to be subject to decisions based solely on automated processing that significantly affect you. You may also complain to your local data protection authority.

(b) California and Other US States. Depending on where you live, you may have the right to know what personal information we collect and how we use it, and to access, correct, or delete it. We do not sell personal information, and we will not discriminate against you for exercising your rights.

(c) Other Countries. If the law where you live gives you additional rights, such as under Brazil's LGPD, we will honour them. Contact us using the details in Section 16.

(a) Making a Request. To exercise any of your rights, email hello@orchewo.com from the address linked to your account, or tell us how we can verify your identity. We will respond within the time required by applicable law. You may also update much of your information directly in your account settings.

(b) Marketing. You can stop receiving marketing emails at any time by using the unsubscribe link in any email or by contacting us.

(c) Service Communications. We will still send you messages that are necessary to run your account, such as security alerts, billing notices, and changes to our terms. You cannot opt out of these while your account is active, but you can close your account.

We use cookies and similar technologies that are necessary to run our websites and Services, such as keeping you signed in and remembering your preferences. We may also use analytics technologies to understand how our websites are used. Where the law requires, we will ask for your consent before setting non-essential cookies. You can block or delete cookies through your browser settings, although some features may not work without them.

We keep personal data only for as long as we need it for the purposes in this notice, then delete or anonymise it. In particular:

• account and Customer Data is kept while your account is active. After your subscription ends, you have fourteen (14) days to export it, and we delete it from our active systems within ninety (90) days, as set out in our Terms of Service;
• billing and tax records are kept for the period required by tax and accounting laws;
• if you unsubscribe from marketing, we keep your email address on a suppression list so we do not contact you again; and
• we keep data for longer where the law requires it or where it is needed to establish or defend legal claims.

Our websites and Services may link to or integrate with websites and applications that we do not operate. Their privacy practices are governed by their own policies, and we encourage you to read them.

Our Services are not directed at anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us at hello@orchewo.com and we will delete it.

We may update this notice from time to time. We will post the updated version on this page and revise the effective date above. If we make material changes, we will notify you by email or within the Services before they take effect.

For questions, requests, or complaints about this notice or our handling of personal data, contact our Grievance Officer:

Email

hello@orchewo.com

Post

Grievance Officer, ORCHEWO PRIVATE LIMITED, No. 32/2, 34/1 Kadabisanahal, Prestige Tech Platina, Vartur, Bangalore South, Bangalore – 560087, Karnataka, India

We aim to acknowledge requests promptly and resolve grievances within the time required by applicable law.

"Personal data"

means any information about an individual who is identified or identifiable from that information.

"Processing"

means any operation performed on personal data, such as collecting, storing, using, sharing, or deleting it.

"Data Fiduciary" or "controller"

means the person who decides the purpose and means of processing personal data.

"Data Processor"

means a person who processes personal data on behalf of a Data Fiduciary.

"Customer Data", "Input", "Output", "Services", "Usage Data", and "User"

have the meanings given in our Terms of Service.