1.1. Frostrek LLP (“Frostrek”, “we”, “us”, “our”) provides Frosty Agent, an AI sales and support agent that businesses deploy on their own website and messaging channels. This policy explains what we do with personal data.

1.2. This policy covers frostyagent.com, the Frosty Agent dashboards, the chat widget, and the agent itself wherever it operates.

1.3. Dual Roles: We act in two different roles, and which one applies determines your rights and who you contact:

• 2.1. Account data: Name, business email, phone number, company name, role, and hashed password.
• 2.2. Business data: GSTIN, billing address, plan, invoices and payment references. Razorpay handles payment details securely.
• 2.3. Configuration: Knowledge base, product catalogue, agent settings, and branding assets.
• 2.4. Usage data: Logins, actions in the dashboard, audit logs, IP address, device, and browser.
• 2.5. Support communications: Messages you send us and our replies.

3.3. Contractual Commitment: We never use your content, configuration or visitors’ conversations to train or fine-tune any AI model — clause 12.4 of our Terms of Service makes that a binding contractual commitment.

• Under DPDP Act, 2023: Right to access summary of data (Section 11), correction & erasure (Section 12), grievance redressal (Section 13), and nomination upon death/incapacity (Section 14).
• Consent withdrawal: Withdraw consent anytime via [email protected]. Data is erased within 30 days (except statutory tax records).
• Registered Consent Managers: We accept instructions from consent managers registered under Section 6(7) of the DPDP Act.
• GDPR Rights: Articles 15 to 21 rights (Access, Rectification, Erasure, Portability, Restriction, and Objection).

• Full conversation transcripts and audio notes.
• Contact details (name, email, phone) provided during chat.
• WhatsApp numbers or website session identifiers.
• Meeting bookings and quotation requests.
• Technical data (IP address, city-level location, browser, device).
• Sensitive data warning: Do not send health info, credit cards, bank details, Aadhaar, or PAN numbers.

• The agent is automated software and will state that it is an AI if asked.
• Enquiry scoring estimates interest for merchant staff prioritization (GDPR Art. 4(4) profiling).
• Automated decisions with legal or significant effects are prohibited without human review (Section 1 AUP).
• Quotations drafted by AI are indicative until approved by the merchant.

The widget uses local storage solely to persist active conversations across page reloads. We do not use persistent tracking cookies, cross-site tracking technologies, or advertising identifiers. You can clear your browser storage at any time to delete stored local session IDs.

Whatever retention a merchant selects, Frostrek enforces these maximum retention ceilings:

Because the merchant is your Data Controller, please direct access, correction, and deletion requests to them first. If you cannot reach the merchant, email [email protected] with the merchant website URL and conversation date, and we will forward your request to the merchant within 48 hours.

• Identity verification: We verify the requestor’s identity before disclosing or erasing data.
• Resolution SLA: Requests are processed within 30 days of verification (extendable by 30 days for complex inquiries with notice).
• Fee standard: Data requests are handled free of charge, except where requests are manifestly unfounded or excessive.

Primary merchant databases and vector embeddings reside in India (Mumbai region). Where cross-border processing occurs for global model inference or WhatsApp routing, transfers are executed under Standard Contractual Clauses (SCCs) and DPDP cross-border whitelist mechanisms.

• Encryption: TLS 1.2+ in transit, AES-256 at rest.
• Multi-tenant isolation: Enforced via PostgreSQL Row-Level Security (RLS) policies preventing cross-tenant leakage.
• Access controls: Mandatory MFA for staff and least-privilege role boundaries.

• DPDP Act (India): Notification to Data Protection Board and affected users without delay under Rule 7(a).
• GDPR (EU/UK): Supervisory authority notice within 72 hours under Article 33.
• CERT-In (India): Cybersecurity incidents reported within 6 hours under Section 70B(6) of IT Act 2000.

Under the California Consumer Privacy Act (CCPA) as amended by CPRA, Frostrek operates as a Service Provider (Cal. Civ. Code § 1798.140(ag)). We do not sell or share personal information and do not retain consumer data across unrelated business accounts.

We respect national data protection laws including the UK Data Protection Act 2018, Singapore Personal Data Protection Act (PDPA), and UAE Federal Decree-Law No. 45/2021.

The platform is designed for businesses. We do not knowingly collect personal data from children under 18 without verifiable parental consent under Section 9 of the DPDP Act. If we learn of unauthorized processing of a child’s data, we promptly purge it.

This Privacy Policy is governed by the laws of India. Any disputes arising hereunder shall be subject to the exclusive jurisdiction of the competent courts in Gurugram, Haryana, India. If any provision is held invalid by a court or authority, the remaining provisions remain in full force and effect.