Privacy Policy

This policy applies to personal information we handle for our own purposes, such as operating the website, managing customer accounts, billing, marketing and support.

When our customers use the Services, they upload and manage their own data, such as leads, employees, candidates and connected email accounts ("Customer Data"). For Customer Data, the customer is the data controller (or "data fiduciary" under Indian law) and we act as a data processor on the customer's behalf. If you are a lead, employee, candidate or email correspondent of one of our customers, please contact that organization about your information. We will assist our customers in responding to such requests.

Information you give us:

• Contact and demo requests: your name, company name, business email, mobile number, city, team size, and any message or product interests you share.
• Account information: name, email address, phone number, company details, password and user role when you create or are invited to an account.
• Billing information: billing name and address, tax identifiers such as GSTIN, selected plan, and transaction records. Card, UPI and bank details are collected directly by our payment gateways and are not stored on our servers.
• Support and communications: messages, feedback, call notes and other information you provide when you contact us.

Customer Data processed through the Services, depending on the products your organization uses:

• Mitoo CRM: lead and contact details, deal information, quotations, invoices, call logs and recordings, WhatsApp, email and chat conversations.
• Mitoo HRMS: employee profiles, attendance, leave, payroll-related data, documents and, where enabled by the employer and permitted by the device, location information.
• Mitoo Hire: candidate resumes, application details, assessment results, interview recordings and AI-generated evaluations.
• Mitoo Radar: the content and metadata of emails in the email accounts you choose to connect, together with AI-generated summaries, categories, flags and draft replies.

Information collected automatically:

• Device and usage data such as IP address, browser type, operating system, pages viewed, referring URLs, and the date and time of visits.
• Approximate location derived from your IP address.
• Cookies and similar technologies, as described in the Cookies and Tracking section below.

Information from third parties:

• Integrations you connect, such as Google, Microsoft, WhatsApp Business, Meta and Google Ads lead forms, marketplaces and telephony providers.
• Payment confirmations and transaction status from Razorpay and Stripe.
• Business contact information from partners, events or publicly available sources.

• To provide, operate, maintain and secure the Services.
• To create and manage accounts, authenticate users and provide customer support.
• To process subscriptions, payments, invoices, taxes and refunds.
• To respond to demo and contact requests and to follow up on your enquiry.
• To deliver AI features you request, such as summaries, lead and candidate scoring, chatbots and draft replies.
• To send service, security, billing and policy notices.
• To send marketing communications where permitted, with an option to unsubscribe at any time.
• To measure website performance and the effectiveness of our advertising.
• To detect, prevent and investigate fraud, abuse and security incidents.
• To comply with legal obligations and enforce our Terms & Conditions.

We process Customer Data only to provide the Services under our agreement with the customer and according to the customer's instructions.

Several Mitoo products include AI features. When you use them, the relevant Customer Data is processed to generate the requested output, such as an email summary, urgency score, candidate evaluation or draft response.

• We do not use Customer Data to train generalized AI or machine learning models.
• Where we use third-party AI service providers, they process data only to provide the requested feature and are contractually restricted from using it to train their own models.
• AI-generated output can be inaccurate or incomplete and should be reviewed by a person before you rely on it. Mitoo Radar never sends an email on your behalf without your action.

Payments from customers in India are processed by Razorpay for Mehta Softech Pvt. Ltd. Payments from customers outside India are processed by Stripe for Mitoo Technologies Inc.

Card, UPI and bank account details are entered directly with the payment gateway and are encrypted in accordance with the Payment Card Industry Data Security Standard (PCI-DSS). We do not store full card numbers or CVV codes. We receive and retain limited information such as the transaction ID, amount, currency, payment status and, where provided, the last four digits and brand of the card.

Payment gateways process your information under their own privacy policies. You can read them at https://razorpay.com/privacy/ (Razorpay) and https://stripe.com/privacy (Stripe).

We do not sell personal information. We share information only as follows:

• Between Mehta Softech Pvt. Ltd. and Mitoo Technologies Inc., which operate the Services together, under this policy.
• With service providers who help us operate the Services, such as cloud hosting, payment processing, email delivery, telephony, messaging, AI processing, analytics and customer support. They may use the information only to provide services to us.
• With third-party services you or your organization choose to connect, such as Google, Microsoft, WhatsApp or advertising platforms.
• With advertising partners, such as Meta, for measuring and improving our own advertising, as described in the Cookies and Tracking section.
• With professional advisers, auditors and insurers where necessary.
• With authorities or other parties when required by law, legal process, or to protect the rights, property or safety of Mitoo, our customers or others.
• In connection with a merger, acquisition, financing or sale of all or part of our business, subject to this policy.

Mitoo's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

If you connect a Google account, we access only the Google data required for the features you explicitly enable, such as Google Calendar for scheduling, availability and event management, and, for Mitoo Radar, Gmail messages in the accounts you connect for monitoring, summarization, categorization and drafting replies.

• Google user data is used only to provide and improve user-facing features that are visible in the Services and requested by you.
• We do not sell Google user data, and we do not transfer it to third parties except as necessary to provide or improve those features, for security purposes, to comply with applicable law, or as part of a merger or acquisition with notice to you.
• We do not use Google user data for serving advertisements, including retargeting, personalized or interest-based advertising.
• We do not use Google user data to develop, improve or train generalized AI or machine learning models.
• Humans do not read Google user data unless we have your affirmative consent for specific messages, it is necessary for security purposes such as investigating abuse, it is required to comply with applicable law, or the data has been aggregated and anonymized for internal operations.

You can revoke Mitoo's access at any time from your Google Account security settings or by disconnecting the integration in the Services.

We use cookies, local storage and similar technologies for the following purposes:

• Essential: to keep you signed in, remember preferences such as light or dark mode, and secure the Services.
• Analytics: to understand how visitors use the website and improve it.
• Advertising: the website uses the Meta Pixel to measure the effectiveness of our advertising and to show relevant Mitoo ads on Meta platforms. Meta may collect information such as your IP address, browser information and the pages you visit, under Meta's own privacy policy.

You can control cookies through your browser settings and manage ad preferences in your Meta account settings. Blocking essential cookies may prevent parts of the Services from working. Where required by law, we ask for your consent before using non-essential cookies.

Mitoo operates in India and the United States and uses service providers in other countries. Your information may therefore be transferred to, stored in and processed in countries other than the one where you live, including India and the United States.

When we transfer personal information across borders, we take steps to ensure it remains protected as required by applicable law, including contractual safeguards with our service providers.

• Account and Customer Data is retained for as long as the customer's subscription is active. After the subscription ends, the customer has 30 days to export its data, after which we delete or anonymize it within a reasonable period, except where retention is required by law.
• Billing and tax records are retained for the period required by applicable tax and accounting laws.
• Contact and demo request information is retained for as long as needed to respond and maintain the business relationship, or until you ask us to delete it.
• Backups are overwritten on a rolling basis.

We use reasonable technical and organizational measures to protect personal information, including encryption in transit, access controls, authentication and monitoring. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

If we become aware of a personal data breach that affects your information, we will notify you and the relevant authorities as required by applicable law.

Depending on where you live, you may have some or all of the following rights:

• To access the personal information we hold about you and obtain a copy.
• To correct inaccurate or incomplete information.
• To request deletion of your information.
• To withdraw consent where we rely on consent, without affecting processing that took place before withdrawal.
• To object to or restrict certain processing, including direct marketing.
• To data portability.
• To nominate another person to exercise your rights in the event of death or incapacity, as provided under India's Digital Personal Data Protection Act, 2023.
• To lodge a complaint with a data protection authority.

India: If you are in India, you have the rights provided under the Digital Personal Data Protection Act, 2023 and applicable rules, including the right to grievance redressal through our Grievance Officer before approaching the Data Protection Board of India.

United States: Residents of California and other US states with consumer privacy laws may have the right to know what personal information we collect, use and disclose; to request deletion and correction; and to opt out of the "sale" or "sharing" of personal information for cross-context behavioral advertising. We do not sell personal information for money. Our use of advertising pixels may be considered "sharing" under some state laws; you can opt out by emailing us or by enabling a Global Privacy Control signal in your browser. We will not discriminate against you for exercising your rights.

European Economic Area and United Kingdom: If you are located in the EEA or UK, we process personal information on the basis of contract performance, legitimate interests, legal obligations or consent, and you have the rights described above under the GDPR or UK GDPR.

To exercise your rights, email info@mitoo.ai from the email address associated with your account. We may need to verify your identity before responding. If your information is Customer Data, we will direct your request to the relevant customer.

In accordance with the Information Technology Act, 2000, the rules made under it, and the Digital Personal Data Protection Act, 2023, the contact details of our Grievance Officer are:

• Grievance Officer, Mehta Softech Pvt. Ltd.
• 4 & 5, 2nd Floor, Sumel Complex, Sarkhej – Gandhinagar Highway, Ahmedabad, Gujarat 380054, India
• Email: info@mitoo.ai

We will acknowledge grievances within 24 hours and aim to resolve them within 15 days of receipt, or within any shorter period required by law.

The Services are intended for businesses and are not directed to anyone under 18 years of age. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.

The website and Services may contain links to third-party websites and integrations. We are not responsible for the privacy practices of those third parties, and we encourage you to read their privacy policies.

We may update this Privacy Policy from time to time. The "Last updated" date at the top shows when it was last revised. If we make material changes, we will notify customers by email or through the Services before the changes take effect.

For questions about this Privacy Policy or our privacy practices, email info@mitoo.ai or write to us:

• India: Mehta Softech Pvt. Ltd., 4 & 5, 2nd Floor, Sumel Complex, Sarkhej – Gandhinagar Highway, Ahmedabad, Gujarat 380054, India
• United States and rest of world: Mitoo Technologies Inc., 8 The Green, Suite B, Dover, Delaware 19901, United States