Privacy Policy

1. Introduction

This Privacy Policy v1.0 (“Policy”) describes how VNash Digital Pvt Ltd (“Company,” “we,” “us,” or “our”) collects, uses, discloses, retains, deletes, and otherwise processes information in connection with:

• (a) the public marketing website at https://sapyon.com (the “Website”), including demo booking, contact forms, and related pages; and
• (b) the Sapyon AI web application and related services (the “Service”), currently offered at https://app.sapyon.com, including sign-up, login, and in-app features.

Sapyon AI is business software for Amazon advertising optimization and related retail operations. Authorized users can connect advertising and retail platform accounts, view hourly and other performance signals, configure automations and schedules, receive ranked recommendations, and use an in-product chat assistant.

This Policy is posted online and is intended to be reachable through a conspicuous “Privacy” link. By accessing the Website or using the Service, you acknowledge this Policy. If you do not agree, do not use the Website or the Service.

This Policy should be read together with our Terms of Service, Cookie Policy, Privacy Choices notice, Data Processing Addendum, and Subprocessors list. Where we process Customer Data as a processor, our DPA applies. This Policy is not legal advice.

2. Company details

The Website and the Service are operated by:

VNash Digital Pvt Ltd
Bangalore, India
Privacy contact: [email protected]

The product name displayed in the Service is Sapyon AI. The product tagline displayed in the Service is Retail Ops. The production application hostname is app.sapyon.com.

Dual role. We act in two capacities:

• (a) Controller of Personal Data relating to Website visitors, leads, and accounts used to sign in to Sapyon AI (Account Data and Website Data, as defined below).
• (b) Processor of Personal Data and other data that a Customer causes to be processed through connected advertising and retail platforms and through features the Customer configures (Customer Data, including Amazon Ads Data). That processing is performed on the Customer’s instructions and, where executed, under a DPA.

If you use the Service on behalf of a business, that business is typically the Customer. Your administrator may grant or revoke your access to specific advertising profiles.

3. Scope

3.1 What this Policy covers

This Policy applies to Personal Data processed through:

• (a) The Website, including the homepage, packages/pricing, case studies, about, careers, blog, contact form, thank-you page, demo booking links, cookie banner, and legal pages;
• (b) Sign-up and login for the Service at app.sapyon.com (including /signup, /login, /settings, and /login/oauth/callback);
• (c) The Service, including Connections, Accounts, Dashboard, Workspace, campaign management, budget rules, automations, recommendations, daily spend, dayparting (stream insights), Chat, Audience (Amazon Marketing Cloud), Retail features, and administrator surfaces where a user has the required role; and
• (d) Support and sales communications you send to us by form, email, or scheduling tool.

This Policy describes those surfaces even where a “Privacy” link in the application itself is implemented in the app codebase rather than on this marketing site.

3.2 What this Policy does not cover

• (a) Amazon, Google, Flipkart, Calendly, or other third-party platforms that you connect, sign in with, or visit, which have their own privacy policies;
• (b) websites or services we do not operate, even if linked from the Website or the Service;
• (c) employment recruiting records beyond the limited contact we receive when you email a careers inquiry, which we handle for hiring rather than as product Account Data.

The Website and the Service are business (B2B) offerings. They are not directed to consumers acting in a purely personal capacity, except to the extent an individual visits the Website or creates an app account.

4. Definitions

• Account Data means Personal Data about a User of the Service, such as email address, authentication credentials or Google account identifiers, roles, permissions, and Service usage associated with that account.
• Amazon Ads Data means advertising account, campaign, reporting, stream, audience, and related data obtained from Amazon Advertising APIs after a Customer authorizes Login with Amazon, including data we write back to Amazon when a User confirms an action.
• Company, we, us, our means VNash Digital Pvt Ltd.
• Controller / Processor have the meanings given in the GDPR where that law applies.
• Customer means the business that contracts for or administers use of the Service.
• Customer Data means data a Customer or its Users submit to, or cause to be processed through, the Service, including Amazon Ads Data, other connected-platform data, automations, chat threads about those accounts, and related configuration.
• Personal Data / Personal Information means information that identifies, relates to, or could reasonably be linked with an individual, as those terms are defined under applicable law.
• Service means the Sapyon AI application at app.sapyon.com and related product functionality.
• Subprocessor means a vendor we engage to process Personal Data on our behalf in connection with the Website or the Service.
• User means an individual who visits the Website or is invited to use the Service.
• Website means sapyon.com and pages we operate on that domain, excluding the Service.
• Website Data means Personal Data collected on the Website, such as contact-form submissions, demo-scheduling metadata we receive, and cookie/analytics data described in this Policy and the Cookie Policy.

5. Information we collect

We collect the categories below. What we collect in a given case depends on how you interact with us (Website only, demo, or the Service).

5.1 Account information

If you create or are provisioned a Service account, we store and retrieve an account record that may include:

• user id, email address, active/deactivated status, and whether the account is a demo account;
• global roles (including super_admin) and permission codes (including, as used in the application, admin.users.read, profiles.write, automation.write, and automation.execute);
• accessible advertising profile ids;
• authentication secrets handled by the backend (password credentials for email/password users; Google subject identifier google_sub for Google sign-in users).

Sign-up and sign-in use email and password (password must be at least eight (8) characters), or “Continue with Google,” in which case we receive an authorization code that our backend exchanges for a session. Password changes are submitted to the Service’s change-password API. Demo accounts cannot change passwords in Settings.

Session tokens: after sign-in, the browser stores in localStorage under the key amz_app_session an access token, an optional refresh token, and a copy of the user object. API requests send an Authorization Bearer token. Signing out removes this item from localStorage on the device.

We do not collect a legal name, phone number, or billing address as Service account fields. Connection display names and advertising account names typically come from connected platforms. Name and phone may still be collected on the Website contact form, as described next.

5.2 Contact information

We collect contact details when you:

• (a) Submit the Website contact form, which currently collects name, email, phone number (including country code), and an optional message about your Amazon advertising goals;
• (b) Book a demo through Calendly (name, email, and scheduling metadata processed by Calendly and shared with us as needed to hold the meeting);
• (c) Email us at [email protected], including careers inquiries;
• (d) Are provisioned as a User by a Customer administrator (email address).

5.3 Billing information

The Service does not include a billing module. We do not collect payment card numbers, bank account numbers, or billing addresses in the application.

Amazon or Flipkart advertising spend is charged by those platforms, not by Sapyon AI. If we invoice a Customer for Sapyon subscription or professional fees, that billing is handled off-platform (for example by invoice or a separate commercial arrangement). Any billing records we keep for that commercial relationship are limited to what is needed to quote, invoice, and account for fees, and are not processed inside the advertising application.

5.4 Amazon Ads data

When a Customer connects an Amazon Ads account, we process Amazon Ads Data on the Customer’s behalf. This includes Login with Amazon / LWA connection identifiers, advertising profiles, campaigns and entities, reports and performance metrics, Amazon Marketing Stream / dayparting data, Amazon Marketing Cloud context, and write-back actions. A consolidated description of what, why, where, who, retention, deletion, and customer controls is in Section 9.

5.5 Other connected-platform data

Where enabled for the Customer, we may also process:

• Amazon Selling Partner API (Seller and Vendor): selling partner ids, regions, marketplace ids, connection type, store/account names, sales summaries, catalog and inventory-related fields, traffic, purchase orders, Brand Analytics, geo sellout (including ship-to country/state or province), review/sentiment rows, and organic/inorganic sales breakdowns;
• Flipkart and Flipkart Ads OAuth: seller id, display name, scopes, consent and expiry, status/health, and related advertising data returned by that integration;
• Customer-configured Service data: automation rules and logs, term lists, hourly-budget groups, budget rules, bid snapshots, chat threads/messages/proposals, recommendation dismissals stored locally, and CSV exports generated in the browser.

This information may include Personal Data (for example User emails, identifiers in search terms, ship-to geography, or Amazon audience user_id values referenced in AMC SQL). We do not require special-category data, and the Service is not designed to collect it.

5.6 Usage and device information

Service. We process API requests your session makes, feature use implied by those requests, administrator metrics views, chat action history, automation execution status, and OAuth connection health. The Service does not include third-party product-analytics SDKs such as Google Analytics, Mixpanel, Segment, Amplitude, PostHog, Hotjar, or Sentry. Our backend maintains standard server-side logs and monitoring needed to operate and secure the Service. Servers, hosting, and any reverse proxy typically receive IP address, date and time, request URL, user agent, and similar HTTP metadata. The browser also holds localStorage (session and dismissed recommendation ids) and sessionStorage (date range, last advertising profile, Workspace filters).

Website. We and our analytics providers may collect device and usage data such as pages viewed, approximate location derived from IP, browser and device type, referring URL, and, where Microsoft Clarity is loaded, session replay and heatmap interactions with the page.

5.7 Support communications

We collect the content of support, sales, and careers communications, including email threads, contact-form messages, demo notes, and related attachments you send. We use this information to respond, provide support, and maintain a record of the conversation.

5.8 Cookies and similar technologies

We and certain vendors use cookies, pixels, localStorage, sessionStorage, and similar technologies. See Section 20 and our Cookie Policy.

6. Sources of data

We receive information from:

• (a) You, when you browse the Website, submit forms, book a demo, email us, sign up, sign in, configure the Service, or use Chat;
• (b) Customer administrators, who create Users, assign profile access, deactivate Users, and trigger syncs;
• (c) Google, if you use Continue with Google (authorization and account linking based on a verified email);
• (d) Amazon Advertising APIs, after Login with Amazon authorization;
• (e) Amazon Selling Partner API, after Seller Central or Vendor Central authorization (or a super-admin self-authorized token);
• (f) Flipkart, after Flipkart OAuth authorization;
• (g) Calendly, when you book a demo;
• (h) Netlify Forms, when you submit the Website contact form;
• (i) Analytics and infrastructure providers listed in Section 12 (including Google Tag Manager, Microsoft Clarity, AWS, Netlify, and Cloudflare).

We do not independently verify all third-party data. Accuracy depends on those platforms and on the permissions you grant.

7. Purposes of processing

We use information to:

• (a) operate the Website, respond to inquiries, schedule and hold demos, and communicate about packages;
• (b) create and administer Service accounts, authenticate Users, and enforce role-based access;
• (c) connect to third-party APIs using tokens you authorize, and prompt re-authorization when connections expire;
• (d) sync, store, and display advertising catalogs, reports, stream/dayparting data, and retail data;
• (e) enable campaign management, Workspace jobs, automations, hourly-budget / dayparting schedules, AMC audiences, and bid snapshots;
• (f) provide ranked recommendations and Chat, including sending relevant account context to Google Gemini when you use Chat, and executing confirmed actions;
• (g) support administrators (user provisioning, profile grants, metrics, report coverage, stream subscriptions);
• (h) maintain security, prevent abuse, debug, and monitor reliability;
• (i) understand Website usage (pages, traffic sources, and session behavior) so we can improve the site;
• (j) comply with law, enforce terms, and protect the rights, property, and safety of the Company, Customers, Users, or the public;
• (k) improve the Service. We do not use Customer advertising data or chat content to train general-purpose AI models unless otherwise agreed with the Customer in writing.

8. Legal bases where GDPR applies

Whether the EU/UK GDPR (or equivalent) applies depends on the location and role of the relevant party. Where it applies to our role as Controller of Account Data or Website Data, we rely on:

• (a) Contract (Art. 6(1)(b)): to create and administer your account, authenticate you, provide the Service you request, and respond to a demo or support request you initiate;
• (b) Legitimate interests (Art. 6(1)(f)): to secure the Service and Website, prevent abuse, understand reliability of integrations, administer access control, follow up on B2B sales inquiries, and improve the Website, balanced against your rights;
• (c) Consent (Art. 6(1)(a)): where you choose Google sign-in or optional connections, and for non-essential Website analytics/marketing cookies where we present a choice;
• (d) Legal obligation (Art. 6(1)(c)): where we must retain or disclose information to comply with law.

As Processor of Customer Data, we process Personal Data on the Customer’s documented instructions. The Customer is responsible for ensuring it has a lawful basis to permit that processing (including advertising, retail, and shopper-related data obtained via Amazon or Flipkart).

9. Amazon Ads data handling

This section consolidates how we handle Amazon Ads Data. It applies when a Customer (or its User) connects Amazon Ads through Login with Amazon.

9.1 What we access

• (a) Connection and identity. Login with Amazon / LWA connection identifiers, manager account ids, display names, OAuth scopes, consent and expiry timestamps, health/status, linked advertising profile ids, and related alerts.
• (b) Advertising profiles and catalog. Profile ids, account names, manager account names, country codes, marketplace identifiers, enablement/setup status, sync status, last sync times, and last errors.
• (c) Campaigns and entities. Portfolios, campaigns (Sponsored Products, Sponsored Brands, Sponsored Display), ad groups, product ads, keywords, product targets, negative keywords, negative targets, brands, ASINs/SKUs, eligibility and product metadata, budgets, states (enabled/paused/archived), bids, placement adjustments, and related Amazon entity identifiers.
• (d) Reports and performance metrics. Report rows and summaries for campaigns, keywords, targets, search terms, placements, match types, targeting types, daily spend, budget usage, and date-range comparisons, including spend, sales, impressions, clicks, and derived metrics such as ROAS/ACOS displayed in Dashboard, Workspace, Reports, Compare, and Recommendations.
• (e) Amazon Marketing Stream / dayparting. Hourly stream health, summary and row data, heatmaps (including timezone), budget-usage stream data, and stream subscription metadata used to ingest hourly signals (including dataset ids, destination ARNs, queue URLs, and AWS region fields used by administrators).
• (f) Amazon Marketing Cloud (AMC). Instance ids and names, advertiser ids, marketplace ids, audience definitions and execution ids, SQL query text, lookbacks, and audience status, where AMC is available for the connected account.
• (g) Write-back actions you confirm. Budget, bid, state, keyword, negative, placement, budget-rule, automation, chat-confirmed, and hourly-budget updates we send to Amazon Advertising APIs after User confirmation or Customer-configured automation.

9.2 Why we access it

We process Amazon Ads Data only to provide the Service the Customer requests: connect the account, ingest hourly and reporting signals, display performance, score keywords, rank recommended actions, run Customer-configured automations and dayparting, power Chat with relevant account context, and write confirmed changes back to Amazon. We do not use Amazon Ads Data to sell advertising to consumers, to build an independent consumer profile, or to train general-purpose AI models unless the Customer agrees in writing.

9.3 Where it is stored and processed

Amazon Ads Data is processed in our production infrastructure. The production API target is an AWS Elastic Load Balancing hostname in us-east-1 (United States). Data storage uses AWS RDS; advertising report files use S3; stream subscriptions use SQS; backend hosting and secrets use ECS and Secrets Manager. The web application is hosted on Netlify with DNS on Cloudflare. Session tokens for the User are stored in the browser’s localStorage on the User’s device. We do not offer single-region data residency.

9.4 Who receives it

• The Customer’s authorized Users who have been granted the relevant advertising profile;
• Amazon, as the source platform and as the destination of write-back API calls;
• Infrastructure subprocessors (AWS, Netlify, Cloudflare) as needed to host and operate the Service;
• Google Gemini only when a User uses Chat, and only to the extent the prompt and relevant account context are sent to generate a reply or action proposal;
• Our personnel with a need to know for support, security, or operations, under confidentiality obligations.

We do not sell Amazon Ads Data. We do not share it with unrelated advertisers. A current subprocessor list is in Section 12 and at /subprocessors.

9.5 Retention

Amazon Ads Data is retained for the duration of the Customer relationship while the connection remains authorized, so the Service can display history, run automations, and support the account. After the Customer relationship ends, the Ads connection is disconnected, or we receive a documented deletion instruction, we delete or anonymize Amazon Ads Data from production systems as described in Section 14 and Section 16.

9.6 Deletion and customer controls

Customers and their Users can:

• disconnect Amazon Ads / revoke Login with Amazon authorization in the Service where the UI permits, and in Amazon’s own account settings;
• archive chat threads and delete certain Customer-configured objects (including bid snapshots, automation rules, AMC audiences, and hourly-budget groups) where the UI supports deletion;
• export on-screen data via CSV where the Service provides export;
• request deletion of remaining Amazon Ads Data and the Service account by emailing [email protected] (there is no in-app “delete my account” or “export all my data” control).

The Customer is the controller of Amazon Ads Data we process on its behalf. End-shopper requests about Amazon advertising should generally go to the Customer and/or Amazon. We will assist the Customer with deletion and other instructions as described in this Policy and, where executed, the DPA.

10. AI and machine-learning processing

Sapyon AI uses a mix of rules, ranking logic, and third-party large language models:

• (a) Recommendations and keyword scoring. We analyze connected advertising performance to rank suggested actions (for example, pausing waste, adjusting bids, or changing budgets). These outputs are generated from the Customer’s own Amazon Ads Data and configuration.
• (b) Automations and dayparting. Customer-configured rules can adjust budgets, bids, or states on a schedule or when hourly stream conditions are met. These are Customer-directed advertising operations, not consumer credit, hiring, or similarly significant decisions about individuals under GDPR Article 22.
• (c) Chat. When you use Chat, we send your prompt, optional thread title, timezone, and relevant account context (such as campaign or metric snippets needed to answer) to our backend and to Google Gemini. Chat may store model and provider identifiers returned by the backend, produce replies and action proposals, and execute confirmed writes to Amazon Ads. You can confirm, reject, edit, or undo proposals where the Service permits.

We do not use Customer advertising data or chat content to train general-purpose AI models unless otherwise agreed with the Customer in writing. Google Gemini processes prompts and context to return a completion and may retain limited logs under Google’s terms; we contract with Google as a subprocessor where applicable. See Subprocessors.

AMC audience creation may affect advertising targeting on Amazon’s platform under the Customer’s instructions. Amazon remains responsible for how those audiences are used on Amazon’s systems.

11. Data sharing

We do not sell Personal Information in the ordinary commercial sense of selling a list of users. Statutory “sale” or “share” under California law is addressed in Section 18 and at Privacy Choices.

We share information with:

• (a) Subprocessors listed in Section 12, only as needed to provide their services to us;
• (b) Connected platforms you or the Customer authorize (Amazon Advertising, Amazon SP-API, Flipkart, Google sign-in), including campaign writes you confirm;
• (c) Calendly, when you open a demo booking;
• (d) Other Users of the same Customer who have been granted access to the same advertising profile or admin permissions;
• (e) Professional advisers or authorities if we believe in good faith that disclosure is required by law, legal process, or to protect rights, safety, or integrity of the Service;
• (f) A successor in connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, subject to appropriate confidentiality and this Policy’s purposes.

Connected platforms are independent controllers or processors of their own services. Their use is governed by their terms and privacy policies and by the consents you grant in their OAuth or booking screens.

Super-admin paste of an SP-API refresh token is a sensitive credential transfer. The Customer is responsible for treating that token as confidential. CSV and snapshot exports download to the User’s device; we are not responsible for those files after download.

12. Subprocessors

We use the following categories of subprocessors and service providers. The canonical list, including DPA status and transfer mechanisms, is at https://sapyon.com/subprocessors/.

We may also engage additional processors for email delivery, monitoring, support tooling, and backups. These providers process information only as needed to provide their services to us, subject to our contracts with them where applicable.

13. International transfers

VNash Digital Pvt Ltd is established in India. The Website and Service are used by Customers in multiple countries. Account Data, Website Data, and Customer Data may be processed in India, the United States (including AWS us-east-1), and other locations where our providers operate.

Where GDPR or UK GDPR applies to a transfer of Personal Data from the EEA or United Kingdom, we rely on appropriate safeguards such as Standard Contractual Clauses or other approved transfer mechanisms, including those set out in our DPA. Data residency in a single country or region is not offered.

14. Data retention

We retain Personal Data only as long as needed for the purposes described in this Policy, including security, dispute resolution, and legal compliance. Working periods:

• Account Data. Retained while the account remains active. After deactivation or closure, we retain Account Data for a limited period as needed for security, audit, and legal compliance, then delete or anonymize it unless a longer period is required by law. Deactivation in the UI (is_active set to false) is not by itself erasure.
• Amazon Ads Data and other Customer Data. Retained for the duration of the Customer relationship and while the relevant connection is authorized. After the relationship ends or we receive a documented deletion instruction, we delete or anonymize it from production systems as described in Section 16. Backups expire on the backup rotation cycle.
• Website leads and support communications. Retained as long as needed to respond and follow up on your inquiry, and thereafter for a limited sales or support record, unless you request earlier deletion. You may ask us to delete lead records at any time.
• Server and security logs. Retained for a limited operations and security period, typically up to ninety (90) days, unless an incident, dispute, or legal obligation requires longer.
• Browser storage. Remains until you clear it, sign out (session key), or the browser session ends (sessionStorage).
• Demo accounts. Retained only as long as necessary to support demonstration use.
• Cookies. Cookie lifetimes are described in the Cookie Policy.

Where a DPA with a Customer specifies different retention or deletion periods for Customer Data, those contractual periods control for that Customer.

15. Security measures

We implement technical and organizational measures appropriate to a multi-tenant B2B application, including:

• authentication required for non-public API routes when app auth is enabled;
• Bearer JWT access tokens issued by the backend;
• role-based access (super admin, account owner, profile grants, permission codes) and demo-user profile restrictions;
• password minimum length of eight (8) characters and authenticated password change for non-demo users;
• Google OAuth as an alternative to passwords;
• HTTPS/TLS for user access to the production Website and Service;
• hosting on AWS with secrets stored in Secrets Manager;
• user confirmation before Chat action proposals are executed against advertising accounts;
• super-admin restriction for certain SP-API connection and retail operations.

The browser stores access and refresh tokens in localStorage. This is not equivalent to httpOnly cookie storage. Users should use a private device, sign out on shared devices, and protect their password and Google account.

We evaluate additional security practices as the Service matures. We do not claim ISO, SOC, or similar certifications in this Policy. A public summary is at /security. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a security incident affecting Personal Data, we will notify affected Customers and, where required, individuals or regulators, in accordance with applicable law.

16. Data deletion

You and Customers can delete or reduce data as follows:

• Website leads: email [email protected] and ask us to delete your contact submission or to stop follow-up.
• Cookies / analytics: use the homepage cookie banner where presented, browser controls, and Privacy Choices.
• Service objects: archive chat threads and delete bid snapshots, automation rules, AMC audiences, and hourly-budget groups where the UI supports it; disconnect Amazon Ads and other OAuth connections.
• Account erasure: there is no in-app “delete my account” control. Email [email protected]. We may need to verify identity and, if you are not the Customer’s administrator, we may redirect the request to the Customer.

After a verified deletion request or end of the Customer relationship, we delete or anonymize applicable Personal Data and Customer Data from production systems promptly, and in any event within ninety (90) days, except (a) information we must retain for legal, security, or dispute purposes, (b) backup copies that expire on the backup rotation cycle, and (c) data Amazon or another platform continues to hold under its own policy. Revoking Login with Amazon stops new ingest; it does not by itself erase historical copies already stored in the Service until we process deletion.

17. User and customer privacy rights

Depending on applicable law, you may have rights to access, correct, delete, or restrict processing of Personal Data, to object to processing, to portability, and to withdraw consent.

App Users can view the email associated with the session, change password (non-demo accounts) in Settings, sign out, reconnect or manage Amazon and other connections where the UI permits, and archive or delete certain objects described in Section 16. There is no in-app export-all-data control; contact us for assistance.

If we process data solely as a Processor, we will refer data-subject requests to the Customer and assist the Customer, unless law requires us to act directly.

17.1 GDPR rights, where applicable

Where the GDPR or UK GDPR applies to our Controller processing, data subjects may have: access (Art. 15); rectification (Art. 16); erasure (Art. 17), subject to legal exceptions (account erasure is not self-service in the application); restriction (Art. 18); portability (Art. 20) for Account Data you provided, where technically feasible; objection (Art. 21), including to processing based on legitimate interests; withdrawal of consent where processing is based on consent, without affecting prior lawful processing; and the right to lodge a complaint with a local supervisory authority.

We do not perform solely automated decision-making that produces legal or similarly significant effects about individuals as a consumer-credit or hiring system. Chat and automations can write to advertising accounts after configuration or confirmation; those are Customer-directed advertising operations, not GDPR Article 22 consumer decisions about shoppers.

18. California and other US privacy rights

If you are a California resident and the California Consumer Privacy Act (as amended, including the CPRA) (“CCPA”) applies, you may have rights to know, delete, correct, and opt out of sale or sharing of Personal Information, to limit use of sensitive Personal Information, and not to be discriminated against for exercising rights. Other US state privacy laws may provide similar rights.

Categories of Personal Information we collect are described in Section 5 (identifiers such as email, name, phone, and user id; commercial/advertising data; internet/technical data; geolocation-related fields in retail geo sellout, if present; inference-like recommendation outputs generated from advertising performance). We collect these categories from you, from administrators, from connected platforms, from devices, and from subprocessors listed in this Policy. Business purposes are described in Section 7.

We do not sell Personal Information, and we do not share it for cross-context behavioral advertising, as those terms are defined under the CCPA. We do not have actual knowledge that we sell or share Personal Information of consumers under 16. For opt-out instructions and cookie choices, see Privacy Choices.

Sensitive Personal Information: passwords and OAuth tokens are used only to provide the Service (authentication and connected APIs). Website phone numbers collected on the contact form are used to respond to your inquiry. We do not use Sensitive Personal Information to infer characteristics about you.

To exercise CCPA or similar US state rights, email [email protected] with the subject line “Privacy Request,” or use Privacy Requests. We will accept requests submitted through an authorized agent in accordance with applicable law. We may need to verify your identity. We will not discriminate against you for exercising your rights.

This Policy is posted at https://sapyon.com/privacy-policy/ and is linked from the Website footer using the word “Privacy,” as required for a conspicuous online privacy notice under California law.

19. Children’s privacy

The Website and the Service are business advertising-operations offerings. They are not directed to children. We do not knowingly collect Personal Data from children. The Service is intended for use by individuals who are at least 18 years of age, acting on behalf of a business. If you believe a child has provided Personal Data, contact [email protected]. We will take appropriate steps, which may include deleting the information or account.

20. Cookies

We use cookies and similar technologies differently on the Website and in the Service. Details, including how to manage cookies, are in our Cookie Policy.

20.1 Website (sapyon.com)

The marketing Website shows a cookie banner on all pages. Accepting cookies stores a consent record and allows Google Tag Manager and Microsoft Clarity to run. Rejecting cookies stores a refusal record and those analytics tags do not load. Google Fonts still load to display typography. Opening a demo loads Calendly, which may set its own cookies. You can also adjust browser settings or use Privacy Choices.

20.2 Service (app.sapyon.com)

The Sapyon AI application frontend does not implement a cookie banner, does not set first-party analytics cookies, and does not load common third-party advertising or analytics pixels. It uses localStorage and sessionStorage for authentication session and UI state. Google Fonts may process IP address and request metadata. Third-party OAuth pop-ups (Google, Amazon, Flipkart) may set cookies on those parties’ domains according to their policies.

21. Changes to this Policy

We may update this Policy from time to time. The version number and “Last Updated” date at the top will change accordingly. Material changes will be communicated by posting the revised Policy on this page and, where appropriate, by email or an in-app notice. Continued use after the effective date of a revised Policy constitutes acknowledgment where permitted by law.

22. Contact information

Controller (Account Data and Website Data): VNash Digital Pvt Ltd

Address: Bangalore, India

Privacy contact email: [email protected]

Privacy requests: https://sapyon.com/privacy-request/. For Customer Data processed on behalf of a Customer, contact the Customer (your administrator) first. Email us if you need help identifying them. General commercial questions: [email protected].

Effective Date of this v1.0: September 17, 2026
Last Updated: September 18, 2026

Related documents: Terms of Service · DPA · Cookie Policy · Subprocessors · Security Overview · Privacy Choices · Privacy Requests