Privacy Policy
Version 2.0 · Effective October 15, 2026
1. Who we are and what this covers
PWIN Technologies Private Limited ("Nagent", "we") runs nagent.ai and the Nagent platform. For the personal data described here we are the data fiduciary under India's Digital Personal Data Protection Act, 2023 ("DPDP Act") and the controller under the EU and UK GDPR.
This policy covers: visitors to our websites; people who contact us, chat with our website assistant or book a demo; people we contact about our own products; and the people who sign up for and use the Nagent platform.
It does not cover Customer Data. When a business uses Nagent, the data it puts in its Workspace is processed by us on its behalf under our Data Processing Agreement. This includes its leads, contacts, emails and documents. That business is the data fiduciary or controller, and its own privacy notice applies. If you received a message sent through Nagent by one of our customers, see section 9.
Enterprise deployments. For Enterprise customers, the customer's signed agreement and DPA set where Customer Data is hosted, which providers process it and how long it is kept. On a Private Cloud deployment, Customer Data stays in the customer's own cloud account. In that case Nagent receives only licence, version, health and aggregate usage information, plus what our staff see during support sessions the customer approves.
This policy is a notice. It explains how we handle personal data. It is not a contract and creates no rights or obligations beyond those that data protection law gives you. For our customers, any liability of Nagent relating to personal data is subject to the limits in our Terms of Service or their signed agreement with us.
2. Summary
| Question | Short answer |
|---|---|
| Do you sell my data? | No. |
| Is my data used to train AI models? | No. We do not train on it, and our agreements with the frontier AI model providers we use prohibit them from training on it. |
| Where is it stored? | In India. Some providers process it elsewhere (section 7). Enterprise private cloud data stays in the customer's own cloud. |
| Which cookies need my consent? | Analytics and marketing cookies, which stay off until you accept them (section 6). |
| How do I exercise my rights? | Email privacy@nagent.ai. We answer within 30 days (section 10). |
3. What we collect
You give us: name, work email, phone, company, job title and password when you sign up; details you enter in forms, demo bookings and chats with our website assistant; messages to support; and billing details. For self-serve plans, card and payment details are collected by our payment provider, and we receive only the transaction record, plan and billing address. Enterprise customers are invoiced directly, and we keep billing contacts, invoices and payment records.
Collected automatically: pages viewed, time on page, referring site and campaign tags; a random visitor identifier (section 6); the company your visit appears to come from; and, for signed-in users, security and audit logs including IP address, browser and device, and actions taken. With your consent, analytics and session-replay tools record how you use our website.
From others: business contact details from business data providers, and from public sources such as company websites and professional profiles, when we identify you as a potential customer for Nagent. Also information from partners who refer you, and from sign-in or calendar services you connect.
4. Why we use it, and our grounds
| Purpose | Data | DPDP ground | GDPR basis |
|---|---|---|---|
| Create and run your account, bill you, give support, and perform an Enterprise agreement | Account, billing, support | Consent given at sign-up; legitimate use for data you provide voluntarily (s.7(a)) | Contract |
| Answer enquiries, demos and website chat | Contact, messages | Legitimate use for voluntarily provided data (s.7(a)) | Steps before a contract; legitimate interests |
| Contact potential customers about Nagent | Business contact data | Consent where required; we stop on objection | Legitimate interests; you may object at any time |
| Marketing emails to customers | Contact, usage | Consent, withdrawable in every email | Consent or legitimate interests where law allows |
| Website analytics, session replay, ad measurement | Usage, cookies | Consent through the cookie banner | Consent |
| Security, fraud prevention, audit | Logs, IP, device | Legitimate uses including compliance with law (s.7) | Legitimate interests; legal obligation |
| Comply with law, tax, disputes | As needed | Legitimate uses (s.7) | Legal obligation |
Automated scoring. We automatically score enquiries to decide which to follow up first. No decision with legal or similarly significant effect on you is made by automated means alone. You can ask for a person to review any decision about you.
AI providers. Our website assistant and platform features send text to AI model providers to generate responses. They process it under commercial agreements, only to provide that response, and those agreements prohibit them from using it to train their models.
5. Children
Our services are for businesses, and we do not knowingly process personal data of anyone under 18, who is a child under the DPDP Act. If we learn that we have, we will delete it. Contact us if you believe we hold a child's data.
6. Cookies and similar technologies
| Name | Type | Kept for | Purpose | Consent |
|---|---|---|---|---|
nagent_cookie_consent | Local storage | Until changed | Remembers your cookie choice | Necessary |
nagent_v | Cookie | 90 days | Random visitor number so a website conversation continues across pages | Necessary |
nagent_utm, nagent_entry_referrer | Session storage | Until the tab closes | Records how you arrived, for a form you submit in that visit | Necessary |
nagent_demo_booking_consent | Local storage | Until cleared | Records that you accepted the Terms before booking a demo | Necessary |
| Session cookie | Cookie | 1 hour | Keeps signed-in users signed in | Necessary |
nagent_touch | Cookie | 90 days | First and latest campaign tags, attached to an enquiry you later make | Analytics |
| Website analytics tools, including session replay | Third-party | Set by provider | Measure visits and how the site is used | Analytics |
| Advertising measurement pixels | Third-party | Set by provider | Measure visits from our adverts | Marketing |
Analytics and marketing items load only after you accept them in the cookie banner. You can change your choice at any time from the banner settings. Withdrawing consent stops further collection and deletes the items that depended on it.
7. Who we share it with
Service providers who process data for us under contract: hosting and databases, AI model providers, email delivery, payments, scheduling, analytics, data enrichment and security. Each is bound by data protection terms no less protective than ours. We will publish the list of providers that process customer data at nagent.ai/subprocessors, and update it before a new one processes that data.
Your organisation. If you use a Workspace, its administrators can see your profile and activity in it.
Others: authorities where the law requires; professional advisers; a buyer or successor in a merger or acquisition, under this policy; and anyone else you ask us to share with. We do not sell personal data.
Transfers abroad. We store data in India. Some providers process it in other countries, including the United States and the European Union. Transfers comply with section 16 of the DPDP Act and are never made to a country the Government of India restricts. For data from the EEA, UK or Switzerland, we rely on adequacy decisions or on the European Commission's Standard Contractual Clauses and the UK Addendum, incorporated in our agreements with customers and with each provider.
8. How long we keep it
| Data | Kept for |
|---|---|
| Account data | While your account is open, then 30 days, then deleted. Enterprise accounts follow the period in the customer's agreement. |
| Enquiries and prospect records | 24 months after the last interaction, or sooner if you object or ask us to erase them |
| Website visit records not linked to an enquiry | 180 days |
| Security and audit logs | Up to 365 days, or longer where the law requires |
| Billing and tax records | As long as company and tax law requires, currently up to 8 years |
When the period ends we delete the data or irreversibly de-identify it. Where the DPDP Rules require us to keep processing logs for a minimum period, we keep them for that period.
9. If a Nagent customer contacted you
Businesses use Nagent to find, enrich and contact prospects. If one contacted you, that business decided to do so and is responsible for your data. Contact them first. You can also write to privacy@nagent.ai, and we will pass your request to the business and help it respond. We do not combine data across customers into a shared database of people.
10. Your rights
Under the DPDP Act you may: get a summary of your personal data and how it is processed, and the people it has been shared with; have it corrected, completed, updated or erased; withdraw consent as easily as you gave it; have a grievance resolved; and nominate someone to exercise your rights if you die or become incapacitated.
Under the GDPR, if it applies to you, you also have the rights of access, rectification, erasure, restriction, portability and objection, including an absolute right to object to direct marketing, and you may complain to your data protection authority.
How: email privacy@nagent.ai, or use the settings in your account. We may need to verify your identity. We aim to respond within 30 days and will resolve any grievance within 90 days. If you are not satisfied with our Grievance Officer's response, you may complain to the Data Protection Board of India.
11. Security
Our information security management system is certified to ISO/IEC 27001:2022 (InterCert, certificate IC-IS-2609127). Our SOC 2 Type II programme is in progress.
Our measures include: encryption in transit and at rest; separation of each customer's data at the database layer; role-based access with least privilege; multi-factor authentication; and audit logging. No system is perfectly secure.
If a breach affects your personal data, we will inform you and the Data Protection Board of India as the DPDP Act and Rules require, and supervisory authorities as the GDPR requires.
12. Health information
We do not seek health information. Self-serve plans must not be used for health information. Enterprise customers may process protected health information only under a signed Business Associate Agreement, on a deployment and with features designated as eligible. For that information, the Business Associate Agreement and the customer's own notices apply.
13. Changes
We will post updates here with a new version number and date. For material changes we will email account holders at least 30 days before the change takes effect. Where a change needs your consent, we will ask for it.
14. Contact
PWIN Technologies Private Limited, 1st Floor, 2085, 24th Main Road, Vanganahalli, 1st Sector, HSR Layout, Bengaluru, Karnataka 560102, India.
Data Protection Officer and the contact for questions under section 8(9) of the DPDP Act: Chinmoy Nanda, privacy@nagent.ai.
Grievance Officer: Neelesh Sharma, grievance@nagent.ai, +91 7381091238.