Part A · Access and use

1. Access

1. You may access and use the Services only as allowed under these Terms. We may change the scope, features or availability of the Services at any time.
2. You confirm that you are authorised to use the Services, whether personally or on behalf of your organisation. If we find that you are not authorised, we may suspend or end your access and take appropriate action.
3. You are responsible for keeping your login credentials confidential and for all activity carried out under your account.

2. Your information

1. "User Information" means any data, document, image, file, text, link or other material that you upload, submit, generate or access through the Services.
2. You confirm that you hold all rights and consents needed to share User Information with us, including any personal data of your customers or employees.
3. We process User Information in line with these Terms, our Privacy Policy and applicable law, including the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023.
4. Where you use the Services through one of our clients, User Information may be visible to that client and its authorised users.

3. Permitted use

1. You may use the Services only for lawful purposes, following the instructions and authorisations we or our clients give you.
2. Thinkstage is incorporated in India and based in Hyderabad, Telangana. If you access the Services from outside India, you do so by choice and are responsible for following the laws of your location.

4. Prohibited use

You agree not to:

1. resell, sublicense, rent or commercially exploit the Services without our written consent;
2. copy, reverse-engineer, decompile or try to extract the source code of any part of the Services;
3. upload or share content that you do not own or have no right to share;
4. upload or share content that is unlawful, harmful, harassing, defamatory, obscene, invasive of privacy, hateful, discriminatory, or that promotes gambling or money laundering;
5. harm or attempt to harm minors in any way;
6. infringe any patent, trademark, copyright, trade secret or other proprietary right;
7. impersonate any person or misrepresent your identity or affiliation;
8. introduce viruses, malware or any code designed to disrupt, damage or limit any system;
9. try to gain unauthorised access to, probe, scan or overload the Services or related networks;
10. share content that threatens the unity, integrity, defence, security or sovereignty of India, friendly relations with foreign states or public order;
11. send spam, unsolicited marketing or advertisements through the Services; or
12. use the Services in any other way not allowed by these Terms.

Part B · Intellectual property

1. The Services and everything in them, including software, source code, databases, designs, user interfaces, features, text, graphics, icons and the Thinkstage, A3Finnora, A3Technora, Farvos and Soris names and logos, belong to Thinkstage or its licensors.
2. We give you a limited, non-exclusive, non-transferable, revocable right to use the Services under these Terms. No other rights are granted.
3. You may not reproduce, distribute, modify, publicly display, republish or create derivative works from any part of the Services for commercial purposes without our prior written consent.
4. If you send us feedback or suggestions, we may use them freely without any obligation to you.

Part C · Indemnity and limitation of liability

1. Indemnity

You agree to indemnify and hold harmless Thinkstage and its directors, shareholders, officers, employees, partners, vendors and agents against any claim, loss, damage or cost (including reasonable legal fees) arising from your use of the Services, your User Information, or your breach of these Terms or applicable law.

2. Limitation of liability

To the fullest extent allowed by law, Thinkstage is not liable for any indirect, incidental, special, consequential or punitive damages, or for any loss of profit, revenue, business, data, goodwill or reputation, however caused, even if we were told such loss was possible.

Our total liability for all claims relating to the Services, under any legal theory, will not exceed INR 1,00,000 (Indian Rupees One Lakh). Where you have a separate signed agreement with us, the liability terms in that agreement apply instead.

Part D · Content and disclaimers

1. User postings

1. Some Services may include feedback forms, reviews, chat, forums or similar features ("Communication Features"). Anything you post through them ("User Postings") is treated as non-confidential.
2. By posting, you allow Thinkstage and its affiliates to use, reproduce, adapt, display and share your User Postings in connection with the Services.
3. You are solely responsible for the content, accuracy and legality of your User Postings. They must not contain defamatory, abusive, explicit, discriminatory, infringing or misleading material, or cause distress or inconvenience to others.

2. Disclaimers

The Services are provided on an "as is" and "as available" basis. We do not promise that:

1. the Services will always be available, uninterrupted or error-free;
2. User Information will never be lost or corrupted, although we take reasonable security measures;
3. the Services will be free of viruses or other harmful components; or
4. third-party content, data or images shown in the Services are accurate or properly licensed.

We disclaim all other warranties, express or implied, including merchantability, fitness for a particular purpose and non-infringement. We try to keep information on the Services accurate, but errors can happen and we may correct them at any time. Outputs from AI features in the Services support your decisions and do not replace your own professional, legal, credit or compliance judgement.

Part E · General

1. Third-party links

The Services may link to third-party websites or services for your convenience. We do not control or endorse them and are not responsible for their content, security or practices. Please take your own precautions when visiting them.

2. Suspension and termination

We may suspend or end your access to the Services at any time if you breach these Terms or if required by law. Provisions that by their nature should continue, including intellectual property, indemnity, limitation of liability and governing law, will survive termination.

3. Force majeure

We are not liable for any failure or delay caused by events beyond our reasonable control, including natural disasters, fire, flood, epidemics, strikes, riots, war, government action, or failures of power, internet or third-party services.

4. Waiver

A waiver by Thinkstage is valid only if made in writing. Waiving one provision does not waive any other provision or any later breach.

5. Entire agreement

These Terms and the Privacy Policy form the entire agreement between you and Thinkstage about your use of the Services, unless you have a separate signed agreement with us. In that case, the signed agreement takes priority if the two conflict.

6. Severability

If any part of these Terms is found invalid or unenforceable, the rest of the Terms will remain in full force.

7. Governing law and disputes

These Terms are governed by the laws of India. The courts at Hyderabad, Telangana have exclusive jurisdiction, subject to the arbitration clause below.

Any dispute arising from or relating to these Terms will first be referred to a sole arbitrator appointed by mutual agreement within 30 days of the dispute arising. If the parties cannot agree, the arbitrator will be appointed under the Arbitration and Conciliation Act, 1996. The seat and venue of arbitration will be Hyderabad, Telangana, proceedings will be in English, and the award will be final and binding.

Part F · Grievances and contact

As required by the Information Technology Act, 2000 and the rules made under it, you can contact our Grievance Officer with any complaint about the Services or content on them. We will acknowledge complaints within 24 hours and aim to resolve them within 15 days.

End of Terms of Use

1. Who we are and our role

1. As a Data Fiduciary: for data we collect directly, such as website visitors, demo requests, business contacts and job applicants, Thinkstage decides why and how the data is processed.
2. As a Data Processor: when banks, NBFCs, lenders, insurers or other businesses ("Clients") use our Services to onboard or serve their own customers, we process that data on the Client's behalf and only on their documented instructions. The Client is the Data Fiduciary, and their privacy notice applies to you. Please contact the Client directly to exercise your rights for that data. We will help them respond.

2. Personal data we collect

Information you give us

• Contact details: name, work email, mobile number, company, designation and the details of your enquiry.
• Account details: login credentials, user role and access permissions for Client users of our platforms.
• Communications: emails, calls, chat messages and feedback you send us.
• Recruitment data: CV, education and work history, if you apply for a role.

Information processed for Clients

Depending on the journey a Client configures, this may include identity and KYC details (such as Aadhaar-based e-KYC results, PAN or other officially valid documents), photographs and liveness checks, address, income and employment details, bank statements, credit bureau information, loan or card application data, and consent records. We process this only to deliver the Services to the Client.

Information collected automatically

• Device and usage data: IP address, browser, device type, operating system, pages viewed, time spent and referring pages.
• Log and security data: timestamps, actions taken and audit-trail records used to keep the Services secure.
• Cookies and similar technologies, as described in section 9.

3. How we use personal data

• To provide, configure, operate and support the Services.
• To respond to enquiries, arrange demos and manage our business relationships.
• To verify identity, prevent fraud and keep the Services secure, including access control and audit trails.
• To improve and develop our products, mainly using aggregated or de-identified data.
• To send service notices and, with your consent, marketing updates. You can opt out at any time.
• To meet legal, regulatory and audit requirements, and to establish or defend legal claims.

We do not sell personal data. We do not use Client customer data for our own marketing.

4. Consent and legal basis

1. We process personal data on the basis of your consent, or for legitimate uses allowed under the DPDP Act, such as data you share voluntarily for a specific purpose, compliance with law, or responding to an emergency.
2. Where we rely on consent, we ask for it through a clear notice that explains what data we need and why. You can withdraw consent at any time as easily as you gave it. Withdrawing consent does not affect processing that took place before it.
3. Within Client journeys, consent is captured on the Client's behalf and recorded in the audit trail.

5. Who we share data with

We share personal data only when needed, and only under contractual confidentiality and security obligations:

• Clients: data processed in their journeys is shared with the Client who controls it.
• Service providers: cloud hosting, communication, analytics and support vendors who process data on our instructions.
• Verification partners: KYC, credit bureau, account aggregator and similar regulated providers, when a Client's journey requires it and you have consented.
• Authorities: regulators, law enforcement or courts when required by law.
• Business transfers: a successor entity in a merger, acquisition or restructuring, subject to this policy.

6. How we protect data

• Encryption of data in transit and at rest.
• Role-based access, so people only see the data their role needs.
• A full audit trail of access, checks, decisions and consent.
• Secure development practices, vulnerability testing and monitoring.
• Staff confidentiality obligations and regular privacy and security training.

No system is completely secure. If a personal data breach occurs, we will inform the Data Protection Board of India, affected Clients and affected individuals as required by law.

7. How long we keep data

We keep personal data only as long as needed for the purpose it was collected for, or as required by law or by our Clients' regulatory obligations. After that we delete or anonymise it. For Client data, retention follows the Client's instructions and our contract with them.

8. Your rights

Under the DPDP Act you have the right to:

• get a summary of the personal data we process about you and how we process it;
• correct, complete or update your personal data;
• have your personal data erased when it is no longer needed, unless we must keep it by law;
• withdraw consent;
• nominate another person to exercise your rights if you die or become incapacitated; and
• raise a grievance with us and, if it is not resolved, with the Data Protection Board of India.

To make a request, contact our Grievance Officer (section 13). We may need to verify your identity first.

9. Cookies

We use essential cookies to run our websites securely. With your consent, we also use analytics cookies to understand how visitors use them. You can block or delete cookies in your browser settings, although some features may then not work properly.

10. Children

Our Services are meant for businesses and adults. We do not knowingly collect personal data from anyone under 18 except with verifiable parental consent, where a Client's lawful journey requires it. If you believe a child has shared data with us, please contact us and we will delete it.

11. Data location and transfers

We store and process personal data primarily in India. If we transfer data outside India, we do so only as allowed under the DPDP Act and any applicable regulatory direction, such as RBI data localisation requirements for payment data, and with appropriate safeguards in place.

12. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top shows the latest version, and we will tell you about significant changes through the Services or by email.

13. Grievance Officer and contact

If you have a question, request or complaint about how we handle personal data, please contact our Grievance Officer. We will acknowledge your complaint within 24 hours and aim to resolve it within 15 days.

End of Privacy Policy