Privacy Policy

---

1. Summary

• Who we are: SALESSHURU SOFTWARE SOLUTIONS (OPC) PRIVATE LIMITED ("SalesShuru", "we", "us", "our") runs GrowthOS and https://www.salesshuru.com/. For the personal data described here, we are the Data Fiduciary under the Digital Personal Data Protection Act, 2023 ("DPDP Act").
• What we collect: the data you give us (name, email, mobile number, account and workspace content, billing details), recordings and transcripts of calls you ask our AI assistant to make to you, a record of what you consented to, data generated when you use the Service (usage, device and log data), and limited data from our service providers (for example, payment status from Razorpay).
• Why: to run the Founding List, the AgentOS waitlist and GrowthOS, answer your enquiries, place the demo calls you request, generate AI-assisted plans for you, process payments, keep the Service secure, meet legal obligations, and (only with your separate consent) send the Builder Brief and product news.
• Stop anytime: unsubscribe from any marketing email in one click, or stop emails and calls at Privacy choices.
• We do not sell your personal data. We do not store your card details. SalesShuru does not use your Customer Content to train or fine-tune AI models.
• Your rights: access, correction, completion, updating, erasure, withdrawal of consent, grievance redressal and nomination. Write to grievance@salesshuru.com.
• Complaints: contact our Grievance Officer first; you may then complain to the Data Protection Board of India.

Capitalised terms not defined here (such as Service, Account, Customer Content, AI Features, Founding List, Builder Brief and Payment Processor) have the meanings given in the Terms of Service.

2. Scope and legal framework

2.1 This Privacy Policy applies to personal data we process about individuals ("you", the Data Principal) who visit our website, join the Founding List, subscribe to the Builder Brief, use GrowthOS, pay for a Paid Plan, or contact us.

2.2 We process personal data in accordance with Indian law, including:

• the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"), which continue to apply until the relevant provisions of the DPDP Act commence;
• the DPDP Act and the Digital Personal Data Protection Rules, 2025 ("DPDP Rules"), notified on 13 November 2025 and coming into force in phases: provisions on the Data Protection Board took effect on 13 November 2025; Consent Manager provisions take effect on 13 November 2026; and most obligations of Data Fiduciaries (notice, consent, rights, security, breach intimation, children's data) take effect on 13 May 2027;
• the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 (as amended), to the extent GrowthOS acts as an intermediary for content you store in it;
• the CERT-In Directions of 28 April 2022 under section 70B of the IT Act; and
• the Consumer Protection Act, 2019 and Consumer Protection (E-Commerce) Rules, 2020, where applicable.

2.3 We are applying the DPDP standard now. Although many DPDP obligations commence only on 13 May 2027, we have written this notice to meet those standards from launch so that you get the same protections throughout.

2.4 Customer Content about other people. If a Customer uploads personal data of others into a Workspace (for example, names of team members or end-users in a PRD), we process that data on the Customer's behalf and according to its instructions, and the Customer is responsible for having a lawful basis and giving any required notice. Our Data Processing Agreement (coming soon) for business Customers sets out how we act as Data Processor for that data.

3. Personal data we process and why (itemised notice)

The table below lists each category of personal data, the specific purpose for which we use it, and the legal ground we rely on. "Consent" means consent under section 6 of the DPDP Act; "Legitimate use" means a use permitted under section 7 of the DPDP Act (see Section 5).

3.1 Website visitors: what runs on www.salesshuru.com

AI demo calls. When you ask for a call, our AI assistant calls the number you gave, only between 9 AM and 9 PM IST (later requests are called the next morning). It says at the start that it is an AI assistant and that the call is recorded. Say "stop calling me" at any time and it ends the call and adds your number to our do-not-call list; you can also stop calls at Privacy choices. If an unanswered call needs a retry, we try at most three times in total. We accept at most two call requests a day for any one number.

We do not use YouTube embeds today. If we add one, it will use YouTube's privacy-enhanced (youtube-nocookie.com) mode and load only when you click to play. We do not use the Meta Pixel, the LinkedIn Insight Tag, website visitor identification services or contact-enrichment services. If we ever add any of these, we will update this Policy and the Cookie Policy first and use them only with your consent.

What we do not intend to collect: government ID numbers, biometric data, health data, financial account credentials, or information about children. Please do not upload such data into the Service.

4. Consent

4.1 How we ask. Where we rely on consent, we ask for it through a clear affirmative action (an unticked checkbox) presented with a short-form notice linking to this notice. Consent requests are in clear and plain language, are specific to the purposes listed, and are not bundled. On our website forms:

• each form has one required box for that form's purpose (for example, "I'm 18 or older and agree to emails about my Founding 1000 seat"), which also confirms you are 18 or older;
• the call form's box also confirms the number is yours and that the call is recorded;
• marketing email (the Builder Brief and product news) is always a separate, optional, unticked box. Leaving it unticked never stops you from using the form.

We keep a record of each box you tick, as described in row 15 of Section 3. Our website analytics (Plausible) is cookieless and aggregate and runs without a consent prompt.

4.2 Withdrawing consent is as easy as giving it. You can withdraw consent at any time, using a method as easy as the one you used to give it:

4.3 Effect of withdrawal. Withdrawal does not affect processing done before it. After you withdraw, we (and our processors) will stop processing the relevant personal data within a reasonable time unless processing is required or permitted by law. If you withdraw consent needed to provide the Service (for example, account data), we may not be able to continue providing the Service and will tell you the consequences.

4.4 Consent Managers. The DPDP Act allows you to give, manage, review and withdraw consent through a Consent Manager registered with the Data Protection Board of India. Registration of Consent Managers begins under the DPDP Rules from 13 November 2026. We do not currently integrate with a Consent Manager. If we do, we will list it here, and consents given through it will be honoured as if given to us directly.

5. Legitimate uses (processing without consent)

The DPDP Act (section 7) permits processing without consent for certain legitimate uses. We rely on these only where they apply, mainly:

• Voluntarily provided data for a specified purpose (s.7(a)): for example, when you give us your email and payment details to buy a Paid Plan and have not indicated that you do not consent, we use them to complete that transaction.
• Compliance with law (s.7(b)–(d)): processing needed to meet legal obligations, such as tax and accounting records, CERT-In incident reporting and log retention, responding to lawful requests from courts or government agencies, and intermediary obligations under the IT Rules.
• Medical emergency, disaster or public order (s.7(f)–(h)): in the rare event that processing is needed to respond to a threat to life or health or during a disaster or breakdown of public order.

6. Who we share personal data with

6.1 We do not sell or rent your personal data. We share it only as follows:

6.2 Our service providers act as Data Processors on our behalf under written contracts that require them to process data only on our instructions and to protect it. Our current sub-processors are listed in the Sub-processor List (coming soon), which we keep up to date.

7. Cross-border transfer

7.1 GrowthOS is currently offered only to customers in India, and payments are in INR. Razorpay is an Indian payment aggregator regulated by the Reserve Bank of India (RBI). Payment data is handled under Razorpay's terms and the RBI's data-localisation rules for payment system data. We use Amazon Web Services in the Asia Pacific (Mumbai) region to host the Service and our website forms. For AI demo calls, Anthropic processes call transcripts in the United States, and Plivo may route call data outside India. AI Features in GrowthOS use Anthropic's Claude API, which processes AI Inputs and Outputs in the United States. Only the content you send to an AI Feature leaves India, for that request; your stored data stays in Mumbai. Some of our other service providers may also store or process personal data outside India.

7.2 Under section 16 of the DPDP Act, personal data may be transferred outside India except to countries or territories that the Central Government restricts by notification, and subject to any requirements set by the DPDP Rules. We will not transfer personal data to any restricted country and will comply with any conditions the Government specifies. We require recipients to protect personal data to a standard consistent with this Policy.

8. Retention

8.1 We keep personal data only as long as needed for the purposes in Section 3, or as required by law, and then erase it (or anonymise it so it no longer identifies you).

8.2 How deletion works today. Deletion and erasure requests are currently handled manually by our team. To ask for deletion, email grievance@salesshuru.com or use the in-app deletion request. We will confirm your identity, delete the data within 30 days of your request, and email you when it is done. We may keep data we are required by law to keep (for example, billing records), and copies in backups are removed as backups expire.

8.3 Before erasing data because a purpose is no longer served (for example, after long inactivity), we will, where practical, notify you in advance so you can log in or export your data.

9. Children's data

9.1 GrowthOS is a business tool not directed at children. Under the DPDP Act a "child" is anyone under 18. You must be 18 or older to use the Service, join the Founding List or subscribe to the Builder Brief.

9.2 We do not knowingly process children's personal data, track or behaviourally monitor children, or target advertising at them. If we learn that we have collected a child's personal data without verifiable consent of a parent or lawful guardian as required by section 9 of the DPDP Act and the DPDP Rules, we will delete it promptly. If you believe a child has given us data, contact grievance@salesshuru.com.

9.3 The same applies to persons with disability who have a lawful guardian: we do not knowingly process their data without verifiable consent of the lawful guardian.

10. Your rights as a Data Principal

You have the following rights. To exercise any of them, email grievance@salesshuru.com (or use an in-app request where available) and identify yourself using the email address or other identifier linked to your Account. We may need to verify your identity before acting.

Response time. We aim to respond to rights requests within 30 days, and in any case within the period prescribed by law (the DPDP Rules require grievances to be responded to within a period not exceeding 90 days).

Your duties (s.15). When exercising your rights you must comply with applicable law, not impersonate anyone, not suppress material information, not register false or frivolous grievances, and give only verifiably authentic information when requesting correction or erasure. Breach of these duties may attract a penalty under the DPDP Act.

11. Security safeguards

We take reasonable security measures appropriate to the risk, consistent with the SPDI Rules and DPDP Rules. We use industry-standard safeguards, including encryption in transit. Other measures include:

• passwords stored in hashed form, and optional two-factor authentication for your Account;
• access to personal data limited to people who need it to run the Service;
• contractual security obligations on our Data Processors;
• payment card data handled only by Razorpay (we never see or store full card details).

We are an early-stage company and do not currently hold security certifications.

No system is completely secure. Please use a strong, unique password and tell us immediately if you suspect unauthorised access to your Account. More detail is in our Security Overview (coming soon).

12. Personal data breach notification

If a personal data breach occurs, we will:

• inform affected Data Principals without delay, in plain language, describing the nature, extent, timing and likely consequences of the breach, the steps we have taken and you can take to reduce risk, and a contact for questions;
• intimate the Data Protection Board of India without delay, and provide a detailed report within 72 hours of becoming aware of the breach (or such longer period as the Board allows), as required by the DPDP Rules once in force; and
• report cyber security incidents to CERT-In within 6 hours of noticing them, where required by the CERT-In Directions, 2022.

13. Grievance Officer and complaints

13.1 Grievance Officer (appointed under the SPDI Rules, 2011, the IT (Intermediary Guidelines) Rules, 2021 and the Consumer Protection (E-Commerce) Rules, 2020, and acting as the person able to answer questions about processing under section 8(9) of the DPDP Act):

Mayuri Deshmukh, Director SALESSHURU SOFTWARE SOLUTIONS (OPC) PRIVATE LIMITED DL/229 Etape Layout, Sundarkhed Prabhankur, Buldana, Buldhana - 443001, Maharashtra, India Email: grievance@salesshuru.com Phone: +91 7775917507 Working hours: 10:00 AM to 6:00 PM IST, Monday to Saturday (excluding public holidays)

13.2 Timelines. We will acknowledge your grievance within 24 hours and resolve it as follows:

More details are in Contact and Grievance Redressal.

13.3 Data Protection Board of India. If you are not satisfied with our response, or we do not respond within the timelines above, you may complain to the Data Protection Board of India under the DPDP Act (you must first exhaust our grievance redressal process, as required by section 13(3)). You can do this through the Data Protection Board of India's official website or app, once available.

13.4 Data Protection Officer. SalesShuru has not been notified as a Significant Data Fiduciary. A Data Protection Officer based in India, independent audits and data protection impact assessments are mandatory only for Significant Data Fiduciaries notified by the Central Government under section 10 of the DPDP Act. If we are notified, we will appoint a DPO and publish their contact details here.

14. Builder Brief and marketing communications

We send the Builder Brief newsletter and other marketing emails only if you opt in separately. Each email contains an unsubscribe link, and unsubscribing does not affect your Account or transactional emails. Details are in our Builder Brief and Marketing Email Consent and Unsubscribe Terms (coming soon).

15. Cookies

We use essential cookies and similar technologies to run the Service and keep it secure. Our website analytics (Plausible) is cookieless and aggregate, and runs without a consent prompt. Our first-party visitor identifier is session-only and not linked to you, and a small first-visit record in your browser remembers which campaign brought you (see Section 3.1). We do not use advertising or marketing pixels or tracking cookies, so we do not show a cookie banner. See our Cookie Policy.

16. Language of this notice

This notice is available in English. In line with the DPDP Act, which gives you the option to access a consent notice in English or any language specified in the Eighth Schedule to the Constitution of India, you may ask for this notice in another Eighth Schedule language. To request this, email admin@salesshuru.com.

17. Changes to this Policy

We may update this Policy. We will post the updated version with a new "Last updated" date and, for material changes (especially new purposes requiring consent), notify you by email or in-app and ask for fresh consent where required.

18. Contact

General queries: admin@salesshuru.com Privacy queries and rights requests: grievance@salesshuru.com Post: SALESSHURU SOFTWARE SOLUTIONS (OPC) PRIVATE LIMITED, DL/229 Etape Layout, Sundarkhed Prabhankur, Buldana, Buldhana - 443001, Maharashtra, India

---

GrowthOS is a product of SALESSHURU SOFTWARE SOLUTIONS (OPC) PRIVATE LIMITED (CIN U62099ME2026OPC474283). Privacy Policy v0.4 draft, last updated 31 October 2026.