Privacy Policy

1. Introduction

Inturol Technologies Private Limited ("Inturol", "we", "our", "us"), a company incorporated under the laws of India with its registered office at 9th Floor, Kapil Kavuri Hub, 144, Survey 37, Financial District, Hyderabad, India 500032, is committed to protecting the privacy and security of your information. This Privacy Policy explains how we collect, use, store, disclose, and safeguard information when you access or use our IT cost intelligence platform ("Platform") and website at inturol.com ("Website"), collectively referred to as the "Services".

By accessing or using our Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with it, you must not access or use our Services.

2. Our Role: Controller and Processor

Our role under data protection law depends on the data in question:

• As a controller. For information collected through the Website and our marketing and sales activities (such as the contact details you submit and website usage data), we determine the purposes and means of processing and act as the data controller.
• As a processor. For the enterprise data you upload to the Platform ("Customer Data"), we act as a processor (or business) that processes data on your organisation's behalf and under its instructions. Where your organisation is our customer, that processing is governed by the agreement between us, including any data processing addendum, which prevails over this Policy in the event of a conflict.

3. Information We Collect

3.1 Platform (Customer) Data

When you use the Inturol Platform, we process the following categories of enterprise data on your behalf:

• General Ledger (GL) account codes and account descriptions
• Vendor and supplier names
• Cost center labels and department identifiers
• Taxonomy definitions and classification metadata
• Cost allocation rules and configuration settings

3.2 Account Information

When you register for or use our Services, we may collect:

• Name and business email address
• Organisation name, job title, and department
• Contact information necessary for service delivery
• Authentication credentials (stored in encrypted form)

3.3 Website and Usage Data

When you visit our Website, we may automatically collect:

• IP address and approximate geographic location
• Browser type, operating system, and device information
• Pages visited, time spent, and navigation paths
• Referring URLs and search terms

3.4 Communications and Engagement

When you contact us, request a demo, or otherwise communicate with us, we collect the information you provide and a record of that correspondence. If we send you a personalised link or email as part of a sales or marketing conversation, we may record whether and how you interacted with it (for example, opens, pages viewed, and actions taken) so that we can measure engagement and tailor our follow-up. We rely on our legitimate interests for this measurement, and you may object to it at any time using the contact details below.

4. Data We Never Access

Privacy is enforced at the architectural level of our Platform. Inturol AI processes account labels and metadata only. The following categories of data are never accessed, transmitted, or processed by Inturol or any third-party service acting on our behalf:

• Dollar amounts, transaction values, monetary totals, or any financial figures
• Employee personal information, compensation, or payroll data
• Personally identifiable information (PII) such as names, addresses, or identification numbers of individuals
• Bank account numbers, credit card details, or payment instrument data
• Protected health information (PHI) or medical records

Financial amounts are programmatically stripped before any data is transmitted to AI classification models. This is a platform-level enforcement that cannot be overridden by any user or administrator.

5. How We Use Your Information and Legal Bases

We use the information we collect to:

• Provide, operate, and maintain the Platform and its cost classification capabilities
• Generate cost mappings, allocations, and transparency reports
• Improve the accuracy, performance, and security of our Services
• Communicate with you about your account, service updates, and support requests
• Send you marketing communications about our Services, where permitted, and measure their effectiveness
• Detect, prevent, and address fraud, abuse, and security incidents
• Comply with applicable legal and regulatory obligations

Where the EU or UK General Data Protection Regulation ("GDPR") applies, we rely on the following legal bases: performance of a contract (to provide the Services you request); our legitimate interests (to operate, secure, and improve our Services and to conduct business-to-business marketing and engagement measurement); your consent (for example, for optional cookies and certain marketing); and compliance with a legal obligation. Where we rely on consent, you may withdraw it at any time without affecting processing carried out before withdrawal.

6. Cookies and Similar Technologies

We use cookies and similar technologies on our Website, grouped into three categories:

• Strictly necessary: always active. Required for core functionality such as security, fraud prevention, and remembering your cookie choice. These do not require consent.
• Analytics: optional. Help us understand, in aggregate, how the Website is used so that we can improve it.
• Marketing: optional. Help us understand engagement and measure the effectiveness of our outreach.

In the European Economic Area, the United Kingdom, and Switzerland, optional cookies are off until you opt in. Elsewhere, they are on by default and you may opt out. You can review or change your choice at any time through the cookie banner or the Cookie preferences link in our Website footer.

7. Artificial Intelligence Processing

Inturol uses third-party large language models (LLMs) to classify ambiguous cost entries that cannot be resolved by deterministic rules. When AI classification is invoked:

• Only non-sensitive metadata is transmitted: account descriptions, vendor names, and cost center labels
• Financial figures, dollar amounts, and monetary values are never sent to any AI provider
• Employee data, PII, and confidential business information are never transmitted
• Data sent to AI providers is used solely to perform classification for you and is not used to train their models

We select AI providers that offer enterprise-grade or API-tier data handling commitments, including contractual assurances that inputs and outputs are not used to train their foundation models, and we review their data processing practices on an ongoing basis. AI classifications are recommendations that support human review; they include confidence scores and human-readable reasoning, and you remain responsible for validating and using them.

8. Data Residency and Storage

Inturol uses managed cloud infrastructure. Key principles governing data residency:

• In-session processing. Your source GL data is processed in-session and is not permanently stored in Inturol-controlled databases beyond what is required to provide the Services.
• Classification outputs. Cost mappings, confidence scores, and reasoning outputs generated by the Platform are stored in our managed cloud environment.
• Caching. We may cache non-sensitive classification patterns (account labels and vendor names mapped to cost categories) to improve performance and reduce processing costs. Cached data contains no financial figures or PII.

9. How We Share Information

We do not sell your personal information. We share information only with the following categories of recipients, under appropriate confidentiality and data protection obligations:

• Cloud hosting and infrastructure providers that host and operate the Services
• AI classification sub-processors that perform cost classification, as described above
• Customer relationship and email providers that help us manage communications and deliver messages
• Website analytics and marketing intelligence providers that help us understand Website traffic and engagement
• Professional advisers such as auditors, lawyers, and accountants, where reasonably necessary
• Authorities and others where required by applicable law, regulation, legal process, or an enforceable governmental request
• Acquirers in connection with a merger, acquisition, financing, or sale of assets, with notice to affected users

We engage our sub-processors under written contracts that require them to protect your information and to process it only on our instructions. A current list of our sub-processors is available on request.

10. International Data Transfers

We are based in India and may process information in India and in other countries where we or our service providers operate. These countries may have data protection laws that differ from those in your jurisdiction. Where we transfer personal data internationally (including from the European Economic Area, the United Kingdom, or Switzerland), we put in place appropriate safeguards required by law, such as the European Commission's Standard Contractual Clauses (and the UK Addendum) or transfers to countries recognised as providing an adequate level of protection. You may request more information about these safeguards using the contact details below.

11. Data Security

We implement appropriate technical and organisational measures to protect the information we process, including encryption in transit and at rest, access controls, network protections, regular security assessments, and audit logging. In the event of a personal data breach that is likely to result in risk to affected individuals, we will notify the relevant authorities and affected individuals as required by applicable law, including the breach notification timelines under the GDPR and India's Digital Personal Data Protection Act, 2023. However, no method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security.

12. Data Retention

We retain personal information for as long as needed to provide the Services, to comply with our legal obligations, to resolve disputes, and to enforce our agreements. We determine retention periods based on the type of information, the purpose for which it is held, and applicable legal requirements. Account information is retained while your account is active; classification cache data is retained only while it remains relevant to your active taxonomy configuration. You may request deletion of your account and associated personal data at any time, and we will action such requests in accordance with applicable law.

13. Your Privacy Rights

Subject to applicable law, you may have the right to:

• Access and receive a copy of the personal information we hold about you
• Correct inaccurate or incomplete personal information
• Request deletion of your personal information
• Object to or restrict certain processing, including direct marketing
• Request portability of personal information you provided to us
• Withdraw consent where processing is based on consent
• Nominate another individual to exercise your rights in the event of death or incapacity (under India's Digital Personal Data Protection Act, 2023)
• Lodge a complaint with a supervisory authority, such as the UK Information Commissioner's Office, an EU data protection authority, or the Indian Data Protection Board

To exercise any of these rights, please contact us using the details in the "Contact Us" section below. We will respond within the timeframe required by applicable law. We will not discriminate against you for exercising your privacy rights.

14. California Privacy Rights

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"), provides you with specific rights. In the preceding twelve months we may have collected the following categories of personal information: identifiers (such as name, business email, and IP address); professional or employment information (such as job title and employer); commercial information; internet or other network activity (such as Website interactions); and approximate geolocation. We collect this information from you directly, automatically through your use of the Website, and from your organisation. We use it for the business purposes described in this Policy.

As a California resident, you have the right to:

• Know what personal information we collect and how we use and disclose it
• Request access to or deletion of your personal information
• Request correction of inaccurate personal information
• Opt out of any "sale" or "sharing" of personal information for cross-context behavioural advertising
• Not be discriminated against for exercising your rights

We do not sell your personal information for money. We may use analytics and advertising cookies that could be considered a "sale" or "sharing" under California law. You can opt out of these at any time through the cookie banner or the Cookie preferences link in our Website footer, which serves as our "Do Not Sell or Share My Personal Information" control. You may also exercise your rights by contacting us using the details below.

15. Data Lineage and Transparency

Every cost mapping produced by the Inturol Platform includes complete data lineage, allowing you to trace any classified amount back to its source GL entry. All AI-generated classifications include human-readable reasoning and confidence scores, ensuring full transparency and auditability of every decision made by the Platform.

16. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, or legal requirements. If we make material changes, we will notify you by posting the updated policy on our Website or by other appropriate means. Your continued use of the Services after any changes constitutes acceptance of the updated Privacy Policy.

17. Governing Law

This Privacy Policy is governed by and construed in accordance with the laws of India, including the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023, as applicable. Any disputes arising from this Privacy Policy shall be subject to the exclusive jurisdiction of the courts in Hyderabad, India. These governing-law provisions do not deprive you of any protection you are entitled to under the mandatory law of your country of residence.