Privacy Policy

About this Policy

This Privacy Policy explains how DwaarAI Tech Private Limited, with its registered office at 8, Janki Apartments, Anand Nagar, Bhigwan Road, Baramati, Pune, Maharashtra 413102, India ("Dwaar", "we", "us", or "our"), handles information when a customer or authorized user accesses Dwaar’s website, platform, APIs, security assessments, support channels, or related services (collectively, the "Services").

This Policy should be read with Dwaar’s Terms of Use and any order form, data processing agreement, or other written agreement between Dwaar and the customer. If a customer agreement contains stricter data-protection terms, those stricter terms will apply to the extent of any conflict.

Information We Collect

Account and business information. Names, business email addresses, job titles, organization details, billing information, authentication records, and account preferences.

Application Data. Application configurations, endpoints, credentials or tokens submitted by the customer, system instructions, prompts, responses, files, logs, model or tool configurations, and other information required to connect to or assess an application.

Assessment Data. Attack configurations, payloads, prompts, test inputs, application outputs, findings, vulnerabilities, evidence, reports, scores, recommendations, and assessment logs.

Usage and technical information. IP address, browser and device information, timestamps, diagnostic information, feature usage, audit logs, and security events.

Support and communications. Information supplied in support requests, onboarding sessions, surveys, meetings, and other communications with Dwaar.

How We Obtain Information

We obtain information directly from customers and authorized users, from applications connected by customers, automatically through the Services, and from service providers supporting account administration, billing, security, or customer support.

How We Use Information

Dwaar uses information only where necessary to provide, secure, administer, and support the Services or to comply with law. In particular, Dwaar may use information to:

• Create and administer accounts, authenticate users, and provide customer support.
• Connect to customer-authorized applications and perform the assessments requested or approved by the customer.
• Generate findings, reports, recommendations, audit records, and service communications.
• Monitor availability, prevent misuse, investigate incidents, and protect Dwaar, its customers, and the Services.
• Process payments, administer subscriptions, and meet accounting or legal requirements.

Dwaar’s Application and Assessment Data Commitment

Dwaar will use Application Data and Assessment Data solely to operate the Services, perform assessments requested or approved by the customer, generate and deliver results, provide customer-requested support, and protect the security and integrity of the Services.

Except for the limited disclosures stated below, Dwaar will not sell, rent, commercialize, publish, or disclose Application Data or Assessment Data to any third party. Dwaar will not use such data for advertising, unrelated commercial purposes, public benchmarking, or training general-purpose or third-party artificial intelligence models.

Dwaar will not identify a customer, disclose its security posture, or publish its findings without the customer’s prior written consent.

When Information May Be Disclosed

Dwaar does not share Application Data or Assessment Data with third parties except in the limited circumstances below:

• Approved service providers that process information only to deliver the Services, under written confidentiality, security, and data-protection obligations. The current list of approved service providers is available on request at contact@dwaar.ai.
• A disclosure expressly authorized in advance by the customer in writing.
• A disclosure required by applicable law, court order, or lawful governmental request. Where legally permitted, Dwaar will notify the affected customer before disclosure and will limit the disclosure to what is legally required.
• A corporate transaction involving Dwaar, provided the recipient agrees to protect the information under obligations at least as protective as this Policy and applicable customer agreements.

Data Ownership and Customer Control

As between Dwaar and the customer, the customer retains ownership of its Application Data and Assessment Data. The customer controls which applications are connected, which assessments are run, who may access the customer account, and when customer data should be exported or deleted, subject to contractual and legal retention requirements.

Security

Dwaar uses reasonable administrative, technical, and organizational safeguards designed to protect information against unauthorized access, alteration, loss, destruction, or disclosure. These safeguards include access controls, least-privilege practices, encryption where appropriate, logging, monitoring, and incident-response procedures.

No system is completely secure. Customers must protect their credentials, limit access to authorized users, avoid submitting unnecessary personal or production data, and notify Dwaar promptly of suspected unauthorized access.

Retention and Deletion

Dwaar retains account and business records for as long as needed to provide the Services, manage the customer relationship, resolve disputes, enforce agreements, and meet legal requirements.

Dwaar will delete or return Application Data and Assessment Data within 30 days after account termination or a valid customer request, unless a different period is stated in an order form or retention is legally required. Data may remain in encrypted backup systems for up to 90 additional days and will not be restored except for disaster recovery or legal necessity.

International Processing

Dwaar and its approved service providers may process information in countries other than the customer’s country. Where required, Dwaar will use appropriate contractual or legal safeguards for international transfers. The customer’s data-location commitments, if any, are stated in the applicable order form or data processing agreement.

Individual Privacy Rights

Depending on applicable law, an individual may have rights to request access to, correction of, deletion of, or information about the processing of personal data. Requests may be sent to contact@dwaar.ai. Dwaar may verify the requester’s identity and, where Dwaar processes personal data on a customer’s behalf, refer the request to that customer.

Cookies and Similar Technologies

Dwaar may use strictly necessary cookies or similar technologies for authentication, session continuity, security, preferences, and service operation. Any analytics or non-essential cookies will be described in this section and used subject to applicable consent requirements.

Children

The Services are intended for business users and are not directed to children. Customers must not knowingly submit children’s personal data unless expressly permitted by a written agreement with Dwaar and applicable law.

Policy Changes

Dwaar may update this Policy to reflect changes in the Services, law, or operational practices. Dwaar will post the updated Policy with a revised effective date and will provide additional notice where a material change affects customer rights or Dwaar’s use of Application Data or Assessment Data.

Contact and Grievance Handling

Related Terms

Use of the Services, including authorization for security testing, is governed by Dwaar’s Terms of Use.