Privacy Policy

1. Who We Are

Fragiliti Narratives Private Limited ("Fragiliti", "we", "us", or "our") is a private limited company incorporated under the Companies Act, 2013, with its registered office at:

163, Ferns Habitat, Doddanekkundi, Bangalore 560037, India.

We make Fragiliti, a decision-support platform that is currently deployed on-premises for enterprise customers - it runs inside your own environment, and the data you analyse with it stays there. Our public website is available at fragiliti.com.

This policy covers the limited personal data we collect directly - through our website, enterprise enquiries, sales and support. It does not cover the data you load into a Fragiliti deployment, which never leaves your environment and to which we have no access (see section 2.3).

For the purposes of applicable data protection laws, in respect of the personal data we collect directly:

• Under India's DPDP Act 2023: Fragiliti is a Data Fiduciary.
• Under the EU GDPR: Fragiliti is a Data Controller. For data inside your on-premises deployment, you are the controller and Fragiliti is not a processor, as we do not access it.
• Under US law (CCPA and state equivalents): Fragiliti is a Business or Service Provider depending on context.

Data Protection Contact: Tarun Agarwal - contact@fragiliti.com

2. What Data We Collect

2.1 Data You Give Us Directly

• Contact form data: Name, email, company, role, and any message you submit via our website contact form.
• Enterprise enquiry & sales data: Business contact details and the information you share with us while evaluating or procuring Fragiliti.
• Support communications: Any messages, emails, or tickets you send us.

2.2 Data We Collect Automatically

• Website technical data: IP address, browser type, operating system and approximate location, recorded in standard server logs when you visit our website.
• Cookies and similar technologies: Our website uses a strictly necessary preference store (such as your light/dark theme choice) via local storage and does not use tracking cookies.

We do not run product analytics that send your usage of a Fragiliti deployment back to us - the software runs in your environment.

2.3 Data Inside Your Fragiliti Deployment

Because Fragiliti is deployed on-premises, any files you load and everything the platform computes stay entirely within your own environment. We do not receive, host, access or store this data. It is yours, and you are its controller.

2.4 Data From Third Parties

• If you reach us via a partner referral, we may receive your business contact details from that partner.

3. Why We Collect It - Legal Bases

We only process your data when we have a lawful reason to do so. Here is an explanation of the legal bases we rely on:

4. How We Use Your Data

• To respond to you: Answer enquiries, arrange demos, and handle your requests.
• To provide and support Fragiliti: Manage enterprise onboarding, deployment, and support under your agreement.
• To communicate with you: Send security advisories, product updates, and support responses.
• To improve Fragiliti: Use the feedback you share with us to fix issues and prioritise improvements.
• To send marketing (only with consent): Newsletters, product announcements, and event invites. You can opt out at any time.
• To comply with the law: Respond to court orders, tax obligations, or regulatory requests.
• To protect security: Detect and prevent fraud, abuse, or unauthorised access.

We never sell your personal data to any third party.

5. Who We Share Data With

We share data only where necessary, and only with parties who are contractually bound to protect it.

We do not share your data with advertisers, data brokers, or any party for their own marketing purposes.

For on-premises deployments, your data is processed entirely within your own environment and is not shared with sub-processors. A current sub-processor list covering any hosted services is available to enterprise customers on request.

6. International Transfers

Fragiliti is based in India. The personal data we collect directly (enquiries, sales and support) may be processed in India and in other countries where our website service providers operate - for example, the United States for our contact-form provider. Data inside your on-premises deployment is not transferred to us and stays wherever you host it.

For EU/EEA users (GDPR)

When we transfer the data we hold outside the EU/EEA, we rely on appropriate safeguards, such as:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions where applicable
• Equivalent safeguards where required

For Indian users (DPDP Act 2023)

We transfer personal data outside India only to countries or entities permitted under applicable rules notified by the Government of India.

For US users

We comply with applicable US state privacy laws including CCPA (California), VCDPA (Virginia), and equivalent laws. We do not "sell" personal data as defined under these laws.

7. How Long We Keep Your Data

After retention periods expire, we securely delete or anonymise your data.

8. Your Rights

Depending on where you are located, you have various rights over your personal data. We honour all of them.

Everyone (Global)

• Access: Ask us what data we hold about you.
• Correction: Ask us to fix incorrect data.
• Deletion: Ask us to delete your data (subject to legal retention obligations).
• Withdraw consent: Where we rely on consent, you can withdraw it at any time.

EU/EEA residents (GDPR)

• Portability: Receive your data in a machine-readable format.
• Restriction: Ask us to pause processing while a dispute is resolved.
• Object: Object to processing based on legitimate interests.
• Lodge a complaint: With your local data protection authority (e.g. the supervisory authority in your EU member state).

Indian residents (DPDP Act 2023)

• Information: Know what personal data we process and for what purpose.
• Correction and erasure: Request correction or erasure of your personal data.
• Grievance redressal: Contact our grievance officer (Tarun Agarwal) at contact@fragiliti.com. We will respond within 48 hours and resolve within 30 days.
• Nominate: Nominate another individual to exercise rights on your behalf in case of death or incapacity.

California residents (CCPA/CPRA)

• Know / Access / Delete / Correct / Portability rights as above.
• Opt out of sale/sharing: We do not sell or share personal data for cross-context behavioural advertising. No opt-out needed, but you may contact us to confirm.
• Non-discrimination: We will never treat you differently for exercising your privacy rights.
• Sensitive personal information: We do not use sensitive personal information beyond what is necessary to provide our service.

9. Children's Privacy

The Fragiliti Platform is designed for business users and is not intended for children under the age of 18 (or the applicable age of digital consent in your jurisdiction, 13 in the US, 16 in much of the EU).

We do not knowingly collect data from minors. If you believe a child has provided us with personal data, please contact us immediately at contact@fragiliti.com and we will delete it promptly.

10. Cookies

Our website uses a strictly necessary preference store (such as your light/dark theme choice) via local storage. For privacy-friendly usage measurement we use Cloudflare Web Analytics, which is cookieless — it counts aggregate page views and visit data without setting cookies and without tracking you across other websites. We do not use advertising cookies.

11. Security

The data you analyse in Fragiliti stays within your own on-premises environment, secured by your infrastructure; we do not receive or store it. For the limited personal data we do hold (enquiries, sales and support), key measures include:

• Data in transit is encrypted using TLS 1.2 or higher.
• Access is restricted to authorised personnel using multi-factor authentication.
• We conduct regular security reviews and vulnerability assessments.
• We are working towards SOC 2 Type II and align our controls to it.

For our full security practices, see the Security Compliance Overview.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Update the "Last updated" date at the top of this page.
• Notify enterprise customers in advance of significant changes that affect them.

The latest version always governs. If you have questions about a change, contact us at contact@fragiliti.com.

13. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or your personal data:

For EU residents: if you are not satisfied with our response, you have the right to complain to your local data protection authority.