Privacy Policy
This Privacy Policy explains how Mavix Digital Private Limited ("Contravi.AI", "we", "us", or "our") collects, uses, shares, and protects personal data when you use the Contravi.AI contract-workflow platform, our website, and related services (collectively, the "Service"). Contravi.AI is available to users around the world, and this Policy applies to all of them.
Where we decide why and how personal data is processed, we act as a data controller (referred to as a "Data Fiduciary" under India's Digital Personal Data Protection Act, 2023). Where we process personal data contained in documents and content on behalf of a customer, we act as a data processor (a "Data Processor" under the DPDP Act, or a "service provider" under US laws) — see Section 5.
We aim to align our practices with major data-protection frameworks, including India's Digital Personal Data Protection Act, 2023 ("DPDP Act"), the EU and UK General Data Protection Regulation ("GDPR" / "UK GDPR"), and US state privacy laws such as the California Consumer Privacy Act, as amended by the CPRA ("CCPA"). Depending on where you live, additional region-specific rights apply — see Section 10.
By using the Service, you (the "you", also a "Data Principal", "data subject", or "consumer" depending on your region) acknowledge that you have read and understood this Policy. Where we rely on your consent, we will request it separately and you may withdraw it at any time as described below.
Contents
- Personal data we collect
- How and why we use your data
- Legal bases for processing
- Consent and its withdrawal
- Documents and content you upload
- When we share data
- International data transfers
- Data retention
- How we protect your data
- Your privacy rights (by region)
- Children's data
- Cookies and analytics
- Complaints and grievance redressal
- Changes to this Policy
- Contact us
1. Personal data we collect
We collect personal data that you provide directly, data generated as you use the Service, and limited data from third parties that help us operate the Service.
| Category | Examples |
|---|---|
| Account & identity data | Name, work email address, phone number, employer/organisation, role, and login credentials. |
| Document & workflow data | Contracts, engagement letters, employment letters and other documents you upload or create, along with comments, signatures, signatory details, and workflow metadata (status, dates, owners). |
| Billing data | Billing name, address, GSTIN (if applicable), and transaction records. Card and bank details are handled by our payment processor and are not stored by us. |
| Usage & device data | IP address, browser and device type, pages viewed, actions taken, log and diagnostic data, and approximate location derived from IP. |
| Communications | Messages, support requests, and feedback you send us. |
2. How and why we use your data
We process personal data for the following purposes, relying either on your consent or on the "certain legitimate uses" permitted under the DPDP Act (such as performing the service you have requested):
- To create and administer your account and provide the Service;
- To enable contract upload, creation, sharing, negotiation, commenting, e-signature, search, and management;
- To send service, security, and transactional communications;
- To process payments and maintain billing records;
- To provide support and respond to your requests;
- To monitor, secure, debug, and improve the Service;
- To send product updates or marketing where you have consented (you can opt out at any time); and
- To comply with legal obligations and enforce our terms.
3. Legal bases for processing
Where the GDPR or UK GDPR applies, we rely on one or more of the following legal bases to process personal data:
- Performance of a contract — to provide the Service you or your organisation have requested;
- Legitimate interests — to secure, operate, improve, and market the Service, provided your rights do not override those interests;
- Consent — for non-essential cookies, certain marketing, and any optional processing, which you may withdraw at any time; and
- Legal obligation — to comply with laws, regulations, and lawful requests.
Where India's DPDP Act applies, we process personal data on the basis of your consent or the "certain legitimate uses" permitted under that Act (such as providing a service you have requested). Where US state privacy laws apply, we process personal data for the business and commercial purposes described in this Policy and, where required, with your consent.
4. Consent and its withdrawal
Where processing is based on consent, your consent is free, specific, informed, unconditional, and unambiguous, and limited to the purpose for which it is given. You may withdraw your consent at any time by contacting us at founders@contravi.ai or through in-product settings where available. Withdrawing consent will not affect the lawfulness of processing carried out before withdrawal, and may limit or prevent your continued use of certain features.
5. Documents and content you upload
The Service lets you upload and process documents that may themselves contain personal data of third parties (for example, counterparties, employees, or signatories). In respect of that content, the customer is the data controller (Data Fiduciary / "business") and we act as a data processor (Data Processor / "service provider") processing such data solely on the customer's documented instructions and on their behalf. The customer is responsible for ensuring it has a lawful basis and any required notices or consents to process that data through the Service. For business customers, this processing is also governed by our Data Processing terms and Master Service Agreement.
We do not access, read, review, monitor, sell, or use the contents of the contracts and documents you upload or execute on the Service. Your document content is yours. Our systems store, transmit, and process it only as needed to provide the Service (for example, hosting, back-ups, e-signature, and features you enable such as search), and our personnel do not access document content except in limited cases where you ask us to (such as support you request) or where we are legally compelled to do so by a valid, binding order from a competent federal, state, or other governmental or judicial authority. Where we are legally required to disclose content, we will, unless prohibited by law, take reasonable steps to notify the affected customer.
6. When we share data
We do not sell your personal data, and we do not "share" it for cross-context behavioural advertising as those terms are defined under US state privacy laws. We disclose personal data only as follows:
- Service providers (Data Processors): cloud hosting, storage, payment processing, e-signature, email delivery, and analytics providers who process data under contract and only on our instructions;
- Within a workflow: with the parties you choose to share a document or workflow with;
- Legal and safety: where required by law, regulation, court order, or to protect rights, safety, and the integrity of the Service; and
- Business transfers: in connection with a merger, acquisition, or sale of assets, subject to this Policy.
7. International data transfers
Contravi.AI operates globally, and we and our service providers may process and store personal data in countries other than the one in which you are located, including India, the United States, and the European Union. Data-protection laws in these countries may differ from those where you live.
Where we transfer personal data across borders, we take steps designed to ensure it remains protected, including relying on appropriate safeguards where required — such as the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum) for transfers from the EEA and UK. For transfers from India, we comply with the DPDP Act and do not transfer data to any country or territory that the Central Government may notify as restricted.
8. Data retention
We retain personal data only for as long as necessary to fulfil the purposes described in this Policy, to provide the Service, and to comply with legal, accounting, or reporting obligations. When personal data is no longer required, we will erase it or anonymise it, unless retention is required by law. You may request deletion of your account and associated data as described under your rights below. Note that residual copies may persist in backups and logs for a limited additional time before being overwritten.
9. How we protect your data
We implement reasonable security safeguards designed to protect personal data, including encryption in transit, access controls, and monitoring. However, no method of transmission or storage is completely secure. While we work toward independent certifications (such as SOC 2 and ISO/IEC 27001), these audits are still in progress and have not been completed. In the event of a personal data breach, we will notify the relevant supervisory authorities (including, as applicable, the Data Protection Board of India, EU/UK supervisory authorities, and US state regulators) and affected individuals where required by applicable law.
10. Your privacy rights (by region)
Depending on where you are located, you may have some or all of the following rights. To exercise any right, contact us at founders@contravi.ai. We may need to verify your identity first, and we will not discriminate against you for exercising your rights.
10.1 All users
- Access the personal data we hold about you and how we process it;
- Correct, complete, or update inaccurate or incomplete data;
- Delete your personal data where it is no longer necessary; and
- Withdraw consent where processing is based on consent.
10.2 EEA & UK (GDPR / UK GDPR)
In addition, you may have the right to restrict or object to processing, to data portability, to not be subject to solely automated decisions with legal or similarly significant effects, and to lodge a complaint with your local supervisory authority (or the UK Information Commissioner's Office).
10.3 United States (California and other states)
Depending on your state, you may have the right to know/access the categories and specific pieces of personal information we collect, to delete or correct it, and to opt out of the "sale" or "sharing" of personal information and of certain targeted advertising and profiling. We do not sell or share personal information as those terms are defined under US state privacy laws. You may submit a request yourself or through an authorised agent.
10.4 India (DPDP Act)
As a Data Principal, you also have the right to grievance redressal through the mechanism in Section 13 and to nominate another individual to exercise your rights in the event of death or incapacity.
11. Children's data
The Service is intended for business use and is not directed at children. We do not knowingly collect or process the personal data of children. Because the definition of "child" varies by region — for example, under 18 under India's DPDP Act, under 16 (or a lower age set by a member state) under the GDPR, and under 13 under the US Children's Online Privacy Protection Act (COPPA) — we do not knowingly process data of anyone under the applicable age without verifiable parental or guardian consent, and we do not carry out tracking, behavioural monitoring, or targeted advertising directed at children.
12. Cookies and analytics
We use cookies and similar technologies to keep you signed in, remember preferences, secure the Service, and understand usage. You can control cookies through your browser settings; disabling some cookies may affect functionality. Where required, we will request your consent for non-essential cookies and honour recognised opt-out preference signals (such as Global Privacy Control) where applicable.
13. Complaints and grievance redressal
If you have any concern or complaint regarding the processing of your personal data, please contact us first so we can try to resolve it:
Data Protection / Grievance Officer: [Officer Name]
Mavix Digital Private Limited
4409 Achivers, Sector 49, Faridabad 121001, India
Email: founders@contravi.ai
We will acknowledge and endeavour to resolve your concern within the timelines prescribed under applicable law. If you are not satisfied with our response, you may have the right to escalate your complaint to the relevant authority — for example, the Data Protection Board of India, your EEA supervisory authority or the UK Information Commissioner's Office, or your US state Attorney General.
14. Changes to this Policy
We may update this Policy from time to time, particularly as the product evolves. We will post the updated version here and revise the "Last updated" date, and where changes are material we will take reasonable steps to notify you.
15. Contact us
Mavix Digital Private Limited
4409 Achivers, Sector 49, Faridabad 121001, India
CIN: U58200HR2026PTC146912
General privacy queries: founders@contravi.ai
Support: founders@contravi.ai