Privacy Policy — Hello2AI

Hello2AI ("Hello2AI", "we", "us", or "our") provides AI awareness workshops, training programs, and related communications.

This Policy is published in accordance with:

• The Digital Personal Data Protection Act, 2023 (DPDP Act) and its rules, Government of India.
• The Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (SPDI Rules), Government of India.
• The CAN-SPAM Act (United States), for any commercial email sent to recipients in the United States.
• Amazon Web Services' Acceptable Use Policy and Service Terms, which require senders using Amazon SES to disclose data practices, obtain permission before sending, and provide a working unsubscribe mechanism.

By providing us your email address or other personal data, or by subscribing to our mailing list, you acknowledge that you have read and understood this Policy.

Hello2AI is the data controller (referred to as the "Data Fiduciary" under the DPDP Act) responsible for the personal data described in this Policy.

Contact for privacy questions, grievances, or data rights requests: privacy@hello2ai.in

Grievance Officer (DPDP Act, Section 13): The Grievance Officer for Hello2AI can be reached at privacy@hello2ai.in. We will acknowledge grievances within a reasonable time and aim to resolve them within 30 days of receipt.

We collect and process the following categories of personal data:

3.1 Data you or your organization provide to us

• Name and email address (e.g. when you register for a workshop, request information, or are added to a mailing list by an organization you are affiliated with).
• Any additional fields voluntarily supplied for personalization, such as first name, organization name, or role (used for greeting personalization in emails, e.g. "Hi {{first_name}}").

3.2 Data generated by your interaction with our emails

• Delivery status (delivered, bounced, or failed).
• Whether an email was opened, using a tracking pixel.
• Whether a link in an email was clicked, using redirect tracking.
• Approximate geographic location (country and city only) derived from the IP address at the moment an email is opened or a link is clicked. The raw IP address itself is not stored; only the derived location is retained.
• General email client or device category, where technically inferable from open/click events.
• Unsubscribe and spam-complaint status.

3.3 Account data (for our own staff and authorized senders only)

Email address, hashed password, and two-factor authentication status for individuals who operate our email sending platform. This data is not collected from the public and is used solely for internal access control and audit logging.

We do not knowingly collect sensitive personal data (as defined under the SPDI Rules, e.g. financial information, health data, biometric data, or passwords of external users) through our mailing list or workshop registration process.

We use personal data for the following purposes:

• To send you workshop invitations, training materials, and related informational or promotional communications you have consented to receive.
• To personalize communications (e.g. using your name in a greeting).
• To measure and improve the effectiveness of our communications (delivery, open, and click statistics).
• To maintain a suppression list of addresses that have unsubscribed, bounced, or complained, so that we do not contact them again.
• To detect, prevent, and respond to abuse, fraud, or security incidents.
• To comply with legal obligations, including recordkeeping required by applicable law.

We do not use personal data for any purpose incompatible with the above without seeking fresh consent where required by law.

Under the DPDP Act, we process personal data on the basis of:

• Consent: for individuals who have opted in to receive communications from Hello2AI (e.g. by registering for a workshop, submitting a contact form, or otherwise providing their email address for this purpose).
• Legitimate use: for limited purposes such as responding to a request you have made, or where processing is necessary to comply with a legal obligation.

You may withdraw consent at any time. Withdrawing consent will not affect the lawfulness of processing carried out before withdrawal.

In compliance with the CAN-SPAM Act and AWS's Acceptable Use Policy:

• We only send commercial or bulk email to recipients who have provided their email address to us or to an organization that has authorized us to contact them on its behalf.
• Every commercial email we send includes a clear and conspicuous unsubscribe mechanism, including a one-click "List-Unsubscribe" header where supported by the recipient's email provider.
• Unsubscribe requests are honored promptly and the address is added to our suppression list, after which no further commercial email is sent to that address.
• We do not use false or misleading header information, deceptive subject lines, or harvested or randomly generated email addresses.
• We do not sell, rent, or trade your email address or other personal data to third parties for their own marketing purposes.

To unsubscribe, click the "unsubscribe" link included in any email you receive from us, or email privacy@hello2ai.in with your request.

We share personal data only with the following categories of recipients, each acting as our data processor under contractual confidentiality and security obligations:

• Amazon Web Services (AWS), specifically Amazon Simple Email Service (SES), used to deliver email on our behalf. Data is processed in the AWS Asia Pacific (Hyderabad) region (ap-south-2).
• Postmark (ActiveCampaign, Inc.), used as an alternate email delivery provider. Postmark processes data in the United States; this may involve a cross-border transfer of personal data outside India.
• Resend, used solely to send internal operational alerts to our own team (e.g. delivery-failure notifications); this processor does not receive recipient mailing-list data.

We do not share personal data with any other third party except:

• Where required by law, regulation, court order, or governmental request.
• Where necessary to protect the rights, property, or safety of Hello2AI, our users, or the public.
• With your explicit consent.

Where personal data is transferred outside India (for example, to Postmark in the United States, as described in Section 7), we take steps to ensure that such transfers are made only to processors that maintain adequate data protection safeguards, consistent with the requirements of the DPDP Act.

We retain personal data only for as long as necessary to fulfill the purposes described in this Policy, including:

• Mailing-list contact data: retained while you remain subscribed, and for a reasonable period after unsubscribing solely to maintain the suppression list (so that we do not re-contact you).
• Engagement data (opens, clicks, derived location): retained for as long as the associated campaign record is retained, for reporting purposes.
• Account data for internal platform users: retained for the duration of their authorization to use the platform, plus any period required for audit or legal purposes.

When personal data is no longer required, we delete or anonymize it, except where retention is required by applicable law.

We implement reasonable security practices and procedures as required under the SPDI Rules, including:

• Encryption of sensitive configuration data (such as API credentials) at rest.
• Encryption of data in transit using TLS.
• Access controls, including mandatory two-factor authentication for staff who administer the email sending platform.
• Audit logging of administrative actions.
• Automated and manual bounce and complaint handling to protect recipients and maintain sender reputation.

No method of transmission or storage is completely secure. While we strive to protect personal data, we cannot guarantee absolute security.

Under the DPDP Act, as a Data Principal you have the right to:

• Obtain a summary of the personal data we hold about you and the processing activities carried out.
• Request correction, completion, or updating of your personal data.
• Request erasure of your personal data, unless retention is required by law.
• Withdraw consent at any time, as easily as it was given.
• Nominate another individual to exercise your rights in the event of your death or incapacity.
• Lodge a grievance with our Grievance Officer, and if unresolved, escalate the matter to the Data Protection Board of India.

To exercise any of these rights, contact privacy@hello2ai.in. We may need to verify your identity before acting on a request.

Our communications and workshops are directed at working professionals and organizations, not children. We do not knowingly collect personal data from individuals under the age of 18. If we become aware that we have inadvertently collected personal data from a child without verifiable parental or guardian consent, we will delete it promptly.

If you visit hello2ai.in, we may use cookies or similar technologies for basic website functionality and analytics. Email open and click tracking (Section 3.2) uses standard tracking pixels and link redirects, not browser cookies. You may disable image loading in your email client to prevent open tracking, or avoid clicking tracked links.

We may update this Policy from time to time to reflect changes in our practices or applicable law. The "Last Updated" date at the top of this Policy indicates when it was last revised. Material changes will be communicated through our website or by email where appropriate.

For any questions, requests, or grievances regarding this Policy or our data practices, please contact:

Hello2AI
Email: privacy@hello2ai.in

If you are not satisfied with our response, you may file a complaint with the Data Protection Board of India, established under the DPDP Act, 2023.