Privacy Policy

01PREAMBLE & SCOPE OF THIS POLICY

Zaio ("the Company," "we," "us," or "our") operates a unified, multi-layer vertical artificial intelligence and sovereign compute ecosystem under the Atmanirbhar Bharat initiative. This Master Privacy Policy governs all data processing activities across the Zaio digital presence and across our specialized platform verticals: ZVRN, BhAi, MRDN, DXTR, and Idly. This Policy applies to:

• (a) anonymous visitors browsing Zaio corporate marketing websites;
• (b) authenticated users and enterprise clients directly engaging with Zaio platform verticals;
• (c) hardware hosts and node operators participating in the ZVRN DePIN network;
• (d) parents, guardians, and institutions deploying DXTR hardware for minors; and
• (e) all data subjects whose personal data is processed by Zaio in any capacity.

Zaio operates under a strict data localization mandate in full compliance with India's Digital Personal Data Protection (DPDP) Act 2023, and applicable regional regulations. Where any conflict arises between the provisions of this Policy and statutory requirements, statutory requirements shall prevail.

02DEFINITIONS

For the purposes of this Policy, the following terms carry the meanings ascribed below:

03PART I: DIGITAL & WEB PRIVACY POLICY

This Part governs anonymous visitors browsing our corporate marketing websites, including zaio.in, mrdn.in, and idly.world.

1. Web Data Collection & Analytics

We do not track your personal identity during casual web browsing. To protect user privacy, our web properties utilize cookieless analytics to monitor site health, traffic volume, and performance metrics.

• Third-Party Analytics Integration: We utilize Cloudflare Web Analytics across all corporate domains (zaio.in, mrdn.in, and ecosystem sub-domains). Cloudflare Web Analytics is a privacy-first, non-invasive tool that does not use cookies and does not track individual cross-site behaviour.
• What We Collect via Web Telemetry: IP address (processed anonymously for geographic approximation), device type, operating system, browser type, referral URL, page response times, and localized network latency metrics.
• Where This Data Goes: Anonymous web telemetry is securely processed through Cloudflare's edge network. For further detail, please review the Cloudflare Privacy Policy.
• Future Transition: Zaio reserves the right to introduce consent-based cookies to enable advanced user state persistence. Any such deployment will be preceded by an explicit, interactive user-consent interface and an updated cookie notice.

2. Legal Basis for Web Data Processing

Processing of anonymous web telemetry is conducted on the basis of Zaio's legitimate interest in maintaining and improving the security and performance of its digital properties. No personal data is retained in identifiable form beyond the transient processing window required for Cloudflare's edge analytics service.

3. Cookies & Tracking Technologies (Current Status)

04PART II: PRODUCT & PLATFORM PRIVACY POLICY

This Part governs authenticated users, enterprise clients, hardware hosts, and data subjects interacting directly with the Zaio vertical software and hardware stack.

1. Legal Bases for Processing Across Verticals

Zaio processes personal data only where a valid legal basis exists under the DPDP Act 2023. The following table maps the primary basis applicable to each vertical:

2. Vertical Platform Ingestion Matrix

A. Idly — Media & Consumer Layer

• What We Collect: Approximate geographic location, demographic age brackets, user vocabulary metrics, and English comprehension baselines during interaction.
• Where It Goes: Data is stored locally on native device sessions and synchronised with secure regional caching layers to dynamically tailor news complexity and language settings.
• Training & Third-Party Status: Zero third-party exposure. Data is processed strictly within the internal Zaio media generation pipeline to train automated content engines on audience understanding.
• Retention Period: Session-bound vocabulary and comprehension data is retained only as long as operationally necessary to fulfill user personalizations. Anonymised aggregate data used for model training carries no retention limit.

B. MRDN / mrdn.in — Enterprise Data Fusion Layer

• What We Collect: Legacy corporate ERP data structures, real-time supply chain logistics, live machine telemetry, and structural database metadata ingested via the Orion automated wrapper.
• Where It Goes: This data never leaves sovereign soil or enters public networks. It goes directly into hardware-isolated, on-premise physical ZVRN compute nodes funded by the client, or temporary MeitY-empanelled sovereign cloud vaults during deployment cutovers.
• Training & Purpose Limitation: Zero third-party exposure. Anonymised elements of the internal Nexus ontology layer may be utilized for model fine-tuning only after an explicit, contractually executed data processing agreement is signed prior to corporate onboarding. Clients may opt out of model-training pipelines contractually without affecting core operational access to the MRDN stack.
• Retention Period: Enterprise operational data is retained for the duration of the active service contract, unless a shorter period is contractually agreed. Upon verified erasure request, data is purged across all active nodes within standard operational timelines.

C. DXTR — Vernacular K-12 Educational Layer

• What We Collect: Audio-native biometric voice waveforms, regional dialect variations, chronological academic milestone tracking, and behavioural performance data.
• Where It Goes: Audio inputs are processed at the immediate hardware edge by localised BhAi Small Language Models (SLMs). Performance records and cognitive milestones route securely to an immutable Web3 blockchain ledger to ensure data persistence across changing institutional environments.
• Training & Third-Party Status: Zero third-party exposure. Voice patterns and performance baselines are utilized to train BhAi's Textless NLP to understand unwritten regional dialects. Processing strictly requires verified parental and institutional consent prior to hardware deployment. Biometric voice data of minors is classified as Sensitive Personal Data and is subject to enhanced safeguards.
• Retention Period: Performance metrics and voice profiles are retained for the duration of active educational engagement and career guiding.
• Additional Minor Safeguards: No profiling for targeted advertising or commercial third-party exploitation is conducted on minor data. Parents and guardians may request full data erasure at any time via info@zaio.in.

D. ZVRN — Hardware DePIN Layer

• What We Collect: Host and tenant physical installation verification, localised node power-draw telemetry, and network hardware uptime logs.
• Where It Goes: Telemetry routes directly to the centralised Zaio infrastructure monitoring dashboard to calculate direct financial reimbursements for host electricity bills and dispatch contract rewards.
• Aggregated Hardware Performance Metadata: No application, user, or client data processing occurs on operational hardware telemetry. Hardware performance metadata (node uptime, processing throughput, thermal metrics, energy draw) is decoupled from personal identities, owned directly by Zaio, and utilized anonymously to maintain total grid optimisation.
• Retention Period: Raw node telemetry is retained for the duration required to complete financial reconciliation, electricity accounting, and grid diagnostics. Anonymised aggregate infrastructure performance data is retained indefinitely.

E. BhAi Engine — Foundational Sovereign AI Layer

• What We Collect: Raw spoken audio waveforms, scriptless vernacular inputs, cookies to store persistent interaction context, and situational prompt histories.
• Where It Goes: Processed directly within our regional infrastructure network to eliminate the latency and surveillance exposure of foreign-owned APIs.
• Training & Purpose Limitation: Zero third-party exposure. Spoken regional interactions are fed directly into Zaio's closed-loop self-learning architecture to build the industry's largest proprietary dataset of unwritten Indian dialects. If a user or platform application revokes training consent, contextual processing remains active solely to execute live user requests with zero persistent model retention.
• Retention Period: Raw audio inputs used for short-term inference are cleared immediately following processing, while training-consented data inputs are converted directly to anonymised phonetic embeddings.

05PART III: DATA TRANSFER & LOCALISATION

Zaio's fundamental architecture is designed to ensure that all personal data and sensitive enterprise data remains on sovereign Indian soil. This section sets out our data localisation commitments.

1. Cross-Border Transfer Prohibition

Zaio does not transfer personal data of Indian Data Principals to servers, processors, or sub-processors domiciled outside India. No Zaio vertical transmits identifiable personal data to foreign cloud infrastructure, foreign AI APIs, or foreign analytics platforms for routine processing.

2. Infrastructure Stack (Data Residency Map)

3. Sub-Processor Obligations

Where Zaio engages sub-processors (e.g., MeitY-empanelled cloud providers), Zaio ensures by contract that such sub-processors process data only on Zaio's documented instructions and maintain equivalent sovereign security standards.

06PART IV: SECURITY & TECHNICAL SAFEGUARDS

1. Baseline Technical Measures

• Encryption at Rest: All personal data and enterprise data stored on Zaio-controlled or client-funded nodes is encrypted using AES-256 or equivalent standards.
• Encryption in Transit: All data transmitted between nodes, clients, and Zaio infrastructure is encrypted using TLS 1.2 or higher. BhAi inference clusters operate on physically isolated networks.
• Access Controls: Role-based access control (RBAC) is enforced across all platform verticals. Privileged access to personal data is logged and limited to authorised personnel with a documented need.
• Intrusion Detection: Network monitoring and anomaly detection are deployed on all ZVRN nodes and the centralized infrastructure dashboard.

2. Personal Data Breach Notification

In the event of a personal data breach that is likely to result in harm to Data Principals, Zaio will notify the Data Protection Board of India and affected Data Principals promptly within prescribed statutory timeframes.

07PART V: PROCESSING OF CHILDREN'S DATA

Zaio takes the protection of children's personal data with the highest level of seriousness. This Part supplements the DXTR provisions in Part II and applies across all Zaio verticals.

1. Age Threshold & Verification

For the purposes of this Policy, a 'child' is any individual below the age of 18 years, consistent with the DPDP Act 2023. Zaio does not knowingly collect or process personal data of children through its consumer-facing or enterprise platforms except through the DXTR educational hardware vertical, which is specifically designed for supervised, consent-governed use.

2. Parental Consent Framework

• Prior to any DXTR hardware deployment, Zaio obtains verifiable parental or legal guardian consent in accordance with educational institution protocols.
• Consent is granular: parents are presented with choices regarding academic performance tracking, career guiding profiles, and dialect interactions.
• Parental consent may be withdrawn at any time via written notice to info@zaio.in.

3. Prohibited Processing of Minor Data

The following processing activities are absolutely prohibited in relation to data of children processed through any Zaio vertical:

• Behavioural advertising or commercial tracking of any kind.
• Transfer to any third party for commercial purposes.
• Use of biometric voice data for purposes other than educational dialect recognition and language personalization.

08PART VI: DATA RETENTION SCHEDULE

Zaio retains personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by law.

09PART VII: COMPLIANCE, RECIPIENTS, & DATA RIGHTS

1. Third-Party Data Disclosures

Zaio does not sell, rent, or trade proprietary user data, enterprise ontology profiles, or minor biometric voice records to any third-party marketing brokers or foreign entities. Data is shared only with the following verified infrastructure dependencies:

2. Statutory Rights Under the DPDP Act

Every Data Principal interacting with the Zaio ecosystem retains statutory rights under the DPDP Act 2023. Requests must be submitted to info@zaio.in.

• Right to Access: Obtain a summary of personal data processed by Zaio and the purposes for which it is being processed.
• Right to Correction & Completion: Request rectification of inaccurate, incomplete, or outdated personal data across active nodes.
• Right to Erasure: Request permanent deletion of personal data where the purpose of collection has been fulfilled or consent withdrawn.
• Right to Withdraw Consent: Revoke processing consent at any time.
• Right to Grievance Redressal: Formally escalate concerns to our compliance team; if unresolved, escalate to the Data Protection Board of India.

10PART VIII: COMPLIANCE & CONTACT DECK

For any inquiries regarding data privacy, exercising statutory rights, or clarification on infrastructure processing pipelines, contact the compliance team directly at: info@zaio.in. Zaio does not currently operate outside India. Should international operations commence, this Policy will be updated with applicable cross-border data transfer clauses prior to commencement.

11PART IX: POLICY UPDATES & VERSIONING

Zaio reserves the right to amend this Policy at any time to reflect changes in its products, legal obligations, or data processing practices. Material amendments will be published on zaio.in with a revised 'Last Updated' date. Continued use of Zaio services after the effective date constitutes acceptance of the revised terms.

12ACKNOWLEDGEMENT

This Master Privacy Policy has been reviewed and approved for publication by the Zaio leadership and legal compliance desk. Authorized Compliance Desk: info@zaio.in