Privacy Policy

1. Introduction

This Privacy Policy ("Policy") describes how Promptworks Private Limited, a company incorporated under the Companies Act ("Promptworks", "we", "us", or "our"), collects, uses, stores, shares, and protects personal data when you access or use the website maarket.ai, its subdomains, and related services (collectively, the "Platform").

This Policy is published in accordance with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"), the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and the Digital Personal Data Protection Act, 2023 ("DPDP Act") together with the rules made thereunder as and when they come into force. Promptworks is the "data fiduciary" (as defined in the DPDP Act) in respect of the personal data described in this Policy.

This Policy forms part of, and should be read together with, our Terms of Service. By accessing or using the Platform, or by providing your personal data to us, you acknowledge that you have read and understood this Policy and, where consent is the applicable legal basis, you consent to the collection, use, and disclosure of your personal data as described here. If you do not agree, please do not use the Platform.

2. Scope and Who This Policy Covers

This Policy applies to all visitors, registered Community Members, Vendors, and any other person whose personal data we process in connection with the Platform, whether located in India or elsewhere. It does not apply to the privacy practices of Vendors whose products are listed on the Platform, or to third-party websites, services, or applications that may be linked from the Platform; those are governed by their own privacy policies.

Where a Vendor provides us with personal data of its own personnel (for example, a founder's name and photograph for an interview or case study), the Vendor is responsible for ensuring it has the necessary authority and notices in place to do so.

3. Personal Data We Collect

3.1 Information you provide to us

Account and profile data: name, email address, username, password (stored in hashed form), profile photo or avatar, job title, company name, role or job category, location (city/country), social media handles and links, and any biography or profile description you choose to add.

Authentication data: if you sign in using a third-party provider (such as Google, GitHub, or LinkedIn), we receive the identifiers and profile information that provider makes available to us according to your settings with that provider.

Vendor and Listing data: product name, description, category, website URL, logo, screenshots, demo videos, pricing information, integration and capability claims, company details, and the details of the person submitting or claiming the Listing (including responses to our product submission form).

Community contributions: reviews, ratings, comments, "I use this" signals, recommendations, tech stacks or product playlists you build, and any other content you publish on the Platform. Please note that these contributions are generally public and may be displayed with your name, username, avatar, and role.

Payment and billing data: for Vendors purchasing a Boost Plan — billing name, billing address, company name, GSTIN or tax identification number, and the transaction records generated by our payment processor. We do not store your full payment card number, CVV, or bank account credentials; these are collected and processed directly by our payment processor.

Communications: the contents of emails, support requests, form submissions, interview responses, survey responses, and any other correspondence with us, together with any metadata associated with those communications.

Promotional and editorial content: where you participate in a founder or operator interview, case study, or social post under a Boost Plan or content programme, the information, quotations, images, and recordings you provide for that purpose.

3.2 Information collected automatically

Usage and interaction data: pages and Listings viewed, categories browsed, searches performed, links and outbound clicks (including clicks on Vendor websites that earn Karma Points), features used, referring and exit pages, time and date of visits, and time spent on pages.

Karma Points activity: the actions you take that earn or award Karma Points, the timestamps of those actions, and the resulting scores and leaderboard positions.

Device and technical data: IP address, browser type and version, operating system, device type and identifiers, screen resolution, language settings, and approximate location derived from your IP address.

Cookies and similar technologies: as described in Section 8.

Log data: server logs, error reports, and security events.

3.3 Information from third parties

We may receive information about you from third parties, including authentication providers, our payment processor (transaction status and limited billing details), analytics providers, publicly available sources (such as company websites, product documentation, and public professional profiles used to enrich or verify Listings), and other Users (for example, where a Vendor names you as a contact or a Community Member tags your product in a stack).

3.4 Sensitive personal data

We do not require, and ask that you do not provide, any sensitive personal data or information as defined under the SPDI Rules (such as financial information beyond what is needed for billing, health information, biometric data, or information about religious or political beliefs, caste, or sexual orientation). If you choose to include such information in a public profile, review, or communication, you do so at your own risk and consent to its processing as described in this Policy.

4. How We Use Personal Data

We process personal data for the following purposes:

Purpose	Examples
Providing and operating the Platform	Creating and managing your account; publishing Listings, reviews, stacks, and profiles; calculating and displaying Karma Points, rankings, and leaderboards; enabling search and discovery; generating shareable images (such as stack or playlist cards).
Processing payments and fulfilling Boost Plans	Charging subscription fees; issuing invoices and GST-compliant tax documents; delivering featured placement, banners, case studies, interviews, social posts, and launch support; managing cancellations.
Communicating with you	Sending transactional emails (account, security, billing, plan changes); responding to support and grievance requests; notifying you of changes to our terms or policies.
Marketing and community engagement	Sending newsletters, product updates, leaderboard digests, offers, scratch-card or reward promotions, and invitations to interviews or content programmes, where permitted by law and subject to your right to opt out.
Integrity, safety, and anti-abuse	Detecting and preventing fake accounts, review manipulation, Karma Points fraud, scraping, spam, and other violations of our Terms of Service; enforcing our policies; protecting Users and the Platform.
Analytics and improvement	Understanding how the Platform is used; measuring feature performance; improving search, ranking, and recommendation quality; testing new features; producing aggregated statistics.
AI and answer engine optimisation (AEO)	Structuring Listing and community data so that it can be discovered by search engines and AI assistants; using publicly submitted content to improve our search, ranking, and AI-assisted features.
Legal and compliance	Complying with applicable laws, tax obligations, lawful government requests, and court orders; establishing, exercising, or defending legal claims; fulfilling intermediary due-diligence obligations.
Business transfers	Evaluating or completing a merger, acquisition, financing, reorganisation, or sale of assets involving Promptworks.

We may also create and use aggregated, de-identified, or anonymised data (for example, "the most-used CRM tools among founders in India") that cannot reasonably be used to identify you, for any purpose, including publishing industry reports and insights.

5. Legal Basis for Processing

Under the DPDP Act and, where applicable, other data protection laws, we rely on the following grounds:

Consent: for marketing communications, non-essential cookies, participation in interviews or case studies, and any other processing where the law requires your consent. You may withdraw consent at any time as described in Section 10; withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Voluntary provision for a specified purpose (legitimate use): where you voluntarily provide personal data to us for a purpose (for example, creating an account, submitting a Listing, purchasing a Boost Plan, or requesting support) and have not indicated that you object to its use for that purpose.

Performance of a contract: to provide the Platform and Boost Plans you have signed up for under our Terms of Service.

Compliance with law: to meet our obligations under Indian law, including tax, corporate, and intermediary regulations, and to respond to lawful orders.

Legitimate interests: where applicable law recognises this basis (for example, for Users in the European Economic Area or United Kingdom), for fraud prevention, security, analytics, and the operation and improvement of the Platform, balanced against your rights and interests.

We do not sell your personal data. We share personal data only in the following circumstances:

6.1 Publicly on the Platform

The Platform is a community directory. Your public profile (name or username, avatar, role, company, and links you add), your reviews, ratings, "I use this" signals, recommendations, tech stacks, Karma Points totals, leaderboard positions, and badges are visible to other Users and to the public, and may be indexed by search engines and AI assistants. Listings, including the Vendor company name and any founder or contact names included in the Listing, are also public. Please consider carefully what you choose to make public.

6.2 With Vendors

When you review, recommend, or signal that you use a product, the Vendor of that product can see your public contribution. We do not share your email address or private account details with Vendors without your consent, except that aggregated, non-identifying engagement statistics (such as click and view counts) may be provided to Vendors as part of Listing analytics or Boost Plan reporting.

6.3 With service providers (data processors)

We engage third-party service providers to perform services on our behalf under contractual obligations of confidentiality and data protection. These may include: cloud hosting and database providers (such as Supabase and their underlying cloud infrastructure providers); authentication providers; payment processors; email and transactional messaging providers; analytics and product-usage tools; customer support and help-desk tools; image and media generation or storage services; social media scheduling tools (for Boost Plan social posts); and security, fraud-prevention, and error-monitoring tools. These providers may access personal data only as necessary to perform their services for us.

6.4 For promotional content

Where you participate in a case study, interview, social post, or similar content programme, the content you approve for publication (which may include your name, title, company, likeness, and quotations) will be published on the Platform and may be distributed on our social media channels and other marketing channels.

6.5 Legal, safety, and compliance

We may disclose personal data where we believe in good faith that disclosure is necessary to comply with applicable law, regulation, legal process, or lawful governmental request (including under Section 69 or Section 79 of the Information Technology Act, 2000 and the rules thereunder); to enforce our Terms of Service; to detect, prevent, or address fraud, security, or technical issues; or to protect the rights, property, or safety of Promptworks, our Users, or the public.

6.6 Corporate transactions

If Promptworks is involved in a merger, acquisition, financing, reorganisation, bankruptcy, or sale of all or a portion of its assets, personal data may be transferred to the acquiring or successor entity, subject to this Policy or a policy that is no less protective.

We may share personal data for any other purpose disclosed to you at the time of collection or with your consent.

7. International Data Transfers

Promptworks is headquartered in Bengaluru, India. Our service providers may store or process personal data on servers located outside India, including in the United States, Singapore, and the European Union. By using the Platform, you understand that your personal data may be transferred to, stored, and processed in countries other than the one in which you reside, which may have data protection laws that differ from those of your country. We take steps to ensure that such transfers comply with applicable law, including the DPDP Act and any restrictions notified by the Central Government of India, and, where required for Users in the EEA or UK, by using appropriate safeguards such as standard contractual clauses.

8. Cookies and Similar Technologies

We use cookies, local storage, pixels, and similar technologies to operate the Platform, remember your preferences and login state, understand how the Platform is used, measure the performance of features and Sponsored Content, and detect abuse. Categories of cookies we may use include:

Strictly necessary cookies: required for authentication, security, session management, and core functionality. These cannot be disabled through the Platform.

Preference cookies: remember your settings, such as leaderboard view (weekly / all-time), theme, and language.

Analytics cookies: help us understand traffic, usage patterns, and feature performance, typically in aggregated form.

Marketing and attribution cookies: used to measure the effectiveness of campaigns, referrals, and Boost Plan content, and to attribute outbound clicks to Listings.

You can control cookies through your browser settings and, where we provide one, through our cookie preferences tool. Disabling certain cookies may affect the functionality of the Platform. We currently do not respond to "Do Not Track" browser signals.

9. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, accounting, tax, or reporting requirements, and to resolve disputes and enforce our agreements. In general:

Account data is retained for as long as your account is active and for a reasonable period thereafter to allow reactivation and to comply with legal obligations.

Billing and transaction records are retained for at least eight (8) years from the end of the relevant financial year, as required under the Companies Act, 2013 and Indian tax laws.

Public contributions (reviews, ratings, signals) that other Users have relied upon may be retained and displayed after you delete your account, in which case they will be de-identified (for example, attributed to "a maarket.ai member") unless you request their deletion and the law does not require their retention.

Karma Points and ranking history is retained in aggregated or de-identified form to preserve the integrity of historical leaderboards and rankings.

Server logs and security data are retained for the periods required under applicable intermediary rules (currently one hundred and eighty (180) days from account deletion or withdrawal of registration under the 2021 Intermediary Guidelines) and for as long as reasonably necessary for security purposes.

Where retention is no longer necessary and no legal obligation requires it, we will delete or anonymise personal data within a reasonable period. Where you cease to use the Platform for an extended period and no longer need us to retain your data for a specified purpose, we will erase your personal data in accordance with the DPDP Act, subject to applicable legal retention requirements.

10. Your Rights and Choices

Subject to applicable law, and in accordance with the DPDP Act where it applies, you have the following rights in relation to your personal data:

Access: to obtain a summary of the personal data we process about you, the processing activities undertaken, and the identities of the data fiduciaries and processors with whom it has been shared.

Correction and updating: to request correction of inaccurate or misleading data, completion of incomplete data, and updating of your personal data. You can update most profile and Listing data directly through your account.

Erasure: to request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to legal retention obligations and the exceptions described in Section 9.

Withdrawal of consent: to withdraw any consent you have given, with effect for the future, as easily as it was given.

Grievance redressal: to have your grievance heard and addressed by our Grievance Officer (Section 12).

Nomination: to nominate another individual who may exercise your rights in the event of your death or incapacity, as provided under the DPDP Act.

Opt out of marketing: to stop receiving marketing communications by clicking the "unsubscribe" link in any marketing email or by adjusting your notification settings. Transactional and service communications will continue while your account remains active.

Additional rights for certain jurisdictions: if you are located in the EEA, UK, or a jurisdiction with comparable laws, you may also have rights to data portability, to restrict or object to processing, and to lodge a complaint with your local supervisory authority.

To exercise any of these rights, contact us at [privacy@maarket.ai] or through the contact details in Section 14. We may need to verify your identity before acting on your request. We will respond within the timeframes required by applicable law. We will not discriminate against you for exercising your rights.

You also have a duty under the DPDP Act not to impersonate another person, not to suppress material information, not to register false or frivolous grievances or complaints, and to furnish only verifiably authentic information when exercising your rights.

11. Security

We implement reasonable security practices and procedures, as required under Section 43A of the Information Technology Act, 2000 and the SPDI Rules, and appropriate technical and organisational measures under the DPDP Act, designed to protect personal data from unauthorised access, disclosure, alteration, or destruction. These include encryption of data in transit (TLS), hashed password storage, access controls and role-based permissions, use of reputable cloud infrastructure providers with industry-standard security certifications, logging and monitoring, and periodic review of our practices.

No method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your login credentials confidential. In the event of a personal data breach affecting you, we will notify you and the Data Protection Board of India (or other relevant authority) in the manner and within the time required by applicable law.

12. Grievance Officer

In accordance with the Information Technology Act, 2000, the SPDI Rules, the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and the DPDP Act, we have appointed a Grievance Officer to address your concerns regarding personal data, content on the Platform, and this Policy:

Name: [Grievance Officer Name]

Designation: Grievance Officer, Promptworks Private Limited

Email: [privacy@maarket.ai]

Address: [Registered Address], Bengaluru, Karnataka, India

We will acknowledge your grievance within twenty-four (24) hours and endeavour to resolve it within fifteen (15) days of receipt, or such shorter time as required by applicable law. If you are not satisfied with our response, you may, where the DPDP Act applies, approach the Data Protection Board of India after exhausting this grievance mechanism.

13. Children

The Platform is intended for business users and is not directed at individuals under the age of eighteen (18). We do not knowingly collect personal data from children. If you believe that a child has provided us with personal data, please contact our Grievance Officer and we will take steps to delete such data and terminate the relevant account.

14. Third-Party Links, Vendors, and AI Assistants

The Platform contains links to Vendor websites, demo videos, social media, and other third-party sites and services. We are not responsible for the privacy practices of those third parties. When you click an outbound link to a Vendor website, the Vendor may collect information about you in accordance with its own privacy policy; we may record the click for Karma Points and analytics purposes.

Content that you make public on the Platform (including Listings, reviews, and profiles) is designed to be discoverable and may be crawled, indexed, summarised, or cited by search engines, AI assistants, and answer engines operated by third parties. We do not control how such third parties collect, cache, or display public content once it has been indexed.

15. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices, technology, legal requirements, or the Platform. The updated Policy will be posted on the Platform with a revised "Last updated" date. For material changes, we will provide notice by email to registered Users or by a prominent notice on the Platform before the changes take effect. Your continued use of the Platform after the effective date of the updated Policy constitutes acceptance of the changes, to the extent permitted by law.

16. Governing Law and Jurisdiction

This Policy shall be governed by and construed in accordance with the laws of India. Subject to the dispute resolution provisions of our Terms of Service, any dispute arising out of or in connection with this Policy shall be subject to the exclusive jurisdiction of the courts at Bengaluru, Karnataka, India, and the seat of any arbitration shall be Bengaluru, Karnataka, India.

17. Contact Us

If you have questions, concerns, or requests regarding this Policy or our handling of your personal data, please contact us:

Promptworks Private Limited (operating maarket.ai)

Privacy and data protection requests: [founders@maarket.ai]

General support: [founders@maarket.ai]