Privacy Policy

Tensor Analytics LLC ("Tensor," "we," "our," "us") respects your privacy. This Privacy Policy explains how we collect, use, disclose, and protect personal information when you (i) browse any page under tensoranalytics.ai (the "Site"), (ii) submit information through the Site's Contact Us or Schedule Demo forms, or (iii) use our GrepEye platform and related services (collectively, the "Service").

This Policy is published in compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act) of India, the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 (collectively, "CCPA/CPRA"), and other applicable US state privacy laws. Where requirements differ, we apply the stricter standard.

By submitting a form you warrant that the information supplied is accurate and relates to a legitimate business enquiry. You grant Tensor permission to contact you using the details provided to respond to the enquiry, schedule a demo, and, if you opt in, send marketing communications. You may opt out of marketing at any time.

We collect the following categories of personal data:

• Identification data: name, job title, company name.
• Contact data: work email address, phone number (if provided).
• Enquiry data: the content of your message, the industry you select, and any planning problem you describe.
• Usage data: IP address, browser type, pages visited, referring URL, time on site, and similar analytics data collected via cookies and similar technologies (see our Cookie Policy).
• Customer data: if you become a customer, the data you upload to or generate within GrepEye, including demand history, item masters, location masters, and operational datasets.

We do not collect special categories of personal data (such as health, racial origin, political opinions, or religious beliefs) unless you voluntarily include such data in a free-text field. We recommend you do not include such data.

We process personal data for the following purposes:

• To respond to your enquiry and schedule a demo or walkthrough.
• To provide and maintain the Service, including onboarding, support, and troubleshooting.
• To improve the Site, the Service, and our marketing content based on aggregate usage analytics.
• To send marketing communications, but only where you have opted in or where we have a legitimate business interest and you have not opted out.
• To comply with legal obligations, enforce our Terms of Service, and protect the rights, property, or safety of Tensor, our customers, or others.
• To detect, prevent, and address technical issues, fraud, security incidents, or other malicious activity.

Under the DPDP Act, the lawful basis for processing is your consent (for marketing) or the performance of a contract / legitimate use (for service delivery). Under CCPA/CPRA, the lawful basis is the business purpose described above.

For users in India and other jurisdictions with consent-based data protection frameworks, we process personal data on the following bases:

• Consent: you have given clear, affirmative consent to the processing of your personal data for one or more specific purposes (e.g., marketing emails).
• Performance of a contract: processing is necessary to deliver the Service you have requested or to take steps at your request before entering into a contract.
• Compliance with legal obligation: processing is necessary to comply with applicable Indian law, US federal or state law, or a court order.
• Legitimate use: processing is necessary for purposes that Tensor reasonably considers to be in its legitimate interests, such as fraud prevention, network security, or product improvement, provided such interests are not overridden by your rights.

We do not sell or rent personal data. Disclosure is limited to:

• Service providers: third-party vendors who process data on our behalf, such as cloud infrastructure, analytics, email delivery, and customer support tools. Each vendor is bound by a written agreement requiring confidentiality and data protection safeguards consistent with this Policy.
• Legal compliance: where required by applicable law, court order, or government request, including requests from the Government of India under the DPDP Act and from US authorities under lawful process.
• Business transfers: in connection with a merger, acquisition, reorganisation, or sale of all or part of Tensor's assets, personal data may be transferred subject to confidentiality safeguards.
• Consent: with your separate, explicit consent for any disclosure not covered above.

We retain personal data only as long as necessary to fulfil the purposes described in this Policy, unless a longer retention period is required by law:

• Enquiry data: up to 24 months after last contact, then deleted or anonymised.
• Marketing data: until you opt out or 36 months of inactivity, whichever is earlier.
• Customer data: retained for the duration of the customer relationship. Upon termination, customer data is deleted within 30 days of written request, unless legal obligations require retention.
• Usage and analytics data: aggregated and anonymised within 13 months; raw identifiers deleted within 30 days.

Where retention is required by Indian law (such as tax records under the Income Tax Act, 1961) or US law, the relevant data is held in a restricted, access-controlled archive until the retention period expires.

We implement technical and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit (TLS 1.3) and at rest (AES-256).
• Multi-workspace isolation in GrepEye, with each customer's data in a separate workspace boundary.
• Role-based access control (RBAC) with least-privilege principle for internal access.
• Append-only audit ledger capturing every operationally significant event with actor and timestamp.
• Regular security reviews, vendor due diligence, and incident response procedures.

No method of transmission or storage is completely secure. If a breach occurs that is likely to cause harm, we will notify affected users and the relevant data protection authority (the Data Protection Board of India under DPDP, or the California Attorney General under CCPA) without undue delay, in accordance with applicable law.

Tensor Analytics LLC is a US-registered company with distributed operations, including in India. Personal data collected from users in India may be transferred to and processed in the United States or other countries. Transfers are made subject to standard contractual safeguards and only to jurisdictions that provide an adequate level of data protection, or to recipients bound by contractual clauses consistent with the DPDP Act.

For users in the European Economic Area, United Kingdom, or Switzerland, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission as the legal mechanism for transfers. For users in India, we comply with the cross-border transfer restrictions under Section 16 of the DPDP Act, transferring only to countries notified by the Central Government as providing adequate protection, or subject to approved safeguards.

As a Data Principal under the DPDP Act, you have the following rights regarding your personal data held by Tensor as a Data Fiduciary:

• Access: request a summary of the personal data processed and the processing activities carried out.
• Correction & completion: request correction of inaccurate, incomplete, or outdated personal data.
• Erasure: request erasure of personal data, except where retention is necessary for a specified lawful purpose.
• Grievance redressal: contact our Grievance Officer (contact details below) with any complaint about the processing of your personal data. We will acknowledge within 24 hours and resolve within 30 days, as required by the DPDP Rules.
• Nomination: nominate another individual to exercise your rights in the event of death or incapacity.

To exercise any of these rights, email our Grievance Officer at info@tensoranalytics.ai with the subject line "DPDP Rights Request." We will verify your identity before processing the request.

If you are a resident of California, Colorado, Connecticut, Virginia, Utah, or another US state with a comprehensive privacy law, you have the following rights:

• Right to know: request the categories and specific pieces of personal information we have collected about you.
• Right to delete: request deletion of personal information we have collected from you, subject to legal exceptions.
• Right to correct: request correction of inaccurate personal information (CCPA as amended by CPRA).
• Right to opt out of sale or sharing: we do not sell personal information. We do not share personal information for cross-context behavioural advertising. You may opt out of marketing communications at any time.
• Right to limit use of sensitive personal information: we do not process sensitive personal information beyond what is strictly necessary to provide the Service.
• Right to non-discrimination: we will not discriminate against you for exercising any privacy right.
• Right to authorise a representative: you may designate an authorised agent to submit requests on your behalf.

To exercise these rights, email info@tensoranalytics.ai with the subject line "Privacy Rights Request." We will verify your identity, respond within 45 days (extendable by 45 days where necessary with notice), and provide the information free of charge up to twice per 12-month period.

The Service is not directed to children under 18 (or the age of digital consent in your jurisdiction, where higher). We do not knowingly collect personal data from children. If we learn that we have collected personal data from a child, we will delete it without undue delay. If you believe we have collected such data, please contact info@tensoranalytics.ai.

Under the DPDP Act, processing of children's data requires verifiable parental consent. We do not engage in such processing.

As required by Section 10 of the DPDP Act and the rules issued thereunder, Tensor Analytics has appointed a Grievance Officer based in India to address complaints regarding the processing of personal data. The Grievance Officer can be contacted at:

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision. If we make material changes, we will notify you by email (if we have your email address) and post a prominent notice on the Site at least 30 days before the change takes effect.

Continued use of the Site or Service after the effective date constitutes acceptance of the updated Policy.

If you have any questions about this Privacy Policy, please contact: