Privacy Policy

1. Purpose and scope

This Privacy Policy describes how Raidu Inc. (“Raidu”, “we”, “us”) handles personal information collected through our public website at raidu.com and any sub-domains, our marketing communications, and our products (the “Services”).

This policy does not cover the in-product processing of customer end-user data through the Raidu AI Firewall, AI Console, or Governance Explainability products. Raidu software runs inside each customer’s own cloud, and that data is never transmitted to Raidu. The terms that govern personal data in the customer relationship are set out in our Data Processing Addendum, and the third parties involved are listed on our Sub-processors page.

If you are an end user of one of our customers, please refer to that customer’s privacy notice for information about how your data is processed.

2. Personal information we collect

2.1 Information you provide to us

• Contact information when you fill out a form, request a demo, or sign up for a trial: name, business email, phone number, company name, role.
• Account information when you register for the Services: name, email, password (stored as a salted hash), authentication factors, organization affiliation.
• Communications when you contact us by email, support ticket, or other channel: the contents of your message, attachments, and any context you choose to share.
• Payment information when you subscribe to a paid plan: billing contact and tax details. Payment card data is handled by our payment processor and is not stored on our systems.
• Marketing preferences you express through forms, email links, or in-product settings.

2.2 Information from third parties

If you authenticate using a third-party identity provider such as Google, the provider shares profile information with us according to your privacy settings on that platform. We typically receive your name, email, and a unique identifier.

2.3 Information collected automatically

When you visit raidu.com or use the Services, we automatically collect:

• Device and connection data: IP address, browser type and version, operating system, device identifiers, language settings, and approximate location derived from IP.
• Usage data: pages and screens viewed, links clicked, time spent on each page, referring URL, search terms used to reach the site, and email engagement events such as opens and clicks.
• Cookies and similar technologies: see our Cookie Policy for the full list, retention periods, and opt-out mechanisms.

3. How we use personal information

We use the information described above for the following purposes:

• Operate and secure the Services: authenticate you, maintain your session, prevent abuse, debug and monitor system health.
• Communicate with you: respond to inquiries, deliver transactional notifications about your account, and send the security and product update emails you have opted into.
• Improve and personalize the Services: understand how features are used, prioritize roadmap items, conduct A/B tests, and tailor content to your role and industry.
• Research and development: analyze aggregated and de-identified data to develop new features and improve existing ones.
• Direct marketing: where permitted by law, send you information about Raidu products, events, and offers. You can opt out at any time using the link in every marketing email.
• Compliance and fraud prevention: meet legal obligations, enforce our agreements, defend our legal rights, and detect or prevent fraud or unauthorized use.

We do not sell personal information.

4. Disclosures

We share personal information with the following categories of recipients:

• Service providers that help us operate the Services, such as cloud hosting (Google Cloud Platform), customer relationship management, support tooling, email delivery, and analytics. These providers are contractually bound to use the information only for the purposes we instruct and to protect it appropriately. The full list, with the purpose and location of each, is published on our Sub-processors page.
• Affiliates within the Raidu corporate family, where applicable.
• Authorities and other third parties when required by subpoena, court order, regulatory request, or in good faith to protect the rights, safety, or property of Raidu, our customers, or the public.
• Acquirers in the event of a merger, acquisition, financing, reorganization, or sale of all or part of our business or assets, including in bankruptcy.

We will not share your personal information with third parties for their own marketing purposes without your consent.

5. Your rights and choices

Depending on where you live, you may have the following rights regarding your personal information:

• Access: request a copy of the personal information we hold about you.
• Correction: ask us to correct inaccurate or incomplete information.
• Deletion: ask us to delete personal information, subject to legal exceptions.
• Portability: receive your information in a structured, machine-readable format.
• Objection and restriction: object to or restrict certain processing activities.
• Withdrawal of consent: withdraw any consent you have given us, without affecting prior lawful processing.
• Complaint: lodge a complaint with your local data protection authority.

To exercise any of these rights, email us at the address in section 11. We will respond within the timeframe required by applicable law.

You can also:

• Opt out of marketing emails using the unsubscribe link in any marketing email or by emailing us.
• Limit cookies and tracking through your browser settings, our cookie consent banner, or general-purpose tools such as the Google Analytics opt-out browser add-on. We do not currently respond to “Do Not Track” browser signals.

Visitors in India

For personal data collected through raidu.com from people in India, Raidu acts as a Data Fiduciary under the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. We process that data with your consent or for a legitimate use the Act allows. You can:

• Ask for a summary of the personal data we hold about you and how we process it.
• Correct, complete, update or erase your personal data.
• Withdraw consent as easily as you gave it.
• Nominate another person to exercise these rights for you.
• Raise a grievance with our Privacy Lead and acting Data Protection Officer, Ali Sarafzadeh, at privacy@raidu.com. We respond within the period the DPDP Rules require. If the grievance is not resolved, you can complain to the Data Protection Board of India.

6. International transfers

Raidu is headquartered in the United States. If you access the Services from outside the United States, your information will be transferred to and processed in the United States and other jurisdictions where our service providers operate. We rely on standard contractual clauses or other approved mechanisms to transfer personal information out of the European Economic Area, the United Kingdom, and Switzerland. Section 13 of our Data Processing Addendum sets out the clauses, modules, and options we rely on, together with the UK Addendum and the Swiss modifications.

7. Security

We employ administrative, technical, and organizational measures designed to protect personal information against unauthorized access, disclosure, alteration, and destruction. These include encryption in transit, access controls, audit logging, an information security management system for the Tower platform and supporting cloud infrastructure, certified to ISO/IEC 27001:2022 since 1 September 2026, and a SOC 2 Type II report covering 1 September 2025 to 31 August 2026. No system is perfectly secure; we cannot guarantee the security of information in transit or at rest.

8. Retention

We retain personal information for as long as is necessary to provide the Services, comply with our legal obligations, resolve disputes, and enforce our agreements. Marketing engagement data is retained for up to 24 months from your last interaction. Account data is retained for the life of your account and a reasonable period thereafter. Audit logs and security records may be retained for longer periods as required by law or contractual obligations.

9. Children’s privacy

The Services are intended for businesses and their employees and are not directed to children under 18, the age at which the Digital Personal Data Protection Act, 2023 stops treating a person as a child. We do not knowingly collect personal information from children. If you believe a child has provided personal information to us, please contact us so we can delete it.

10. Changes to this policy

We may update this Privacy Policy from time to time. The effective date at the top of this page reflects the most recent change. For material changes, we will provide a more prominent notice through the Services or by email, where appropriate. Your continued use of the Services after the effective date constitutes acceptance of the updated policy.

11. Contact us

For questions, requests, or complaints relating to this Privacy Policy, contact:

Raidu Inc. 134 N 4th St, Brooklyn, NY 11249, USA Privacy Lead, acting Data Protection Officer: Ali Sarafzadeh Email: privacy@raidu.com Website: raidu.com

Raidu has not appointed a formal Data Protection Officer under Article 37 GDPR. Raidu is not a public authority, and its core activities involve neither large-scale regular and systematic monitoring of data subjects nor large-scale processing of special categories of data, so the Article 37(1) threshold is not met. The Privacy Lead named above discharges the equivalent responsibilities and is the point of contact for data subjects and supervisory authorities. We review this position at least annually. Section 17 of our Data Processing Addendum sets out the full reasoning.