Legal

Privacy Policy

Last updated: September 6, 2026  ·  Effective date: September 6, 2026

Scope of this document. This Policy is drafted to the standard of a comprehensive privacy notice for a US-based business website, covering the categories of disclosure typically required under state privacy statutes (including the CCPA/CPRA) and referencing GDPR/UK GDPR concepts for visitors located in those jurisdictions. It is accurate to how indraam.com operates as of the effective date above. It is not a substitute for advice from counsel licensed in your jurisdiction, who should confirm entity details, registration obligations (e.g., under the CCPA, a data-broker registry, or an EU/UK representative requirement), and any sector-specific rules that apply once OwnerOS or DealerOS AI are handling live customer data — see Section 15.

1. Scope and controller

This Privacy Policy ("Policy") describes how Indraam ("Indraam," "we," "us," or "our") collects, uses, discloses, and safeguards information in connection with indraam.com and the tools embedded in it, including the demo AI agent, the AI gap finder, and the contact form (together, the "Site"). For the purposes of applicable data protection law, Indraam is the controller (or "business," under the CCPA) of the personal information described in this Policy.

This Policy does not apply to OwnerOS or DealerOS AI once a business is an active customer of those platforms; see Section 15.

2. Definitions

  • "Personal Information" means information that identifies, relates to, describes, or could reasonably be linked, directly or indirectly, with a particular individual or household.
  • "Service Provider" / "Sub-processor" means a third party that processes Personal Information on our behalf and under our instructions, listed in Section 6.
  • "Sell" and "Share" have the meanings given in the CCPA/CPRA. We do not sell or share Personal Information as those terms are defined.

3. Categories of information we collect

Information you provide directly

  • Identifiers and contact information — your name and email address, submitted through the contact form ("Book a call").
  • Inquiry content — the message you submit with the contact form, and whatever text you type into the demo AI agent or the AI gap finder.

Information collected automatically

  • Session identifier — a randomly generated ID stored in your browser's sessionStorage (not a persistent cookie). It identifies a browser tab, not a person or device, and is discarded when the tab closes; it is not used to track you across browsing sessions or across other websites.
  • Coarse technical and usage data — an approximate country derived from a hosting-provider edge header, the page that referred you to the Site, and your browser's user-agent string.

We do not collect precise geolocation, government-issued identifiers, biometric information, or IP addresses, and we do not knowingly collect any special category of Personal Information (health, racial or ethnic origin, religious belief, or similar) through the Site.

4. Sources of information

We collect Personal Information (a) directly from you, when you fill out a form or type into a demo tool, and (b) automatically, through your browser, as described above. We do not purchase Personal Information from data brokers.

5. How we use information

We use the categories of information described above for the following business purposes:

  • To respond to inquiries, schedule calls, and provide the services you request;
  • To operate the demo AI agent and AI gap finder, including generating a response to what you submit;
  • To review past submissions and conversations for quality review and to improve the demo tools;
  • For internal, first-party analytics on how the Site is used;
  • To detect, investigate, and prevent security incidents, fraud, and abuse of the Site; and
  • To comply with legal obligations and enforce our Terms & Conditions.

We do not use Personal Information collected through the Site to make decisions that produce legal or similarly significant effects about you, and we do not use it for cross-context behavioral advertising.

6. How we share information

We disclose Personal Information only to the following categories of recipients, each acting as our Service Provider under a contract that restricts their use of it to providing services to us:

  • OpenAI, L.L.C. — processes the text you submit to the demo AI agent and AI gap finder in order to generate a response, under OpenAI's own privacy terms;
  • MongoDB, Inc. (Atlas) — stores contact-form submissions, chat transcripts, and gap-finder runs;
  • Vercel Inc. / Netlify, Inc. — hosts the Site and its serverless functions;
  • Professional advisors (accountants, lawyers) and successors in the event of a merger, acquisition, or sale of assets, subject to confidentiality obligations; and
  • Law enforcement or regulators, where required by valid legal process.

We do not sell or share Personal Information for money or other valuable consideration, and we have not done so in the preceding 12 months. We do not use or disclose sensitive Personal Information for any purpose other than providing the Site's features.

7. Cookies and similar technologies

The Site uses sessionStorage — a browser storage mechanism, not a cookie — to hold the chat session identifier described in Section 3. The Site does not set third-party advertising or cross-site tracking cookies, and does not currently use an analytics service that relies on cookies. If that changes, we will update this Policy and, where required by law, request your consent first.

8. Data retention

We retain contact-form submissions, chat transcripts, and gap-finder runs for as long as reasonably necessary for the purposes in Section 5, and in any event no longer than is necessary to comply with our legal obligations, resolve disputes, and enforce our agreements. We do not currently run an automated deletion schedule; if you would like your records deleted sooner, contact us under Section 17 and we will honor that request except where retention is required by law.

9. Security

We maintain administrative and technical safeguards appropriate to the information we hold, including origin allowlisting and rate limiting on public endpoints, and authenticated, rate-limited, session-based access to the internal admin dashboard. No method of transmission over the internet or electronic storage is completely secure; we cannot guarantee absolute security, and you provide information to the Site at your own risk. We will notify affected individuals and any applicable regulator of a breach of unencrypted Personal Information as required by applicable law.

10. International data transfers

Indraam is based in, and the Site's infrastructure and Service Providers are located in, the United States. If you access the Site from outside the United States, your information will be transferred to, stored, and processed in the United States, a jurisdiction whose data protection laws may differ from those of your home country. Where required for transfers of personal data originating in the European Economic Area, the United Kingdom, or Switzerland, we rely on the recipient's own compliance mechanisms (such as the EU-U.S. Data Privacy Framework or Standard Contractual Clauses) as applicable to that Service Provider.

11. Your privacy rights

11.1 All users

Regardless of where you are located, you may ask us to access, correct, or delete the Personal Information we hold about you, or ask us how it has been used and shared, by contacting us under Section 17. We will verify your request using the email address associated with your submission before acting on it.

11.2 California residents (CCPA/CPRA)

If you are a California resident, you have the right to: (a) know the categories and specific pieces of Personal Information we collect, use, and disclose about you; (b) request deletion of your Personal Information; (c) request correction of inaccurate Personal Information; (d) opt out of the sale or sharing of Personal Information (we do not sell or share it, so no action is needed); and (e) not be discriminated against for exercising any of these rights. This Policy serves as our notice at collection: see Section 3 for categories collected, Section 5 for purposes, and Section 8 for retention criteria. We do not sell or share Personal Information and have not done so in the past 12 months, and we do not use or process sensitive Personal Information for purposes requiring an opt-out right under the CPRA.

11.3 European Economic Area, UK, and Switzerland (GDPR / UK GDPR)

If you are located in the EEA, UK, or Switzerland, our legal bases for processing are: performance of a contract or steps taken at your request before entering one (responding to inquiries), our legitimate interests (operating and securing the Site, and improving the demo tools), and consent where we ask for it. You have the right to access, rectify, erase, or restrict processing of your Personal Information, to data portability, to object to processing based on legitimate interests, to withdraw consent at any time where processing is based on consent, and to lodge a complaint with your local supervisory authority.

11.4 Other jurisdictions

If you are located elsewhere and your local law grants you similar rights (for example, under Virginia, Colorado, Connecticut, Utah, or other US state privacy statutes, or comparable laws outside the United States), we will honor requests consistent with that law on the same basis described in Section 11.1.

12. Automated processing and AI-generated content

The demo AI agent and AI gap finder use a third-party large language model (OpenAI) to generate responses to what you submit. These responses are generated automatically and may be inaccurate or incomplete; see also our Terms & Conditions. We do not use this processing to make solely automated decisions that produce legal or similarly significant effects concerning you.

13. Children's privacy

The Site is directed at businesses and professionals and is not directed at, or intended for use by, children. We do not knowingly collect Personal Information from anyone under 16 years of age. If you believe a child has provided us with Personal Information, contact us under Section 17 and we will delete it.

14. Third-party websites and services

The Site links to third-party services, including Instagram and LinkedIn. These third parties operate independently of Indraam, and any information you provide to them directly is governed by their own privacy policies, not this one. We encourage you to review those policies before interacting with them.

15. OwnerOS and DealerOS AI

This Policy governs the public marketing pages describing OwnerOS and DealerOS AI. It does not govern the data a dealership, owner-operator, or other business uploads to or generates within either platform once they are a customer — that includes vehicle records, customer and buyer information, financial and loan-related documents (such as lender payoff letters), insurance policies, and photographs. That processing is governed by a separate customer agreement and, where applicable, a data processing addendum entered into directly with the customer, which should address the customer's own obligations as a data controller (or, for auto dealers that arrange or extend financing, as a "financial institution" subject to the FTC Safeguards Rule under the Gramm-Leach-Bliley Act) and any state vehicle-record or driver-privacy statutes that apply to the records they process.

16. Changes to this Policy

We may update this Policy from time to time to reflect changes to the Site or our legal obligations. We will revise the "Last updated" date above when we do, and where a change is material, we will provide additional notice (such as a banner on the Site) before it takes effect. Your continued use of the Site after a revised Policy takes effect constitutes acceptance of the changes.

17. How to contact us

To exercise any of the rights described in this Policy, or with questions about it, email hello@indraam.com. We aim to acknowledge requests within 10 business days and to resolve them within 30 days, or within any shorter period required by applicable law.