Privacy Policy

1.Who is responsible for your information

ATALI ELECTRIC INDIA PRIVATE LIMITED (CIN U43219HR2026PTC141202), B-399A, 1st Floor, Nehru Ground, Near Neelam Cinema, Faridabad, Haryana, 121001, India, is the business responsible for personal information collected through our website, accounts, sales and support. For India's Digital Personal Data Protection Act, 2023, we act as the data fiduciary for that information.

When a customer uploads assessment notices, rent rolls, operating statements and other property records to the application, we process that content as a service provider on the customer's behalf under our Data Processing Addendum. The customer decides what is uploaded and why. Questions about this policy go to privacy@atalielectric.com.

2.Information we collect

We collect what we need to operate the service, in these categories.

• Account and contact information: name, work email, phone number, company, job title and the role you hold in your workspace.
• Customer content: county assessment notices, parcel records, rent rolls, operating statements, leases, evidence exhibits and petition drafts that you or your colleagues upload or generate. This content can include the names of tenants, owners and signatories.
• Billing information: billing contact, company address and tax details. Card numbers are collected by Stripe and never reach our servers.
• Usage and device information: pages viewed, features used, tool completions, browser type, approximate location derived from IP address and security logs.
• Communications: messages to sales, support and security, demo requests and survey responses.
• Public records: assessor, appraisal district, recorder and board of review records for parcels, including owner names and addresses that counties publish.

3.How we use information

We use personal information to:

• provide, maintain and secure the service, including preparing evidence packets and tracking filing deadlines;
• bill for subscriptions and keep the records tax law requires;
• answer support and sales requests and send service notices;
• send our newsletter, The Ad Valorem Advisor, if you opted in;
• improve the product using aggregated, de-identified usage data; and
• comply with law, enforce our Terms of Service and protect our users.

4.No training on customer content

We do not use customer content to train or fine-tune artificial intelligence or machine learning models, ours or anyone else's. Our document extraction and valuation models are built from public records, licensed market data and synthetic documents. Customer rent rolls, operating statements and workbooks are used only to deliver the service to that customer.

5.How we share information

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We disclose personal information only in these cases:

• to the subprocessors listed at /subprocessors, who host, deliver and support the service under written contracts;
• at your direction, for example when you export a packet to a county board or send a document for signature;
• when the law requires it, such as a valid subpoena or court order, after we review its scope;
• in a merger, acquisition or sale of assets, in which case the successor must honor this policy; and
• to protect the rights, safety and security of our users, the public or ATALI ELECTRIC INDIA PRIVATE LIMITED

6.Cookies and analytics

We use first-party analytics and a small set of cookies, listed in our Cookie Policy. We honor the Global Privacy Control signal. We do not use advertising cookies, and we never place customer content in client-side analytics.

7.How long we keep information

We keep personal information only as long as we need it for the purposes above.

• Account information: while the account is active, and for up to 24 months afterward to resolve disputes and answer support questions.
• Billing records: seven years, as tax and accounting rules require.
• Customer content: available for export for 30 days after termination, then deleted from production systems within 30 days and from encrypted backups within 90 days of termination.
• Security and audit logs: 13 months.
• Marketing contacts: until you unsubscribe.

8.Security

Customer data is encrypted with AES-256 at rest and TLS 1.3 in transit, isolated by tenant, and protected by multi-factor authentication and role-based access control. Our SOC 2 Type II report and security practices are described in our Security Policy.

9.Where your information is processed

US customer data is hosted on Amazon Web Services in us-east-2 (Ohio), with failover to us-west-2 (Oregon). Our engineers and support staff in Faridabad, India, reach production systems remotely through role-based, time-limited, logged access with multi-factor authentication. Customer content is not stored on staff devices or in infrastructure located in India.

10.Your rights under US state privacy laws

Depending on where you live, including California under the CCPA as amended by the CPRA and states with similar laws such as Colorado, Connecticut, Texas, Utah and Virginia, you may have the right to:

• know what personal information we hold about you and receive a copy;
• correct inaccurate information and request deletion;
• opt out of the sale or sharing of personal information, targeted advertising and profiling in furtherance of decisions with legal effects, none of which we do;
• limit the use of sensitive personal information, which we use only to provide the service you requested; and
• receive equal service and price if you exercise these rights.

11.How to make a request

Email privacy@atalielectric.com or call 1800-419-8826. We verify your identity by matching the details you give us to the account email, and we respond within 45 days, with one extension of up to 45 days when reasonably necessary. An authorized agent may submit a request with written permission from you. If we decline a request you may appeal by replying to our decision, and if the appeal is unresolved you can contact your state attorney general.

If your information sits inside a customer's workspace, we will direct your request to that customer, because the customer controls the content. In the past 12 months we disclosed identifiers, commercial information, internet activity data and professional information to service providers for business purposes only.

12.Rights under India's DPDP Act, 2023

As a company headquartered in India, we handle personal data in line with the Digital Personal Data Protection Act, 2023, and its rules as they come into force. We process personal data on the basis of your consent or for legitimate uses the Act permits, such as providing a service you requested and complying with legal obligations.

As a data principal you may ask for a summary of the personal data we process, request correction or erasure, nominate another person to exercise your rights if you cannot, and seek redress for a grievance. Email privacy@atalielectric.com with "DPDP grievance" in the subject line. Our Head of Security and Compliance replies within 30 days.

13.Children

The service is for business users and is not directed to anyone under 18. We do not knowingly collect personal information from children, and we delete it if we learn we have.

14.Changes to this policy

We post the new date at the top when our practices change and email account owners at least 30 days before material changes take effect.