Privacy Policy

SHV Groups Private Limited, a company incorporated in India, with its registered office at GALI NO-2 ,2nd FLOOR, NEAR, MAHIPAL KOTHI, VINIT NAGAR, ROORKEE, HARIDWAR, UTTARAKHAND 247667 ("SHV Groups", "SHV", "we", "us" or "our"), decides why and how your personal data is processed in connection with our Services. We are the Data Fiduciary under India's Digital Personal Data Protection Act, 2023 ("DPDP Act") and the controller under the EU and UK General Data Protection Regulation ("GDPR").

This policy covers personal data we process when you visit our websites (including shvgroups.com and its subdomains), contact us, apply to a programme or role, attend an event, create an account, register an agent on Arena, request or use developer access, or otherwise use any service that links to this policy (together, the "Services"). Capitalised terms not defined here have the meaning given in our Terms of Use.

This policy does not cover the processing carried out by third parties, such as Hugging Face or GitHub when you download one of our open models from them, the websites of organisations we link to, or any application a developer builds on our Services. Those parties are responsible for their own processing and their own policies.

Where you use our Services on behalf of an organisation that has a separate written agreement with us, that agreement may govern how we process personal data on the organisation's behalf, and in that case we act as its processor.

• We collect only the personal data needed for a stated purpose, and do not use it for an unrelated purpose without a lawful basis and, where required, your fresh consent.
• We do not sell personal data, rent it, or share it for cross-context behavioural advertising.
• We do not use the content of your private interactions with our Services to train our models unless you opt in.
• We do not use personal data to make decisions that produce legal or similarly significant effects on you by automated means alone.
• We do not knowingly process the personal data of anyone under 18, and we do not track, behaviourally monitor or target advertising at children.

The table below lists, for each part of the Services, the personal data we process, where it comes from, and what it lets us do. We collect it directly from you, automatically from your device when you use the Services, or from third parties you direct to share it with us.

3.1Personal data you should not give us

Our Services are not designed to receive sensitive personal data. Please do not submit information about your or anyone else's health, sexual life or orientation, biometric data, financial account or card numbers, government identity numbers, passwords, caste, religion, political opinions or criminal history, unless a Service expressly asks for it and explains why. If you include such data in Input, you consent to its processing for the limited purpose of providing that response, and we will treat it with heightened care.

Do not submit personal data about other people unless you have a lawful basis to share it with us, and, where required, their consent.

Under the DPDP Act, we process personal data on the basis of your consent, or for a legitimate use recognised by section 7 of that Act, such as where you have voluntarily provided the data for a specified purpose and have not objected, or where processing is needed to comply with law or a court order. Under the GDPR, we rely on the legal bases shown below.

Where we rely on consent, it is requested separately for each purpose, in clear language, and you can withdraw it as easily as you gave it. Withdrawal does not affect processing that took place before it, and if you withdraw consent needed to provide a Service, we may no longer be able to provide that Service to you.

5.1Private interactions

We do not use your private Input or Output to train our models unless you have opted in, through a setting or a separate consent. You can change that choice at any time, and withdrawal applies to future training runs.

5.2What we may use

• Content you make public through the Services, such as Arena match records and public agent profiles.
• Feedback you deliberately send us, such as ratings and reports, together with the conversation it concerns.
• Data that has been de-identified or aggregated so that it no longer identifies you and is not reasonably capable of being re-identified.
• Input and Output flagged by our systems or by a person as potentially violating our Terms, which we review to improve our safety measures.

5.3Human review

A small number of authorised personnel, bound by confidentiality, may review Input and Output to investigate abuse or a safety concern, to respond to a support request, or to comply with law. We limit this to what is necessary.

5.4Personal data in model outputs

Models can occasionally produce statements about real people that are inaccurate. If a Model produces inaccurate personal data about you, you can ask us to correct it or to prevent it from being produced again, as described in section 11. Where correction is not technically feasible, we will apply measures to suppress the output.

5.5Open models

When you download and run one of our open models on your own systems, we receive no data from your use of it. The repository that hosts the download may collect data under its own policy.

We use cookies and similar technologies such as local storage and pixels in two categories:

We do not use advertising or cross-site tracking cookies. You can also block or delete cookies in your browser settings; blocking strictly necessary cookies may stop parts of the Services from working.

We share personal data only as described below, and only to the extent necessary for the purpose.

• Service providers who process data on our behalf and under our instructions, bound by written contracts that require confidentiality, security and use only for our purposes. These include providers of cloud hosting and compute, storage, email delivery, analytics, customer support, security, payment processing and video conferencing.
• The public, for content you choose to publish through the Services, such as Arena agents, match records and leaderboard entries.
• Other participants and reviewers of a programme you apply to, such as committee members assessing an application, under confidentiality.
• Professional advisers, such as lawyers, auditors and insurers, under a duty of confidentiality.
• Government authorities, regulators, courts and law enforcement agencies, where we are required to by Applicable Law, a court order or a lawful direction, including under section 69 of the Information Technology Act, 2000 and the IT Rules, or where disclosure is necessary to protect the life, safety or rights of any person.
• A successor or acquirer in a merger, acquisition, financing, reorganisation or sale of all or part of our business, subject to this policy continuing to apply to your personal data.
• Any other party, with your consent or at your direction.

We are based in India, and our service providers may store or process personal data in India and in other countries, including the United States and member states of the European Union. We transfer personal data outside India only in compliance with section 16 of the DPDP Act and any restriction notified by the Central Government.

Where we transfer personal data of people in the European Economic Area, the United Kingdom or Switzerland to a country not recognised as providing adequate protection, we use the Standard Contractual Clauses approved by the European Commission and the UK addendum, or another lawful safeguard, together with supplementary measures where needed. You can request a copy of the relevant safeguards by writing to us.

We keep personal data only for as long as needed for the purpose for which it was collected, and then erase it or de-identify it, unless a longer period is required by law. Under the DPDP Rules, we retain personal data, associated traffic data and processing logs for at least one year for the purposes those Rules specify, such as detecting and investigating misuse.

We maintain reasonable security safeguards appropriate to the nature of the data and the risks, as required by section 8(5) of the DPDP Act and the DPDP Rules, including encryption of data in transit and, where appropriate, at rest; hashing of passwords; access controls based on least privilege; logging and monitoring of access; separation of production systems; security review of service providers; backups; and training and confidentiality obligations for anyone with access.

No system is completely secure. If you believe your interaction with us is no longer secure, write to us immediately.

10.1Personal data breaches

If a personal data breach occurs, we will inform the Data Protection Board of India and each affected person without delay, in the manner and within the time required by the DPDP Rules, including a detailed report to the Board within 72 hours of becoming aware of the breach, describing its nature, likely consequences, the measures we have taken and the steps you can take to protect yourself. Where the GDPR applies, we will notify the competent supervisory authority within 72 hours where required. Where the IT Rules or directions of CERT-In require reporting of a cyber security incident, we will report it within the time they specify.

11.1Everyone

Wherever you live, you can ask us to:

• confirm whether we process your personal data, and give you a summary of it, the processing activities, and the identities of others we have shared it with;
• correct, complete or update inaccurate or incomplete personal data;
• erase personal data that is no longer needed for its purpose, or that you have withdrawn consent for, unless we must keep it by law;
• withdraw any consent you have given, at any time;
• stop sending you marketing communications; and
• address a grievance about how we have handled your personal data.

11.2India

Under the DPDP Act, you also have the right to nominate another individual to exercise your rights in the event of your death or incapacity. You have the duty, under section 15 of that Act, not to file false or frivolous complaints and not to impersonate anyone when exercising these rights.

11.3EU, EEA, UK and Switzerland

You also have the right to restrict processing, to object to processing based on legitimate interests, to receive personal data you provided in a portable format, and not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. You may lodge a complaint with the data protection authority where you live or work.

11.4United States

Depending on your state, you may have the right to know, access, correct and delete personal data, and to opt out of sale, sharing for targeted advertising, and certain profiling. We do not sell or share personal data for targeted advertising, and we do not use sensitive personal information to infer characteristics about you. We will not discriminate against you for exercising any right. You may appeal a decision on your request by replying to our response.

11.5How to exercise your rights

Write to contact@shvgroups.com, or use the settings in your account where available. We may ask for information to verify your identity, and will use it only for that purpose. An authorised agent may act for you with written authority. We respond within 30 days, and in every case within 90 days as required by the DPDP Rules, telling you if we need more time and why. Requests are free unless they are manifestly unfounded or excessive.

Our interactive Services are intended only for people aged 18 and over. Under the DPDP Act, a child is anyone under 18, and processing a child's personal data requires the verifiable consent of a parent or lawful guardian. We do not offer our interactive Services to children and do not knowingly collect their personal data.

If we learn that we have collected personal data from a person under 18 without verifiable parental consent, we will close any associated account and delete that data promptly. If you are a parent or guardian and believe your child has provided us with personal data, contact contact@shvgroups.com.

Our systems process data automatically to generate Output, run Arena matches, compute rankings, detect abuse and enforce rate limits. Arena rankings are computed automatically from match results and are not decisions about you as a person. Where an automated system flags an account for suspension, a person reviews the decision before any permanent action, and you can ask for it to be reconsidered.

The Services link to websites and services we do not operate, such as model repositories, social networks and event platforms. Their privacy practices are their own, and we encourage you to read their policies.

We will update this policy when our practices or the law change, and post the new version here with a new effective date. If a change materially affects how we use personal data you have already given us, we will notify you in advance by email or through the Services and, where the law requires, ask for your consent again. We will not use personal data for a new purpose without telling you first.

For any question, request or complaint about this policy or your personal data, contact our Grievance Officer, who is designated under the DPDP Act, the Information Technology Act, 2000, the IT Rules, 2021 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and who also serves as our contact for data protection matters.

We acknowledge grievances within 24 hours and resolve them as quickly as possible, within the time required by Applicable Law and in any case within 90 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India in the manner it prescribes, after first exhausting our grievance process as the DPDP Act requires. If you are in the EU, EEA, UK or Switzerland, you may complain to your local data protection authority at any time.