Privacy Policy
Last Updated: May 08, 2026
PLEASE READ THIS PRIVACY POLICY CAREFULLY.
Introduction
Welcome to Winning Strategy (hereinafter referred to as “We” / “Us”/ “Our” / “the Company”). We respect your privacy and are committed to protecting your personal data. This privacy policy (the “Policy”) explains how we collect, use, disclose, and safeguard your information when you use our AI-powered services, including our AI Live Dashboard Agents, AI Analysis Agents, and AI Presentation Agents (collectively, the “Services”), and our website https://www.winningstrategy.ai/ (“Site”).
Data Fiduciary: Winning Strategy Consulting Private Limited
Registered Office: Mumbai, India
Applicable Laws: GDPR (EU), DPDP Act 2023 (India), CCPA/CPRA (California)
Definitions and Interpretation
Definitions
“Applicable Law” means, for the data principals in India, the Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025; and for the consumers resident in the State of California, United States of America (USA), the California Consumer Privacy Act, 2018, as amended by California Privacy Rights Act, 2023. All references to Applicable Laws include any subsequent amendments, updates, or successor legislation.
“Opt-in Consent” means the free, specific, informed, unconditional and unambiguous consent given by the user through a clear action (such as checking a box, clicking an "I Accept" button, or sending us a confirmation email). Such consent applies only to the specified uses described in Clause 3.2.
“Personal Information/Data” means any data in digital form through which a User is identifiable. Such information/data may also include non-digitised data/information digitised subsequently. For the purposes of Applicable Laws, this term includes “Digital Personal Data” under the Indian Digital Personal Data Protection Act (DPDPA), 2023, and “Personal Information” as defined by the California Consumer Privacy Act (CCPA), as amended.
“Policy” means the Privacy Policy of the Company hosted and made available on the website https://www.winningstrategy.ai/, which applies to the Services and the Site.
“You”, “Your”, or “User” refers to any natural person who accesses or uses our Sites and Services. For the purposes of applicable data protection laws, this term includes individuals identified as a “Data Principal” under the Indian Digital Personal Data Protection Act (DPDPA), 2023, and a “Consumer” as defined by the California Consumer Privacy Act (CCPA), as amended.
“We” / “Us”/ “Our” / “the Company” means Winning Strategy Consulting Private Limited, having its registered office in Mumbai, India. For the purposes of applicable data protection laws, this term includes “Data Fiduciary” under the Indian Digital Personal Data Protection Act (DPDPA), 2023, and a “Business” as defined by the California Consumer Privacy Act (CCPA), as amended.
“Services” means the Company’s AI-powered services, including its AI Live Dashboard Agents, AI Analysis Agents, and AI Presentation Agents.
“Site”means the Company’s website hosted on the domain https://www.winningstrategy.ai/.
Interpretation
All capitalised and bold terms used in this Policy have the specific meanings defined herein. Unless the context requires otherwise, words in the singular include the plural and vice versa, and any headings are included for convenience only and do not affect the interpretation of this Policy.
Personal Information/Data We Collect
To enable you to use our Services and Sites, we collect the following categories of Personal Information/Data:
Account Information
When you create an account or use our services, we may collect:
- Name and email address
- Phone number (optional)
- Company name and role (for business accounts)
- Billing information (which may include account no., IFSC code, UPI no., credit card/debit card no., billing address, or any other relevant billing information through which the user is identifiable)
- Profile picture (optional)
User Content
We automatically collect Personal Data/Information from the content that you upload, which includes the following:
- Search queries
- AI prompts
- Documents
- Images
- Audio and video
Usage Information
We automatically collect Personal Data/Information about how you use our services:
- AI model usage and interaction data
- Features you use and frequency of use
- Credits consumed and remaining balance
- Files uploaded and processed (temporarily stored)
- Generated outputs and results
Communication Information
If you communicate with us, such as via email or our pages on social media sites, we may collect Personal Information/Data like your name, contact information, and the contents of the messages you send.
Technical Information
When you visit, use or interact with the Services, we receive the following information in relation to your visit, use or interactions:
- IP address and device information
- Browser type and version
- Operating system
- Cookies and similar tracking technologies
- Diagnostic logs and application telemetry
Sharing Information about Others
If you provide us with Personal Information/Data about another person, you must ensure you have their permission to do so. By sharing it, you confirm that we can collect and use that Personal Information/Data as described in this Policy without needing to take additional legal steps. It is your responsibility to make sure that person is aware of this Policy and understands how their data will be handled.
How We Use Your Information
Should you choose to use our Services and Sites, we will use the Personal Data for “legitimate uses” which are: (i) necessary for the delivery of our Services; (ii) to comply with Applicable Laws; and (iii) to perform our contract with you. These are listed below as follows:
- To provide and maintain our AI services
- To process your transactions and manage your subscription
- To send you service updates, security alerts, and support messages
- To respond to your inquiries and provide customer support
- To detect and prevent fraud, abuse, and security incidents
- To comply with legal obligations, such as: (i) disclosure of information to governmental authorities upon receiving such a request; (ii) compliance with a judgment, decree or order issued by a court of law in India
Further, we may also use the following categories of Personal Information/Data for specific uses enumerated below, subject only to receiving your consent (“opt-in consent”):
User content (AI prompts, search queries, documents, images, audio-video)
- To improve our Services by using anonymised versions of your interactions with our AI tools/generators. All personally identifiable information is removed before any analysis.
- To train and improve our AI models (only with anonymised data)
- To personalise AI responses based on your usage patterns and preferences
Account / Communication information (name, email address)
- To send promotional communications
Usage information
- To facilitate analytics and advertisement/marketing (through Google Analytics and Google Ads, respectively), for which we may use third-party cookies.
Technical information (location information)
- To protect your account by detecting unusual login activity or provide more accurate responses.
Legal Basis for Processing (GDPR)
This section applies to individuals in the European Economic Area (EEA), United Kingdom, and Switzerland.
Under the General Data Protection Regulation (GDPR), we process your personal data based on the following legal grounds:
Contract (Article 6(1)(b))
Processing necessary to perform our contract with you or take steps before entering into a contract:
- Account creation and management
- Service delivery (AI agents, data analysis, presentations)
- Billing and payment processing
- Customer support and communication
- Credit allocation and usage tracking
Consent (Article 6(1)(a))
Processing based on your explicit consent, which you can withdraw at any time:
- Analytics cookies (Google Analytics)
- Marketing cookies (Google Ads)
- Marketing communications and newsletters
- Using anonymized data for AI model improvement
- Optional profile information (phone, profile picture)
Legitimate Interest (Article 6(1)(f))
Processing necessary for our legitimate interests, balanced against your rights:
- Fraud detection and prevention
- Security monitoring and incident response
- Service optimization and performance improvement
- Internal analytics (non-marketing)
- Network and information security
You have the right to object to processing based on legitimate interest at any time.
Legal Obligation (Article 6(1)(c))
Processing necessary to comply with legal requirements:
- Tax and accounting records (7 years retention)
- Compliance with court orders and legal request
- Anti-money laundering (AML) requirements
- Data breach notifications to authorities
Data Processing & AI Training
Your Data and AI Models
By default, your prompts and uploaded files are NOT used to train third-party AI models. We work with AI providers who respect data privacy and do not use your data for model training without explicit consent.
Temporary Storage
Files you upload are temporarily stored on secure servers for processing and are automatically deleted within 24 hours. You can manually delete files immediately after processing.
Information Sharing and Disclosure
We do not sell your Personal Information for monetary consideration. We may, however, share your Personal Information with the following categories of third parties, and for the following purposes only:
Service Providers
- Razorpay: Payment processing (subject to their privacy policy)
- AI Providers: OpenAI, Anthropic, Google, etc. (for processing your requests)
- Cloud Hosting: Secure data storage and infrastructure
- Analytics: Usage analytics and service improvement
- Email Service: For transactional and promotional emails
Legal Requirements
We may disclose your information if required by law, court order, or government request, or to protect our rights, property, or safety.
Business Transfers
In the event of a merger, acquisition, or sale of assets, your information may be transferred. We will notify you before your information is transferred and becomes subject to a different privacy policy.
Data Security
We implement industry-standard security measures to protect your information:
- TLS 1.3 encryption for data in transit
- AES-256 encryption at rest for stored data
- Bcrypt password hashing with salt
- HTTPOnly and Secure cookies to prevent XSS attacks
- CSRF protection on all forms
- Regular security audits and vulnerability assessments
- Access controls and multi-factor authentication
- Secure payment processing through Razorpay (PCI DSS compliant)
- Regular backups and disaster recovery procedures
- XSS sanitization on all user inputs
- Content Security Policy (CSP) headers
However, no method of transmission over the Internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.
Data Breach Notification
In the event of a data breach that affects your personal information, we are committed to transparency and prompt notification in accordance with applicable laws.
Our Breach Response Process
- Detection: Continuous monitoring and incident detection systems
- Assessment: Immediate evaluation of breach scope and impact
- Containment: Swift action to contain and mitigate the breach
- Notification: Timely notification to affected parties and authorities
- Remediation: Implementation of measures to prevent future incidents
Notification Timelines
- GDPR (EU/EEA/UK): Within 72 hours to supervisory authority; without undue delay to affected individuals
- DPDP Act (India): In the event of a personal data breach, we will notify the Data Protection Board of India and all affected individuals without delay. Further, within 72 hours, we will provide the Board with a detailed report covering the nature of the breach, its impact, and the remedial measures we have implemented.
- CCPA/CPRA (California): In the event of a security breach, we will notify affected California residents in the most expedient time possible and without unreasonable delay. If a breach affects more than 500 residents, we will also notify the California Attorney General and/or the California Privacy Protection Agency (CPPA) as required by law.
What We Will Tell You
In the event of a breach, we will inform you about:
- The nature of the breach and categories of data affected
- The likely consequences of the breach
- Measures taken to address the breach
- Recommendations for protecting yourself
- Contact information for further inquiries
Report a Security Concern: If you discover a security vulnerability or have concerns about data security, please contact us immediately at [email protected] with subject line "Security Issue".
Your Privacy Rights (All Users)
Regardless of your location, you have the following rights regarding your personal data:
- Access: Request a copy of the personal data we hold about you
- Correction: Request correction of inaccurate or incomplete data
- Deletion: Request deletion of your personal data (right to be forgotten)
- Export: Download your data in a portable format (JSON)
- Opt-out: Unsubscribe from marketing communications
- Object: Object to the processing of your data for certain purposes
- Restrict: Request restriction of processing in certain circumstances
Download Your Data
You can download a complete copy of your personal data at any time from your account settings.
For other privacy requests, contact us at [email protected] or use our Privacy Request Form.
Data Retention and Erasure
We retain your personal information only for as long as necessary to provide our Services, fulfil the purposes outlined in this Policy, or comply with legal obligations.
Erasure and Deletion Requests
Upon receiving a valid erasure request through our Privacy Request Form or by way of email in the form and manner as specified under Clause 14.5 (for Indian users) and Clause 15.4 (for U.S. users in California), we will delete your personal data without unreasonable delay, unless retention is necessary for:
- compliance with the laws of India or the United States of America, as the case may be, or
- for legitimate business purposes permitted under the data protection laws applicable to this Policy.
Mandatory Retention (India)
For users in India, regardless of an erasure request or the completion of a processing purpose, we are mandated by Rule 8(3) of the DPDP Rules, 2025, to retain traffic data and processing logs for a minimum period of one year from the date of processing.
Retention Schedule
We apply the following maximum retention periods to specific categories of data:
| Category | Retention Period |
|---|---|
| Account Information | Retained until account deletion, plus 30 days. For accounts flagged for deletion due to inactivity, we will provide at least 48 hours' notice prior to erasure. |
| User Content | Uploaded files, audio, and video are automatically deleted within 24 hours of upload. |
| Usage Information | Retained for up to 2 years for analytics and service optimization. |
| Transaction Records | Retained for 7 years to satisfy tax, audit, and legal compliance. |
| Support Tickets | Retained for 3 years to ensure support continuity. |
Cookies and Tracking Technologies
We use cookies and similar technologies to enhance your experience. You can manage your cookie preferences at any time.
Essential Cookies (Always Active)
These cookies are necessary for the website to function and cannot be disabled:
- Authentication: Session tokens to keep you logged in
- Security: CSRF tokens to prevent cross-site attacks
- Preferences: Your cookie consent choices
Analytics Cookies (Optional)
Help us understand how visitors interact with our website:
- Google Analytics (_ga, _gid, ga*): Track page views, user behavior, and site performance
- Duration: Up to 2 years
- Provider: Google LLC
Marketing Cookies (Optional)
Used to track visitors across websites and measure advertising effectiveness:
- Google Ads (gcl, gac): Track conversions and ad campaign performance
- Duration: Up to 90 days
- Provider: Google LLC
You can also control cookies through your browser settings. Note that disabling certain cookies may affect functionality. For more information about Google's data practices, visit the Google Privacy Policy.
International Data Transfers
Your information may be transferred to and processed in countries other than India, including the United States and European Union, where our service providers are located.
Data Storage Locations
- Primary Storage: United States (Supabase infrastructure)
- AI Processing: United States (OpenAI, Anthropic, Google)
- Payment Processing: India (Razorpay)
- Email Services: United States (Resend)
Transfer Safeguards
We ensure appropriate safeguards for international data transfers:
- GDPR Compliance: Standard Contractual Clauses (SCCs) approved by the European Commission
- Encryption: All data encrypted in transit (TLS 1.3) and at rest (AES-256)
- Data Processing Agreements: Contracts with all third-party processors
- Adequacy Decisions: Transfers to countries with adequate data protection where applicable
Sub-Processors
We work with the following sub-processors, who may access your data:
Supabase Inc. - Authentication and database (USA)
OpenAI, Anthropic, Google - AI model processing (USA)
Razorpay - Payment processing (India)
Resend - Email delivery (USA)
Google LLC - Analytics and advertising (USA)
We will notify you of any changes to our sub-processors via email or website notice.
Your Rights Under GDPR (EU/EEA/UK/Switzerland)
This section applies to individuals in the European Economic Area, United Kingdom, and Switzerland.
Under GDPR, you have comprehensive rights regarding your personal data:
- Right of Access (Article 15): Obtain confirmation of whether we process your data and access to your personal data
- Right to Rectification (Article 16): Correct inaccurate or incomplete personal data
- Right to Erasure / Right to be Forgotten (Article 17): Request deletion of your personal data (subject to legal exceptions)
- Right to Restriction of Processing (Article 18): Limit how we process your data in certain circumstances
- Right to Data Portability (Article 20): Receive your data in a structured, machine-readable format and transfer it to another service
- Right to Object (Article 21): Object to processing based on legitimate interests or for direct marketing purposes
- Right to Withdraw Consent (Article 7(3)): Withdraw your consent at any time (does not affect prior processing)
- Right to Lodge a Complaint (Article 77): File a complaint with your local data protection authority
How to Exercise Your GDPR Rights
Email: [email protected]
Subject Line: "GDPR Rights Request" or "Data Protection Request"
Response Time: Within 1 month (may extend to 3 months for complex requests)
Supervisory Authority: If you are in the EU/EEA, you have the right to lodge a complaint with your local data protection authority.
EU Representative (Article 27): As we are based in India and currently operate at a scale that does not trigger the Article 27 representative requirement, we have not yet appointed an EU representative. Please direct all GDPR inquiries to [email protected] with subject line "GDPR Request".
India Data Protection (DPDP Act 2023)
This section applies to individuals in India under the Digital Personal Data Protection Act, 2023.
Data Fiduciary Information
Legal Entity: Winning Strategy Consulting Private Limited
Registered Office: Mumbai, Maharashtra, India
Role: Data Fiduciary under DPDP Act 2023
CIN: U62020MH2024PTC417158
Grievance Redressal Officer
Name: Grievance Officer, Winning Strategy
Email: [email protected]
Subject Line: "DPDP Grievance" or "India Data Protection"
Response Time: Within 72 hours of receipt
Resolution Time: Within 30 days of complaint
Your Rights Under DPDP Act
- Right to withdraw consent (Section 6(4)): Withdraw your consent given to us for processing your Personal Information/Data with the same ease with which you gave your consent
- Right to Access (Section 11): Obtain information about your personal data and how it is processed
- Right to Correction (Section 12): Correct, complete, or update inaccurate or misleading personal data
- Right to Erasure (Section 13): Request deletion of your personal data, including such Personal Information/Data for which you had previously consented (subject to legal retention requirements)
- Right to Grievance Redressal (Section 14): Lodge complaints with our Grievance Officer or the Data Protection Board of India
- Right to Nominate (Section 15): Nominate another individual to exercise your rights in the event of death or incapacity
Cross-Border Data Transfers from India
Your personal data may be transferred outside India to the United States and the European Union. We ensure that such transfers comply with DPDP Act requirements and that adequate safeguards are in place.
How to Exercise Your DPDP Rights
Email us at [email protected] with the subject line "DPDP Rights Request" or "India Privacy Request".
Data Protection Board of India: If your complaint is not resolved satisfactorily, you have the right to approach the Data Protection Board of India.
California Privacy Rights (CCPA/CPRA)
This section applies to California residents and supplements the information in this Privacy Policy.
Categories of Personal Information We Collect
Identifiers
Name, email address, phone number, IP address, unique identifiers
Commercial Information
Subscription plans, payment history, credits purchased and used
Internet or Network Activity
Browsing history on our site, search queries, interaction with our services, AI prompts and outputs
Geolocation Data
Approximate location based on IP address
Professional Information
Company name, job role, business information (optional)
Inferences
Preferences, characteristics, behavior patterns derived from your usage
Sale and Sharing of Personal Information
Important Disclosure:
We do not sell your personal information for monetary consideration. However, we do sharepersonal information with third parties (Google Analytics, Google Ads) for analytics and advertising purposes, which may be considered a "sale" or "share" under California law.
Your California Privacy Rights
- Right to Know: Your Right to Know includes the categories of Personal Information we have collected about you, including:
- The categories of sources from which the Personal Information was collected.
- Our business or commercial purposes for collecting, selling, sharing, or disclosing Personal Information.
- The categories of recipients to which we disclose Personal Information.
- The categories of Personal Information that we sold or shared, and for each category identified, the categories of third parties to which we sold or shared that particular category of Personal Information.
- The categories of Personal Information that we disclosed for a business purpose, and for each category identified, the categories of recipients to which we disclosed that particular category of Personal Information.
- The specific pieces of Personal Information we have collected about you.
- Right to Delete: Request deletion of your personal information (subject to certain exceptions)
- Right to Opt-Out of Sale/Sharing: Opt-out of the sale or sharing of your personal information for targeted advertising
- Right to Correct: Request correction of inaccurate personal information
- Right to Limit Use of Sensitive Personal Information: Limit our use of sensitive personal information (if applicable)
- Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights
How to Exercise Your Rights
Submit a Privacy Request Form or email us at [email protected] with the subject line "California Privacy Rights Request". We will respond to your request within 45 days.
Authorized Agents
You may designate an authorized agent to make requests on your behalf. The agent must provide written authorization signed by you.
Opt-Out of Sale/Sharing
- If you opted to enable analytical and marketing cookies at the time when you accessed our Services, you may similarly opt out if you do not wish for us to share the Personal Information/Data gathered through such cookies with the third parties as specified in this Policy.
- You may click "Cookie Settings" in the footer and disable Analytics and Marketing cookies, or email us at [email protected] with the subject "Opt-Out Request". We also honor Global Privacy Control (GPC) signals.
Retention Period
We retain personal information for the periods described in the "Data Retention" section above.
Additional Disclosure Under California Law
We may disclose your Personal Information/Data to a third party for a business purpose. When we do so, we enter into a contract that describes the purpose and requires the recipient to both keep that Personal Information confidential and not use it for any other purpose except performing the contract.
| Categories of Personal Information | Purposes | Third Party |
|---|---|---|
| Identifiers |
|
|
| Commercial Information |
|
|
| Internet or Network Activity |
|
|
| Geolocation Data |
|
|
| Professional Information |
|
|
| Inferences |
|
|
Notice: We do not have actual knowledge that we sell or share personal information of consumers under 16 years of age.
Automated Decision Making and AI
Our platform uses artificial intelligence (AI) and automated decision-making systems to provide our services.
How We Use AI
- Content Generation: AI models generate presentations, spreadsheets, and data analysis reports based on your prompts
- Data Analysis: AI analyzes your uploaded data and provides insights
- Recommendations: AI suggests improvements and optimizations
- Personalization: AI adapts responses based on your usage patterns and preferences
Your Rights Regarding AI
- Human Review: You can request human review of AI-generated content or decisions
- Explanation: You can request an explanation of how the AI reached a particular output
- Contest: You can challenge or contest AI-generated results
- Opt-Out: For certain non-essential AI features, you can opt-out of automated processing
Important: Our AI systems do not make decisions that produce legal effects or similarly significantly affect you without human oversight.
AI Model Providers
We use OpenAI (GPT models), Anthropic (Claude models), and Google (Gemini models). These providers process your prompts and data solely to generate responses and do not use your data for training their models.
Third-Party Links and Services
Our website and services may contain links to third-party websites, applications, or services that are not owned or controlled by WinningStrategy.ai. This Privacy Policy applies only to our services.
Disclaimer: We are not responsible for the privacy practices, content, or security of any third-party websites or services.
Third-Party Services We Integrate With
- Payment Processing: Razorpay
- Analytics: Google Analytics
- Advertising: Google Ads
- AI Models: OpenAI, Anthropic, Google
- Authentication: Google OAuth
Accessibility
We are committed to ensuring that our website and services are accessible to all users, including those with disabilities. We strive to comply with Web Content Accessibility Guidelines (WCAG) 2.1 Level AA standards. If you experience any difficulty, please contact us at [email protected] with subject line "Accessibility Support".
Children's Privacy
Our services are not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately at [email protected] with subject line "Child Privacy Concern".
Changes to This Privacy Policy
We may update this privacy policy from time to time. We will notify you of significant changes by email or through a prominent notice on our website.
Contact Us
If you have questions about this Privacy Policy or our data practices:
All Privacy & Data Protection Inquiries
Subject Lines: "GDPR Request" | "DPDP Grievance" | "California Rights" | "Security Issue" | "Accessibility Support"
GDPR (EU/EEA)
Response: 1 month
DPDP (India)
Response: 72 hours
CCPA (California)
Response: 45 days
Security Issues
Response: Immediate