Repodime Global Privacy & Data Governance Policy

1. Introduction and Scope

• Repodime operates Repodime Workspace, an AI-driven Record to Report platform.
• Users acknowledge and accept this policy to continue using the services.
• By accessing Repodime Workspace for the first time, you enter into a binding agreement regarding the use of the platform and processing of your personal data.
• This document is designed to comply with global data protection and licensing standards:
  • GDPR: General Data Protection Regulation (EU)
  • CCPA/CPRA: California Consumer Privacy Act (USA)
  • DPDPA: Digital Personal Data Protection Act (India)
  • PDPA: Personal Data Protection Act (Singapore)
  • EU AI Act: Artificial Intelligence Act (European Union)

2. Data Controller & Governance Structure

• Repodime acts as the Data Controller (GDPR/DPDPA) and Data Fiduciary (DPDPA).
• Governance Notice: Repodime has elected not to appoint a formal DPO at this stage.
• Direct Accountability: Data protection and privacy compliance are managed directly by our Board of Directors.
• All high-level decisions regarding data architecture are handled by the Directors to ensure accountability.

3. Categories of Data Collected

• Identity & Contact: Name, professional email, phone number, business address.
• Account & Authentication Data: Username, hashed password, assigned role(s) and company access, and login timestamps (used for account security monitoring, including the "last login" shown on your dashboard).
• Financial Data: Billing information, GST/VAT registrations, and uploaded accounting records (trial balances, ledgers, transaction-level detail).
• Technical Data: IP address, browser type, device information, and platform usage logs.
• AI & Machine Learning Data: Direct prompts, uploaded documents, and feedback provided to DimeAI, plus the underlying accounting data our proprietary classification models learn from within your isolated environment (see Section 5).

4. Website Data Collection & Cookie Governance

• Website Data Collection: When you browse our public website, we collect non-identifiable technical data (browser type, timestamps, referring pages, IP address) and identifiable data you submit voluntarily via "Book a Demo," "Careers," or "Contact" forms (e.g., name, business email, and company name).
• Cookie & Consent Governance: Cookies are used to analyze website traffic, manage sessions, and optimize marketing. Non-essential cookies and third-party tracking scripts (analytics, advertising pixels) are only deployed based on consent given through our website cookie banner. If declined, only essential security and session cookies remain active.
• Website Security Infrastructure: All interactions on our public website are secured via HTTPS/TLS encryption. Form submissions are encrypted in transit and routed directly into Zoho CRM, our internal system for managing sales leads and demo requests. Aggregate website traffic is analyzed using Google Analytics, subject to the cookie consent above.
• Strict Data Separation: Data collected for website analytics, marketing, or sales outreach (Google Analytics, Zoho CRM) is strictly siloed from the Repodime Workspace application. It is never co-mingled with client financial data, and it is never used to train the proprietary machine learning models or the Large Language Models used inside the secure Repodime Workspace application environment.

5. AI & Algorithm Transparency (EU AI Act Compliance)

• Users are explicitly informed whenever they are interacting with an AI system (DimeAI). AI-generated answers and insights are clearly labeled as such and are intended to be reviewed, not treated as final determinations.
• Stateless LLMs: The external Large Language Model we use to power DimeAI (Amazon Bedrock) is completely stateless with respect to your data -- it does not retain your prompts or documents after generating a response, and your data is never used to train the underlying foundation models.
• How Amazon Bedrock Handles Your Data (Per-Provider & Regional Detail): Repodime Workspace's AI features run on Amazon Bedrock in AWS's Asia Pacific (Mumbai) region (ap-south-1), so your prompts and the resulting outputs are processed and stored at rest within that region. Per Amazon Bedrock's own published FAQs, AWS states that it "will not use any inputs to or outputs from Amazon Bedrock to train Amazon Nova, Amazon Titan, or any third-party models," and that "your content is not used to improve the base models and is not shared with any model providers." This applies equally to every foundation-model provider available to us through Bedrock in this region -- including Anthropic, OpenAI, Mistral AI, NVIDIA etc. -- each of which operates inside an isolated, AWS-owned "Model Deployment Account" that the provider itself cannot access, meaning no model provider ever has access to Bedrock's infrastructure, logs, or your prompts and completions, regardless of which underlying model answered a given request.
• Isolated Machine Learning Environment: Our proprietary reconciliation/classification ML models are trained exclusively on your organization's own dataset, within a completely isolated environment. If you leave the platform, your data and everything those models learned from it are permanently deleted.
• Redacted Admin Visibility: Repodime's own platform administrators have restricted visibility into client data by design -- underlying financial records and personal data are masked from internal System Admin roles, who can operate and support the platform without reading customer content.
• Human Oversight: DimeAI can draft insights, answers, and recommendations, but it cannot autonomously certify, de-certify, or otherwise modify financial records -- every such action always requires a human Maker/Checker to confirm it.
• High-risk data systems are subject to a Fundamental Rights Impact Assessment (FRIA).
• Private user data is NOT used for foundation model training without explicit opt-in.

6. User Privacy Rights

• Data Ownership: You retain absolute sovereignty over your data. Repodime is a processor of your data, not its owner.
• Users are granted the following rights across all jurisdictions:
  • Right to Access, Correction, and Portability.
  • Right to Erasure ("Right to be Forgotten").
  • Right to Withdraw Consent at any time.
  • Right to Nomination (specific to DPDPA compliance).
• These rights can be exercised through the Manage Your Data and Contact Privacy Team pages of the Trust Center, or via the grievance channel in Section 10.
• Non-Selling Clause: Repodime does NOT sell user data to third parties.

7. Data Storage, Cross-Border Flow & Retention

• Primary processing occurs on Amazon Web Services (AWS) data centers (application hosting and storage) and Google Cloud Platform (GCP) data centers (machine learning infrastructure).
• International/cross-border data flows are governed by Standard Contractual Clauses (SCCs), consistent with GDPR, DPDPA, and PDPA requirements.
• Application data is encrypted and maintained in secure PostgreSQL databases; uploaded files, documents, and exports are stored in encrypted AWS S3 buckets.
• Retention Policy: Personal data is kept for the duration of the active account + 7 years for audit compliance.

8. Security Architecture

• Encryption: AES-256 for data at rest, TLS 1.3 for data in transit.
• Access Control: Role-Based Access Control (RBAC), ensuring users only see what they need, with optional Multi-Factor Authentication (MFA) for added login security.
• Intelligent Threat Detection: Login patterns and behavioral metrics are monitored in real time to detect and block unusual or anomalous account activity.
• Full audit logging of administrative and data-changing actions (see the in-app Audit Trail) and periodic security vulnerability assessments.

9. Sub-Processors

The following third parties support Repodime Workspace's operation. Each is bound by data protection terms consistent with the Standard Contractual Clauses referenced in Section 7, and none is granted standing access to your decrypted financial records beyond what is strictly necessary to provide its service.

10. Grievance Redressal

• For privacy concerns, use the Contact Privacy Team page in the Trust Center, or email us directly at: hello@repodime.com
• Acknowledgment: Within 48 hours.
• Resolution: Within 30 days.

11. Quick Summary

A plain-language recap of the sections above. This summary does not replace or override the full policy.

• It's your data. Repodime processes it to run Repodime Workspace for you -- we don't own it, and we don't sell it to anyone.
• DimeAI is clearly labeled as AI. It drafts answers and insights from your own company's data; it never certifies or changes a financial record without a human confirming it.
• The LLM behind DimeAI (Amazon Bedrock) doesn't remember your prompts or train on them, and no underlying model provider -- Anthropic, Mistral AI, NVIDIA, or otherwise -- can access them either. Our own ML models train only on your organization's data, in isolation, and are deleted if you leave.
• Our own admins can't casually browse your financial records -- access is restricted and audit-logged.
• Your data lives on AWS (app + storage) and GCP (ML), encrypted at rest and in transit, with cross-border transfers governed by SCCs.
• You can access, correct, export, or delete your data at any time through the Trust Center or by contacting us -- see Sections 6 and 10.
• The website (repodime.com) and the Repodime Workspace application are kept strictly separate: marketing/analytics data (Google Analytics, Zoho CRM) never touches your financial data or trains any model.
• The full sub-processor list is in Section 9 -- eleven vendors total, each scoped to a specific purpose (hosting, ML, AI, email, payments, or website-only tooling).