The useful answer was no. After seven months of interviews and assessments for a large e-commerce company, Jasdeep Cheema and his colleagues had reached the final meeting. They had built the company's initial data maps, the painstaking records meant to show where personal information entered, travelled and came to rest. The general counsel asked a plain question: “Are all the reports up to date?” Almost every one was. Engineering's was not.
A lesser meeting might have ended with a promise to refresh the document. Cheema saw a different problem. Software teams alter products every week. A data map assembled from interviews captures a respectable portrait of yesterday. By the time the ink dries, another release can add a field, reroute a data flow or introduce a new third party. Compliance had produced a map of moving country.
That stale report became the hinge of Privado AI's founding story. It gave Cheema and co-founders Vaibhav Antil and Prashant Mahajan a target: move privacy closer to the place where decisions about data are made. Instead of repeatedly asking engineers to remember what their systems do, inspect the systems themselves. Watch the code. Follow the data. Raise a flag while someone can still fix the problem.
01 · The long way to a short answerEight months of listening
The revelation had a long runway. Cheema has said the founders interviewed privacy and security professionals for more than eight months before settling on the issue. The refrain was visibility. Privacy teams were expected to account for personal data, yet the details lived inside engineering workflows that were difficult to see and forever changing.
Then came the consulting job and another seven months close to the machinery. The engagement did more than validate a market slide. It made the cost of the old method bodily real: meetings, assessments, recollection, reconciliation, then a report that began decaying at once. Patient research is hardly cinematic, but it has the useful property of leaving fewer places for wishful thinking to hide.
Privado's early description was wonderfully compact: Grammarly for code privacy issues. The comparison worked because it moved the product from the annual-audit cupboard into the act of creation. Connect Privado to source-code tools, scan what developers write, identify personal-data use and show privacy or security concerns before a release. The founders wanted a privacy score and actionable warnings where a development team already worked.
02 · Before the code scannerA mechanic, a playlist and a taste for systems
Cheema arrived at privacy by a route with several changes of scenery. He studied aircraft engineering and airframe maintenance under India's civil-aviation system, then worked as an aircraft technician at Kingfisher Airlines and an aircraft maintenance mechanic at Cathay Pacific. Aviation is an exacting education in the difference between an assurance and a working mechanism. A checklist has value because there is a machine on the other side of it.
By 2012 he had moved into startup operations. Two years later, he joined four IIT Bombay graduates in a venture born over chai in Powai and a shared objection to dreary restaurant music. BC Jukebox placed a device in restaurants, bars, gyms and hotels, combining curated background music with an app through which customers could request songs. Its software matched tempo, normalized volume and crossfaded tracks. The venue paid a subscription. The patron acquired, briefly, the dangerous power to influence the playlist.
The business expanded across Indian venues and into Dubai, became Jukebox Studio and was acquired by Gaana. Cheema stayed as a business lead. It was another live system whose quality depended on continuous signals rather than a document in a drawer. The distance from restaurant playlists to data governance is wide. The operating instinct crosses it comfortably: observe what is actually happening, make complexity usable, and let the instrument update with the environment.
03 · Privacy at software speedThe document and the thing itself
Privado was founded in 2020. By August 2022, the company monitored more than 600,000 code commits and named HERE Technologies, Thrasio and Zego among its customers. A $3.5 million seed round that January was followed by a $14 million Series A led by Sequoia Capital India and Insight Partners. The money was intended for the technology, the team and the open-source community.
Open source mattered to Cheema's pitch. When the company released its privacy scanner, he invited privacy engineers and developers to use it, contribute and send feedback. The scanner detected personal-data processing and traced the route from collection to data sinks. The invitation made the product's philosophy visible: if privacy was to enter engineering culture, engineers needed something they could inspect and help shape.
The company has since stretched beyond source code. Its platform audits websites and mobile apps, builds dynamic data maps, analyzes documents and contracts, and runs assessments. Live user simulations test what happens when somebody accepts, rejects or ignores a consent banner. Scanners look for cookies, pixels, software-development kits and data transfers. The product is still answering the general counsel's old question, only now the answer comes with evidence gathered closer to the event.
Aircraft technical and maintenance roles at Kingfisher Airlines and Cathay Pacific.
Co-founds Jukebox Studio, later acquired by Gaana, and leads the business after acquisition.
Co-founds Privado AI with Vaibhav Antil and Prashant Mahajan.
Privado raises seed and Series A rounds, and opens its privacy code scanner to contributors.
Privado launches Wren to run privacy assessment workflows from intake through risk tracking.
04 · The operator's side of privacyBuilding the bridge twice
Cheema now serves as Privado's chief revenue officer as well as co-founder. It is a revealing seat. Privacy engineering has to cross organizational borders before it can cross technical ones. Lawyers, privacy officers, security teams, product managers and developers bring different vocabularies and incentives. The commercial task is partly translation: show the privacy team what exists in the product, then give engineering a specific issue it can act upon.
That bridge appears repeatedly in Cheema's public account of the company. He credits the early privacy practitioners who gave the founders time, the advisers who tested the idea, and the team that built it. His contribution to the origin story has no lone-genius flourish. It is the slow accumulation of conversations, a consulting engagement and an uncomfortable exception in a status meeting.
Privado also created the Bridge Summit, a free technical-privacy conference. Its 2025 edition brought more than 1,500 professionals from over 60 countries into discussions spanning privacy, engineering, security, legal work, AI and data analytics. The name is almost suspiciously apt. The company sells software, certainly, but the category grows only if people on either side of the organizational divide learn to recognize the same problem.
05 · The agent arrivesTeaching the process to watch for work
In March 2026, Privado introduced Wren, an AI privacy analyst named for Samuel Warren, who co-wrote the 1890 essay “The Right to Privacy.” Wren monitors tools such as Jira, Confluence and procurement systems for activity that may require review. It can triage a risk, trigger the appropriate assessment, gather evidence, ask for missing context and track remediation.
The ambition is broader than filling forms quickly. It is to make the assessment process notice when it is needed. A feature request, a vendor purchase or a technical document can become an intake signal. Low-risk work can receive guidance without joining a long queue. Higher-risk work can be routed into a PIA, DPIA, TIA or record of processing activity. Cheema summarized the pressure bluntly: “Privacy teams have been handed an impossible task.”
There is continuity here with the original stale report. First Privado asked code to disclose its data flows. Now it asks the surrounding workflow to reveal when a privacy decision is forming. The scanner looks at the thing being built; the agent looks at the work gathering around it. Both reduce dependence on somebody remembering to update a form.
06 · The useful exceptionWhat the stale report still says
Cheema's career has moved through aircraft, music and privacy, three fields with little patience for stale state. An aircraft's condition matters now. A room's music changes the room now. A data flow can become risky the moment a release changes it. His companies have each sat near the control panel, turning live complexity into something an operator can use.
The enduring scene remains that final consulting meeting. Months of respectable labor had created a nearly complete answer. The single outdated report could have looked like a small embarrassment. Cheema treated it as evidence that the method had reached its limit. It was an operator's insight, modest in appearance and expensive in consequence.
Founders are often celebrated for seeing around corners. Cheema's story offers a more practical talent: noticing what is already on the conference-room table. The future of Privado AI emerged there, inside the one answer that would not behave. The report had failed to keep up. The failure, at least, arrived perfectly on time.