Privacy Policy

1. Data Collection

We collect information you provide directly to us when you request a demo, sign up for our CRM, or communicate with our automated agents. This includes your name, email, phone number, and business details.

We may also automatically collect metadata related to your usage of our AI platforms to improve response latency and model accuracy.

2. Cookie Consent Data & IP Address Collection

When you interact with our cookie consent banner by clicking Accept All, Reject All, Essential Cookies, or Manage Preferences, we automatically record the following data solely for the purpose of maintaining a legally required audit trail of your consent decision:

• IP Address: Your public IP address at the time of your consent decision.
• Approximate Location: City, region, and country derived from your IP address via a third-party geolocation service (ipapi.co).
• ISP / Organisation: The internet service provider or organisation associated with your IP.
• Browser & Device: Your browser type, operating system, and preferred language.
• Consent Choice: Which option you selected (Accept All / Reject All / Essential / Custom) and which individual cookie categories you enabled or disabled.
• Page URL & Referrer: The page you were visiting and the source URL when you made your consent decision.
• Timestamp: The exact date and time (UTC) of your consent action.

Legal Basis Under DPDP Act, 2023 & International Frameworks

Personal data processing is carried out strictly under the legal grounds of Verifiable Consent (India DPDP Act 2023 Section 6; GDPR Article 6(1)(a)) and specified Legitimate Uses / Legal Obligations (India DPDP Act 2023 Section 7; GDPR Article 6(1)(c)). As a Data Fiduciary, we maintain verifiable consent audit records to demonstrate compliance.

How We Use This Data

This consent audit data is used exclusively for compliance verification and legal evidence purposes. It is never used for advertising, marketing profiling, or sold to any third party.

Retention Period

Consent audit records, including IP address and location data (where consent was granted), are retained for a maximum of 12 months from the date of collection, after which they are permanently deleted.

Your Data Principal Rights

Under the DPDP Act 2023 (Sections 11–14), you have the right to request access to, correction of, updating, or complete erasure of your personal data, as well as the right to withdraw consent at any time. Please submit your request through our contact form or support channel.

3. WhatsApp & Communications Consent

By submitting your phone number via our forms or interacting with our WhatsApp chatbots, you provide explicit, affirmative consent (opt-in) to receive automated messages, account notifications, and marketing communications from Gyan VaniAi via WhatsApp and SMS.

Opting Out: You may revoke this consent and opt out of these communications at any time by replying "STOP" to any of our WhatsApp messages or by contacting our support team. Standard message and data rates may apply.

4. Meta & Third-Party APIs

Because our core infrastructure utilizes the official WhatsApp Business API, data transmitted via our chatbots is securely routed through Meta's infrastructure. We ensure that this data is handled in strict compliance with Meta's Business Policies.

We do not sell your personal data to any third-party brokers. Data is only shared with essential sub-processors (like AWS, Firebase, or Vertex AI) required to provide the core service.

5. Security & Storage

We implement enterprise-grade security, including JWT authentication, TLS encryption, and secure PII masking, to protect your personal information against unauthorized access, alteration, disclosure, or destruction.

6. User Data Deletion & DPDP / GDPR Compliance

In strict compliance with the Indian Digital Personal Data Protection Act, 2023 (Section 12: Right to Erasure) and international frameworks (such as GDPR Article 17), you have the absolute right to request the complete deletion of your personal data stored within our systems.

How to Request Data Deletion

To exercise your right to erasure, please submit a formal data deletion request with the subject line "Data Deletion Request". We will verify your identity within 7 business days and process your request accordingly.

Our Deletion Process

• Identity Verification: We will verify your identity within 7 business days to prevent unauthorized data removal and ensure the security of your account.
• Complete Erasure: Upon successful verification, we will permanently delete or cryptographically anonymize your personal data across all our active databases, internal systems, and third-party sub-processors within a maximum of 30 days.
• Legal Exceptions: Data may be retained only where strict retention is explicitly mandated by national or international financial laws, legal obligations, or active dispute resolutions.

7. Grievance Redressal & Data Protection Board (DPBI) Appeals

In compliance with Section 5(2) and Section 13 of the Digital Personal Data Protection Act, 2023, Gyan VaniAi has designated a Grievance Officer to address any privacy concerns, data rights requests, or grievances. You can submit your concerns through the following process:

Procedure for Filing Grievance & Appeals to DPBI:

1. Internal Grievance Redressal: Submit your privacy complaint or rights request through our designated contact channels. We will acknowledge receipt within 24 hours and resolve your request within 15 business days according to applicable laws.

2. Appeal to Data Protection Board of India (DPBI): If you are unsatisfied with our response or if no response is provided within statutory timelines, you have the statutory right under DPDP Act Section 13(3) & Section 18 to file an appeal directly with the Data Protection Board of India (DPBI) via their official portal at dpbi.gov.in.

Privacy Request Form