Privacy Policy

1. Who we are

CYBOT-X Technologies Private Limited ("we", "us") operates Privora at privora.cybot-x.com. For marketing-site and account data we act as a Data Fiduciary under the DPDP Act. For personal data you process inside your tenant workspace (customer/employee records, notices, DSAR content), you are typically the Data Fiduciary and we act as a Data Processor under your instructions and our DPA where executed.

GSTIN (seller): To be published on invoices. Postal path: Registered office details available on request via support@cybot-x.com.

2. Personal data we collect

• Account identity: name, email, organisation, role
• Billing: address, GSTIN / tax IDs, invoices, Cashfree (and Razorpay when enabled) payment references
• Product telemetry needed to run, bill, and secure the service
• Support correspondence, demo requests, and Gap Scanner lead emails
• Optional marketing analytics cookies only after you accept on our consent banner

3. Purpose limitation

We process personal data only for specified purposes: providing and improving Privora, authenticating users, billing and tax compliance, security and fraud prevention, customer support, and — with consent where required — limited marketing communications. We do not use personal data for purposes incompatible with those disclosed here without a fresh lawful basis (including fresh consent where the DPDP Act requires it).

4. Consent & lawful processing

Where processing is based on consent (for example optional analytics or marketing), you may withdraw consent at any time without affecting processing already completed lawfully. Essential cookies and processing needed to perform the contract (account, billing, security) continue as required to operate the service. Decline optional analytics via the cookie banner or by clearing the stored preference and revisiting the site.

5. Retention

• Gap Scanner public logs: 90 days (enforced by retention purge job)
• Marketing leads: up to 365 days unless a longer period is required by law or an open dispute
• Account and billing records: retained as required for tax, dispute, and security obligations

6. Sharing & subprocessors

Payment processing (Cashfree; Razorpay when enabled), hosting, email delivery, observability, and AI assistance providers process data only under contract and for the purposes above. Enterprise customers may request the current subprocessors list and DPA template from support@cybot-x.com. We do not sell personal data.

7. Cross-border transfers

Privora may use infrastructure or subprocessors located outside India where necessary to deliver the service. Where personal data is transferred outside India, we take steps consistent with applicable Indian law and our contracts (including processor terms). Enterprise customers with residency requirements should discuss options with support@cybot-x.com before onboarding regulated datasets.

8. Your rights as a Data Principal

Subject to the DPDP Act and other applicable law, you may request:

• Access to personal data we hold about you as a fiduciary
• Correction of inaccurate or incomplete personal data
• Erasure of personal data that is no longer necessary for the stated purpose, subject to legal retention
• Withdrawal of consent for consent-based processing
• Grievance redressal through the contacts below if you believe processing is unlawful

We may refuse or limit requests that undermine security, fraud prevention, mandatory retention, or rights of others. Use in-product DSAR tools where published for tenant-controlled data, or email support@cybot-x.com with subject "Data Principal request".

9. Grievance officer

Grievance Officer for CYBOT-X Technologies Private Limited. Contact support@cybot-x.com with subject "Privacy grievance". We aim to acknowledge grievances promptly and resolve them within timelines required under applicable Indian law. Named officer details may be updated via environment configuration as the company finalises designation.

10. Children

Privora is a B2B compliance product. We do not knowingly market the service to children. If you believe a child's personal data was provided to us without verifiable parental consent where required, contact support@cybot-x.com.

11. Security

We apply administrative and technical controls appropriate to a multi-tenant compliance product (including MFA for privileged roles, audit logging, and TLS). No method of transmission or storage is perfectly secure; you remain responsible for account credentials and tenant configuration.

12. Changes

We may update this living policy for product, legal, or operational changes. Material changes will be reflected on this page with an updated review date in the banner above. Continued use after publication constitutes notice of the updated terms for account holders, subject to mandatory law.