Privacy policy

Exinary Technologies Private Limited(“Exinary”, “we”) is a company registered in India, with its registered office at TC 6/199-9, SWATHY, Netaji Road, Thiruvananthapuram, Kerala 695013. AI Digital Hub is a department of Exinary, not a separate legal entity — the contracting party in every engagement is Exinary.

For the purposes of the Digital Personal Data Protection Act 2023 (“DPDP Act”) we are the Data Fiduciary for personal data collected through this website. Where the UK or EU GDPR applies, we are the Controller for that data. When we process data on behalf of a client during an engagement, we act as a Data Processor under their instructions and a Data Processing Addendum.

Data protection contact: [email protected].

We collect only what a stated purpose requires.

We do not sell personal data, and we do not share it for advertising. We do not use behavioural advertising pixels on this site.

Card details are entered on our payment provider’s hosted checkout and never reach our servers. We receive confirmation of the payment, the billing name and address, and the last four digits of the card for reconciliation. Our current provider is listed on the sub-processors page.

The assistant on this site is powered by a large language model operated by a third-party provider. What you type is sent to that provider to generate a reply. We instruct the provider not to retain your conversation for training.

Please do not paste confidential information, credentials or personal data about other people into it. If you ask the assistant to pass your details to us, it records the name, email and summary you provided and emails them to our team — that is the only circumstance in which a conversation becomes a record we keep.

• Enquiries and quote requests: 24 months from last contact, then deleted.
• Job applications: 12 months, then deleted, unless you ask us to keep them longer.
• Newsletter subscriptions: until you unsubscribe, plus a suppression record so we do not email you again by mistake.
• Billing and tax records: 8 years, as required by Indian tax law. This period is a legal obligation and overrides a deletion request for those specific records.
• Assistant conversations: not retained by us unless you asked us to record your enquiry.
• Server logs: 30 days.

We use a small number of processors to run this site — hosting, transactional email, payments, analytics and the AI provider. Each one, what it does, and where it processes data, is listed on the sub-processors page. We keep that list current because it is the honest answer to “where does my data go”.

Some of these providers process data outside India. Where that happens we rely on the provider’s contractual commitments, including Standard Contractual Clauses where GDPR applies. For client engagements with residency requirements, we design around in-region processing and will say so explicitly in the engagement terms.

Under the DPDP Act you have the right to access a summary of your personal data and our processing of it, to correct or complete it, to have it erased, to nominate someone to exercise your rights, and to a grievance redressal process. Under GDPR you additionally have rights to restriction, portability and objection.

To exercise any of these, email [email protected]. We respond within 30 days. We may ask you to confirm your identity, but only to the extent needed to be sure we are giving your data to you.

If you are not satisfied with our response, you may complain to the Data Protection Board of India, or to your local supervisory authority if GDPR applies to you.

Encryption in transit and at rest, least-privilege access, mandatory MFA on all internal systems, centralised audit logging, and a documented incident response process. The detail is on our security page. If you believe you have found a vulnerability, email [email protected] — we acknowledge within one business day and will not pursue good-faith researchers.

This is a business-to-business site and is not directed at children. We do not knowingly collect personal data from anyone under 18. Under the DPDP Act, processing children’s data requires verifiable parental consent, which we do not seek because we do not process it. If you believe we hold data about a child, tell us and we will delete it.

If we change this policy in a way that materially affects how we use your data, we will update the date at the top and, where we have your consent for email, tell you directly. We will not quietly broaden the purposes for which we use data you already gave us.