Privacy Policy

Who we are

Gnaan AI (“Gnaan AI”, “we”, “us” or “our”) is an AI and data governance consultancy based in Hyderabad, India. This website is operated by Gnaan AI. For privacy questions, contact [TODO: privacy contact email from me]. This placeholder must be replaced with a monitored privacy contact before publication.

Personal data this site may collect

When you make an enquiry or request a consultation, we may receive the information you choose to share, such as your name, business contact details, email address, phone number, organisation, and the contents of your message. Enquiries may arrive through a contact form, email, or phone. Please do not send sensitive personal information unless it is necessary and requested.

When you browse the site, our hosting and analytics services may process technical and usage information such as IP address, device and browser details, pages viewed, referral source, approximate location, and timestamps. The exact analytics fields and tools in use should be confirmed before this draft is finalised.

Purposes and legal bases

We use enquiry information to respond to you, arrange requested meetings, provide information about our services, and manage potential or current client relationships. We use technical data to operate, secure, troubleshoot, and understand use of the website.

Where the EU/UK GDPR applies, the relevant legal basis may be taking steps at your request before entering a contract, performing a contract, our legitimate interests in running and securing the site and responding to business enquiries, or your consent where it is required (for example, for certain optional analytics or cookies). Where India's Digital Personal Data Protection Act, 2023 (DPDP Act) applies, processing will be handled on the applicable basis under that Act, including consent or a permitted legitimate use where applicable. The precise bases, notices, and consent controls must be verified by counsel against our actual practices and applicable commencement rules.

Retention

We retain enquiry information for as long as needed to respond, maintain a business relationship, and meet applicable legal, accounting, security, and dispute-resolution requirements. Technical and analytics records are retained only as needed for their stated purposes and according to the relevant service settings. Retention periods and deletion schedules are to be confirmed before publication; information no longer needed should be deleted or de-identified where appropriate.

Sharing and service providers

We may share relevant information with service providers that help us host, secure, analyse, communicate through, or otherwise operate the site and handle enquiries. They may process information on our behalf under appropriate contractual and security arrangements. We do not authorise them to use it for their own unrelated purposes.

Information may also be disclosed where required by law, to protect rights and safety, or as part of a business reorganisation. If a service provider processes personal data outside your country, applicable transfer requirements and safeguards should be assessed and documented before publication.

Your rights and how to exercise them

Depending on your location and applicable law, you may have rights to request access to personal data, correction, completion, erasure or deletion, information about processing, a copy or portability where provided by law, withdrawal of consent, or to raise a complaint or grievance. GDPR rights apply where the GDPR covers the processing. Rights and procedures under India's DPDP Act, 2023 apply as and when applicable to the processing.

To make a request, email [TODO: privacy contact email from me] with “Privacy request” in the subject and describe what you need. We may ask for information reasonably necessary to verify your identity and locate the relevant records. We will respond under the timelines and exceptions set by applicable law. Withdrawing consent does not affect processing lawfully carried out before withdrawal. You may also have a right to complain to the relevant authority. The contact, grievance process and statutory details must be confirmed by counsel before publication.

Cookies and similar technologies

The site or its providers may use essential technologies needed to deliver and secure pages, and analytics technologies to understand site usage. Browser settings may let you control cookies, although blocking essential cookies can affect how the site works. Where required, non-essential cookies or similar technologies should be used only after the appropriate consent is obtained. The actual cookies, analytics providers, consent mechanism, and retention settings must be audited and described here before publication.

Updates to this notice

We may update this notice when our practices or legal requirements change. Before this draft is published, add the effective date and a process for notifying visitors of material changes.