Privacy Policy

1. Scope and who we are

This Privacy Policy explains how Panchbhai Technologies LLP("Privisol," "we," "us," or "our") collects, uses, discloses, safeguards, and retains personal information when you visit https://privisol.com, create an account, communicate with us, or use our websites, applications, APIs, and related services (collectively, the "Services").

This Policy applies where we determine why and how personal information is processed, such as for our website, account administration, security, support, and business operations. When an organization uses Privisol to process information under its own control ("Customer Content"), that organization is responsible for the processing and we generally act as its service provider or processor. Requests about Customer Content should first be directed to the relevant organization. We will assist it as required by our agreement and applicable law.

2. Information we collect

2.1 Information you provide

• Account and identity data: name, work email, telephone number, job title, organization, location, profile, login credentials, authentication data, and account preferences.
• Commercial data: plan, subscriptions, transaction records, billing contact, tax details, and limited payment information received from payment providers.
• Communications: support requests, feedback, survey responses, meeting details, and correspondence with us.
• Applications and events: information you submit when requesting a demonstration, applying for a role, registering for training, or attending an event.

2.2 Customer Content

Depending on how an organization configures the Services, Customer Content may include user and employee records, device and access information, application inventories, security configurations, policies, procedures, manuals, registers, agreements, implementation records, audit evidence, findings, reports, consent and data-request records, uploaded files, URLs, prompts, responses, and integration data. Customers decide what they submit and are responsible for providing notices and obtaining rights or lawful bases needed for that information.

2.3 Information collected automatically

• Device and network data: IP address, browser, operating system, device identifiers, language, approximate location, and network information.
• Usage and log data: pages and features used, links clicked, timestamps, referring pages, searches, API requests, errors, performance, session activity, and audit or security logs.
• Cookie data: information collected through cookies, local storage, pixels, and similar technologies as described below.

2.4 Information from other sources

We may receive information from your employer or account administrator, identity providers, enabled integrations, resellers and partners, public sources, security and fraud-prevention providers, and service providers that help us operate the Services.

3. How we use information

We use personal information to:

• provide, configure, maintain, support, and improve the Services;
• create and administer accounts, authenticate users, and manage permissions;
• process customer instructions, uploads, integrations, reports, and AI-assisted workflows;
• monitor reliability, troubleshoot errors, and develop features;
• protect accounts, users, systems, and data; detect misuse; and investigate incidents;
• process transactions and manage subscriptions, renewals, and customer relationships;
• communicate about the Services, security, support, policies, and relevant products or events;
• measure and understand use of our website and Services;
• comply with law, enforce agreements, establish or defend legal claims, and protect rights; and
• create aggregated or de-identified information that does not reasonably identify an individual.

We do not use Customer Content to advertise to individuals. We do not sell personal information for money or share it for cross-context behavioural advertising as those terms are defined under applicable US state privacy laws.

4. Legal bases

Where a law requires a legal basis, we process personal information as needed to perform a contract or take requested pre-contract steps; pursue legitimate interests such as operating, securing, supporting, and improving our business and Services; comply with legal obligations; protect vital interests; or based on consent. We balance legitimate interests against affected rights and provide choices where required.

Where India's Digital Personal Data Protection Act, 2023 applies, we process digital personal data with consent or for applicable legitimate uses and fulfil obligations owed to data principals. Customers are responsible for the legal basis applicable to Customer Content they instruct us to process.

5. AI-assisted processing

Privisol may use machine-learning systems and model providers to analyse submitted material and produce summaries, mappings, suggested controls, findings, reports, or other output. Information sent to these features may be transmitted to providers that process it on our behalf or as otherwise described at the point of use. Customers should avoid submitting personal or confidential information that is unnecessary for the task and must configure and use these features consistently with their obligations.

We do not intend AI-assisted features to make final decisions producing legal or similarly significant effects on individuals. Customers must apply appropriate human review and should contact us if they have questions about a specific feature.

6. How we disclose information

We may disclose personal information to:

• Service providers and subprocessors that provide cloud hosting, databases, storage, authentication, communications, analytics, customer support, AI models, document conversion, payment processing, monitoring, and security services.
• Your organization and administrators who manage your workspace, users, permissions, content, integrations, and subscription.
• Integrations and third parties you direct when you enable a connection, export information, or ask us to interact with another service.
• Professional advisers and business partners such as auditors, insurers, lawyers, accountants, resellers, and implementation partners subject to appropriate duties.
• Authorities and affected parties when reasonably necessary to comply with law or legal process, enforce agreements, protect rights and safety, prevent harm, or respond to an emergency.
• Transaction participants in connection with financing, due diligence, merger, acquisition, reorganization, insolvency, or sale of some or all of our business or assets.

We may disclose aggregated or de-identified information for any lawful purpose. We require providers handling personal information for us to use it only for authorized purposes and apply appropriate safeguards.

7. Cookies and similar technologies

We use essential cookies and similar technologies to authenticate users, maintain sessions, remember preferences, route traffic, prevent abuse, and provide requested functionality. We may also use analytics or support technologies to understand usage, diagnose problems, and communicate with visitors. These third parties may collect device, usage, and interaction data under their own notices or as our processors.

You can control many cookies through browser settings and any preference controls we make available. Blocking essential storage may prevent sign-in or cause parts of the Services to stop working. Browser "Do Not Track" signals do not have a uniform legal standard; we respond to legally recognized opt-out signals where required.

8. International transfers

We and our providers may process information in India and other countries where we or they operate. Those countries may have privacy laws different from those in your location. Where required, we use recognized transfer mechanisms and safeguards, such as adequacy decisions, contractual clauses, data processing agreements, and technical and organizational measures. Transfers remain subject to restrictions imposed by applicable law and customer agreements.

9. Retention

We retain personal information only as long as reasonably necessary for the purposes described in this Policy, including to provide the Services, maintain security and business records, comply with legal and contractual obligations, resolve disputes, and enforce agreements. Retention depends on the information's nature, sensitivity, volume, risk, account status, customer instructions, backup cycles, and legal requirements.

Customer Content is retained and deleted according to customer settings, our agreement, and applicable law. Deleted information may remain temporarily in backups or be retained where required for security, fraud prevention, legal holds, or compliance. We may retain aggregated or de-identified information that cannot reasonably identify you.

10. Security

We use administrative, technical, and organizational measures designed to protect personal information against unauthorized access, loss, misuse, alteration, and disclosure. Measures may include access controls, authentication, encryption, monitoring, backups, logging, vendor review, and incident-response procedures, as appropriate to the information and Services.

No system or transmission is completely secure. You are responsible for securing your accounts, endpoints, credentials, integrations, and configurations and for notifying us promptly at support@privisol.com if you suspect unauthorized access.

11. Your rights and choices

Depending on your location and our role, you may have rights to access, confirm, or receive a copy of personal information; correct inaccurate information; request deletion; withdraw consent; object to or restrict processing; obtain portability; opt out of certain marketing; nominate another person; seek grievance redressal; or appeal a decision. You may also have the right to complain to a privacy regulator.

To exercise a right concerning information Privisol controls, email support@privisol.com. We may ask for information needed to verify identity and authority. We will respond within the period required by applicable law and will explain if an exception applies. Authorized agents may submit requests where permitted. We will not unlawfully discriminate against you for exercising a privacy right.

For Customer Content, contact the organization that provided your account or collected the information. If you contact us directly, we may refer your request to that customer. You can unsubscribe from promotional email using the message link, but we may continue sending transactional, security, and service communications.

12. Children

The Services are intended for organizations and adults and are not directed to children under 18. We do not knowingly collect personal information directly from children for our own purposes. If you believe a child has provided information to us without proper authorization, contact us so we can investigate and take appropriate action. Customers must not submit children's data unless lawfully authorized and expressly supported by their agreement with us.

13. Third-party services and links

The Services may link to or integrate with third-party websites and products. Their privacy practices are governed by their own notices, not this Policy. Review those notices before enabling an integration or providing information. We are not responsible for third-party privacy or security practices you choose to use.

14. Changes to this Policy

We may update this Policy as our Services, practices, or legal obligations change. We will post the revised Policy, update the date above, and provide additional notice of material changes where required. Earlier versions may be available on request.

15. Contact and grievances

Contact us with privacy questions, requests, or grievances. Please include enough detail for us to understand and respond to your request.