Privacy Policy

SorviAI is a business software platform operated by SORVI AI LTD, a private company limited by shares, registered in England and Wales with company number 16927720, with its registered office at Unit 5a Victoria Road, Stoke-On-Trent, England, ST4 2HS, United Kingdom. Our full company details are on our Legal Notice and Grievance Officer page. Because we offer SorviAI to businesses in India, Indian data protection law applies to what we do with information about people in India.

This is the India version of our Privacy Policy. It applies to workspaces set up for India and to visitors to our website in India. Everyone else reads the Global version. Both versions describe the same service. This policy is in English; you can write to us in any language, and we answer in English.

In this policy, “we”, “us” and “our” mean that company. “You” means the person reading it, whether you hold a SorviAI account yourself or your details appear in someone else’s account.

Our Grievance Officer, Deepak Gupta, handles privacy complaints and requests from India, at [email protected]. India has no register of data controllers to join. How to contact us gives every way to reach us.

SorviAI is used by organisations to run their business. That means we handle personal information in two very different ways, and your rights depend on which one applies to you.

When we decide, we are the controller

If you sign up for SorviAI, get invited into a workspace, pay us, visit our website, subscribe to our newsletter, apply for a job with us or contact our support team, we decide why and how your information is used. In legal terms we are the data controller, which the Digital Personal Data Protection Act 2023 calls the Data Fiduciary, and this policy is the document that governs it.

When our customer decides, we are the processor

If your details are inside SorviAI because an organisation put them there, that organisation is the controller (the Data Fiduciary) and we are only the processor (the Data Processor). This applies if you are an employee whose record sits in the Worklink module, a customer or supplier whose contact and invoice records sit in Finance, someone who reported a repair ticket, a visitor signed in at a business’s front desk, someone who sent an enquiry through a storefront, someone who signs in to a business’s customer or vendor portal, someone who opens a file a business shared with a public link, or someone who exchanged emails with a business using our TeamEmail module.

In those cases we hold your information on that organisation’s instructions. The written terms that govern this are our Data Processing Agreement, which is the contract the Digital Personal Data Protection Act 2023 (section 8(2)) expects between a Data Fiduciary and its Data Processor, and which forms part of our Terms of Service. We do not decide what is collected, we do not use it for our own purposes, and we do not change or delete it on our own initiative.

This policy applies to the SorviAI platform and every application within it, together with our public website and our sales and support communications.

What it does not cover

• Online stores run by our customers. Businesses can publish their own storefront using SorviAI. Storefronts show the business’s own catalogue and take enquiries; they have no checkout. If you are browsing one of those sites or sending an enquiry through it, the business running it is the controller of your information and its own privacy policy applies, not this one.
• Third-party services our customers connect. If a customer links a Microsoft 365 mailbox, a payment gateway, a carrier account or another external account to SorviAI, that provider’s own terms and privacy policy continue to apply to the data held on their systems.
• Other websites we link to. We are not responsible for how they handle your information.

This section covers information we hold as controller, which means information about you as a user or prospective user of SorviAI.

Account and profile information

When you create an account or accept an invitation to a workspace, we collect your email address, first and last name, and optionally your phone number and a profile picture. Your profile can also hold additional email addresses and phone numbers, your gender, country, state or region, time zone and language, if you or an administrator add them. While you are signing up, before your email address is verified, we hold a short-lived pending sign-up record. We record whether your email address has been verified and when, when your account was created and last updated, and which workspaces you belong to.

Authentication and security information

To keep your account secure we hold your password in hashed form, never as readable text. If you enable two-factor authentication we store the secret needed to verify your codes in encrypted form, your recovery codes, and the time you last used a code so that the same code cannot be replayed. We also issue short-lived tokens when you sign in, switch workspace or accept an invitation.

Device, network and activity information

When you take actions in SorviAI we record what was done, when, by which account, together with the IP address and browser user-agent string of the request. This forms the audit log, which lets workspace administrators see who changed what and lets us investigate security incidents.

Each time you sign in we also keep a session record with the IP address, your browser’s user-agent string, a location label derived from the IP address (such as the country or network), and when the session was last used. You can see your own sessions in your profile. A session record is deleted after the session expires.

When someone checks in or out in Worklink, the IP address of that check-in and check-out is stored with the attendance record. That record belongs to the employer, and is described under employee records below. Where a workspace administrator has turned on IP-based access restriction for check-in, we also compare the address of each attempt against the addresses that administrator has allowed.

Error monitoring

When something goes wrong in the SorviAI app, an error report goes to our error-monitoring provider, Sentry, which processes it in its EU region in Frankfurt, Germany. A report carries technical details of the request and the fault, and identifies the account involved by its user ID, email address and username, together with the name of the workspace. Some error log lines can also contain the email addresses a message was being sent to.

Sentry’s session replay feature records what happens on screen to help us find the cause of a fault. In the SorviAI app it records 10% of sessions and every session in which an error occurs. It masks what you type into form fields, but it does not mask the text shown on screen or images, so a recording can show the records you had open, such as customer names, invoice lines or employee details, including an employee’s PAN or bank details on a Worklink screen. It runs only if you allow analytics in our consent banner, and stops when you withdraw that consent. While it runs, Sentry writes an entry named sentryReplaySession to your browser’s session storage. Please do not enter Aadhaar numbers in SorviAI.

Billing information

We hold your billing contact details, the plan and subscription associated with your workspace, and a record of invoices and payments. Subscription payments are processed by Stripe. Card numbers go straight to Stripe and never reach our servers; to show you which card is on file we fetch its brand, last four digits and expiry date from Stripe when the page loads, and we do not store them.

Support and correspondence

If you contact us for help we keep the messages you send, our replies, and any diagnostic information you choose to share so that we can resolve the issue and improve the product. If you report a problem with the bug reporter inside the app, the report reaches our own support desk as a ticket, together with the details the app attaches: the screen you were on, app versions, your browser details, recent failed requests, the Sentry error reference and any screenshot you include. Our support mailbox runs on Microsoft 365.

Website information

When you visit our public website we collect standard technical information such as IP address, browser type and the pages you viewed, from our server logs. We run no advertising scripts on that site. If you allow analytics in our consent banner, Google Analytics also records the pages you view, the page that referred you, an approximate location derived from your IP address, your device and browser details, and how you engage with the site, such as scrolling, following links that leave it, searching it, downloading files and playing videos. Nothing from Google loads before you allow it. The script of Tradedoubler, our affiliate network, loads only if you allow affiliate tracking. Both are explained under who we share information with. Our network provider, Cloudflare, sets a short-lived security cookie to tell people from automated traffic; the other cookies the site can set are written only after you act: for example, your answer in the consent banner, your answer to a “was this helpful?” question on our articles and guides, or the country you pick in the country switcher. Our Cookie Policy lists each of them. When you arrive without having picked a country, the site may send you to a country version based on the country Cloudflare derives from your IP address; that country is not stored in a cookie or linked to you.

If you open the chat with our assistant, that conversation is kept in your own browser so a reload does not lose it: it is answered by a script running there, it never reaches us, and closing the chat erases it. The assistant does not ask for or store your email address or phone number. You can also write to a desk from inside that chat, and a message you send that way reaches us exactly as one sent from our contact page does.

A message sent through a contact form arrives with us by email, together with the name and address you give us. Any file you attach is held in private storage and a copy is included in the email to the desk. Attachments are deleted from our storage automatically 30 days after they are uploaded, and the copy in the receiving mailbox is kept as set out under how long we keep information.

Newsletter

If you subscribe to our newsletter we hold your email address, your name if you give it, where you signed up, and a record of your consent: the time you asked to subscribe, the IP address the request came from, and the time you confirmed. We send you a confirmation email first and add you to the list only after you click the link in it, so that nobody can subscribe you without your knowledge. We record whether each issue was delivered to you. Newsletters carry no open tracking. Links in an issue pass through our own short redirect, which counts how often each link is followed without recording who followed it. Every newsletter carries an unsubscribe link, and unsubscribing takes effect at once.

Marketing email

India has no law written specifically for marketing email; from 13 May 2027 it is processing that needs your consent under the Digital Personal Data Protection Act 2023. We already treat it that way. We send marketing email only with your prior consent or, for our own customers, where we collected the address in a sale or negotiation, the email is about our own similar products, and we offered a way to opt out when we collected it and in every message. We send no marketing by SMS or phone call.

Subscribers who sign up on our website confirm by email before they receive anything. Our earlier launch “notify me” list was single opt-in, and addresses imported from existing lists can be added as confirmed without a confirmation email; we send no marketing to those addresses until they have re-confirmed by email. Every message says who it is from, carries our postal address and gives a working way to opt out.

Job applications

If you apply for a role through our careers page we hold the name, email address and phone number you give us, the role you applied for, your CV, and a cover letter if you choose to send one. We also record the time you gave your consent and the IP address you gave it from, so that we can show the consent was given. We ask for your consent before you send any of it, and we rely on that consent as our legal basis.

Your CV and any cover letter are stored privately, are never published, and are reached only through a link that expires, by the people involved in hiring for that role. The hiring team is told about a new application by email; that email carries your contact details and time-limited links to your files, not the files themselves.

We keep an application for 12 months from the day it arrives and then delete it, together with the files. You can withdraw your consent or ask us to delete an application at any time, and we will act on it.

This section covers content that our customers put into their workspace. We process it on their instructions, as described under our two roles. We are telling you what it consists of so that you know what we hold, not because we decide what happens to it.

Business contacts and financial records

Names, job titles, email addresses, phone numbers and postal addresses of a customer’s own clients and suppliers, together with quotes, sales orders, invoices, credit notes, bills, purchase orders, goods receipts, payments, expenses, inventory items, price lists, tax records and storefront enquiries. The same applies to budgets, statements, stock counts, point-of-sale sales (including walk-in customers), helpdesk contacts, companies and tickets in Escalate, call and meeting records, campaign contacts and repair technicians.

Employee records

Customers using the Worklink module can store detailed records about their staff. Depending on what that employer chooses to record, this may include a profile photograph, date of birth, gender, marital status, a national identification number, a tax identification number and a social security number (each a free-text field the employer may fill or leave empty), emergency contact name, phone number and relationship, bank name, routing code and bank account number, annual pay, present and permanent home addresses, personal email address and mobile number, dependants with their names, relationship and dates of birth, education and work history, an “about me” text, uploaded documents such as contracts or copies of right-to-work documents, performance reviews, training records, company assets issued to the employee, resignation or separation requests with exit-interview answers, and day-to-day attendance, shift, leave and timesheet records. Worklink has no dedicated right-to-work field or document type: such a copy is an ordinary uploaded document.

Every workspace that uses Worklink is set up with a “Sick Leave” leave type, and every leave request needs a reason typed as free text, so an employee or manager can end up writing details of an illness there. A leave request can also carry a supporting document, such as a doctor’s note, if the employee or employer attaches one. Details of an illness are health data.

There is no dedicated field for a national insurance or social security number: such a number goes into one of the free-text identification, tax or social security fields. Those fields are stored, and returned by our programming interface, in plain text to anyone the employer has given access to employee records: there is no separate restriction on them. Detail screens show only the last four characters; the edit form shows the full number.

For every working day, a Worklink attendance record holds:

• the check-in and check-out times, and the hours, breaks and overtime calculated from them;
• whether the employee arrived late or left early, by how many minutes, and any reason the employee gave for being late;
• how the check-in was made (in the web app, from the header, by an administrator, automatically, through a personal link or on a wall-mounted kiosk tablet using the employee’s personal kiosk code), and which kiosk tablet, if one was used;
• the IP address of the check-in and of the check-out.

Worklink also shows each employee’s live presence status (whether they are checked in and when they were last active) to users with access, and it marks employees as absent automatically each day when no check-in is recorded, for the employer to review. The personal check-in link works without signing in.

Worklink uses no biometrics: no fingerprints and no facial recognition. It does not record location coordinates or photographs at check-in; the only image it holds is an optional profile picture. The IP address is stored on every check-in and check-out; there is currently no setting to turn that off.

If you are an employer

You are the Data Fiduciary for your employees’ records, and Indian employment and data protection law decides what you may record and for how long. Some points matter in India in particular, and SorviAI does not handle them for you today:

• Aadhaar. The Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act 2016 limits who may collect, store and display Aadhaar numbers. Worklink has no masked Aadhaar field, and its free-text identification fields show the full number on the edit form. Do not store Aadhaar numbers in SorviAI.
• PAN and bank details. These are financial information, which the 2011 rules on sensitive personal data protect. In Worklink they are visible to every user you give access to employee records; there is no payroll-only restriction. Grant that access narrowly.
• Sick leave. The reason field is free text and can end up holding details of an illness, which is sensitive personal data. Ask your staff not to write a diagnosis there.
• Registers. Indian labour law and state rules set which attendance and wage registers you keep, in what form and for how long. Worklink does not produce them in a statutory format.

Our Data Processing Agreement sets out what we do for you as your processor.

Visitors at a business’s front desk

A business using Worklink’s visitor desk can record each visitor’s name, phone number, email address, company, purpose of visit, the person they are visiting, badge, notes, check-in and check-out times and the office they visited. It can also record the type and number of an identity document the visitor shows, such as a passport or residence permit number. The document number is masked in responses from our programming interface. The business is the controller of these records.

Mailbox content

Where a customer connects a Microsoft 365 mailbox to the TeamEmail module, we sync and store message content, subject lines, sender and recipient addresses, attachments and threading metadata so that the customer’s team can work on those conversations inside SorviAI. Access is granted by the customer’s own administrator through Microsoft’s consent process and can be revoked by them at any time, which stops any further sync.

Emails a workspace sends

When a workspace sends a document by email from SorviAI, such as an invoice or a quote, we keep a send log: the sender, the recipients, the subject, the full rendered message, the time it was sent and whether it was delivered. Document emails are sent through Twilio SendGrid with open and click tracking switched on by default: each carries a tracking pixel, and its links are rewritten to pass through SendGrid. SendGrid records on its own systems when a message is opened and when a link is clicked. Our send log has fields for open and click times, but nothing fills them today, so those results do not reach SorviAI. Customer portal emails and workspace invitations are sent without tracking.

Service and repair tickets

Details of reported faults, the device or item concerned, and whatever the person reporting the issue chose to write, along with the contact details needed to keep them updated. The business’s staff can add comments to a ticket; those comments are internal to the business, and the person who reported the fault does not see the ticket or its comments in SorviAI.

Files and attachments

Any document, image or other file that a user uploads to their workspace, including files stored in Nest.

Files shared through a public link

A business using Nest can share a file with someone outside the business by creating a public link. Public links are allowed unless a workspace administrator switches them off. The person creating a link can protect it with a password, set it to expire, make it view-only, and revoke it at any time.

If you open a file through one of these links, we record each view, each download and each failed password attempt, with the time, the IP address the request came from and your browser’s user-agent string. The purpose is to let the business see how its link has been used and to detect abuse of the link, such as someone guessing its password. The business that created the link is the controller of this record and can see it; we keep it as its processor, until the link or the file is deleted. Revoking a link does not delete it.

We use information only for a stated purpose. The table below sets out each purpose and why we may use the information for it.

Today. Until 13 May 2027, the Information Technology Act 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011 (the SPDI Rules) apply. They protect sensitive personal data in particular. The main such data we hold about you as controller is your password, which you set to create your account and which we keep only in hashed form; we do not hold your card details, as explained above. We disclose personal information only with your consent, where our contract with you or your organisation needs it, or where the law requires it.

From 13 May 2027. The Digital Personal Data Protection Act 2023 applies. Indian law has no general “legitimate interests” ground. We will process your personal data either with your consent, given after a clear notice of what we collect and why, or for a legitimate use the Act lists in section 7, such as information you gave us voluntarily for a specified purpose, or meeting an obligation under law or a court order.

Using information for a new purpose. We use information only for the purpose we collected it for. We will tell you, and ask for your consent where the law requires it, before we use your information for anything else.

We do not sell personal information, we do not use it for targeted advertising, and we do not disclose it to third parties for their own marketing.

We use a small number of cookies and similar browser storage to make SorviAI work, and two optional categories, affiliate and analytics, that run only with your consent. A consent banner asks on your first visit to our website or the SorviAI app, and “Cookie settings”, in the website footer and the app’s user menu, lets you change your answer at any time. There are four categories.

• Strictly necessary. These keep you signed in, maintain your session, route you to the correct workspace and protect against cross-site request forgery. Our network provider, Cloudflare, also sets a cookie named __cf_bm on our website and on workspace addresses to tell people from automated traffic; it expires after 30 minutes of inactivity, and a cookie named sorvi_consent records your answer in the consent banner, with a random consent ID that links it to the record of that answer we keep on our servers. The service cannot function without these, so they are set without asking for consent.
• Preferences. These remember choices such as your light or dark theme setting and your layout preferences, and on our public website the country you picked and the conversation you opened with our assistant. They are written only after you act, and exist purely to make things behave the way you left them. Storage that only remembers a choice you made is part of the service you asked for, so we do not ask for consent to it.
• Affiliate. If a partner’s link brought you to our website and you allow affiliate tracking, we keep the Tradedoubler click reference in a cookie named sorvi_tduid for 90 days, and Tradedoubler’s own script sets its tduid cookie and some local storage. Nothing is stored before you agree, and withdrawing deletes it. How the reference is used is explained under who we share information with.
• Analytics and diagnostics. Both run only if you allow analytics. On our public website, Google Analytics counts visits and the pages read, using the _ga and _ga_2L8QNHVNBH cookies, which last up to two years; switching analytics off deletes them. In the SorviAI app, Sentry Session Replay is a screen recording used to debug faults, described under error monitoring above. It masks form inputs but not on-screen text or images, and writes sentryReplaySession to session storage.

We show no adverts and set no advertising cookies, on the platform or on our public website. Google Analytics is used for audience measurement only, with its advertising features switched off, and session replay is a debugging recording, not simple statistics. Document emails that workspaces send are tracked by default, as described under emails a workspace sends; our newsletter carries no open tracking.

The SorviAI app currently loads its typefaces from Google Fonts, and loads the component that displays PDF previews, flag images, emoji images and the animation player from the jsDelivr content network, with unpkg as a fallback for the animation player. Opening the app, or the screen that needs one of these, sends your IP address and browser details to those providers. When you preview a Word, Excel or PowerPoint attachment, the app hands a signed, time-limited link to the file to the Google Docs Viewer (docs.google.com), which fetches the file to display it. None of these sets a cookie through our app.

Our Cookie Policy lists every cookie we set with its purpose and expiry, describes the browser storage we use, and explains how to clear or block it.

We do not sell your information. We share it only with the suppliers listed below, who process it on our instructions, with our affiliate network if you allow affiliate tracking, with Google if you allow analytics on our website, and in the limited legal circumstances set out at the end of this section.

Our sub-processors

SorviAI does not currently use an AI provider; if one is added it will be listed as a sub-processor.

Services a customer chooses to connect

These providers are not our sub-processors. A customer switches each one on for its own workspace, and the data they receive is sent at that customer’s direction and under that provider’s own terms.

Our affiliate network

Partners can earn commission for referring customers to SorviAI through Tradedoubler, our affiliate network. If you arrive through a partner’s link and allow affiliate tracking, Tradedoubler’s script on our website receives your IP address and browser details and sets the cookie and storage our Cookie Policy lists. When you create a workspace, we keep the click reference with it. When that workspace’s first paid subscription is completed, our servers send Tradedoubler the click reference, the subscription number as the order number, and the first payment amount, excluding tax, with its currency, so the partner can be paid. We do not send your name, email address or payment card details, and later payments are not reported.

Withdrawing consent through “Cookie settings” deletes the cookies and storage in your browser. It does not reach a click reference already stored with a workspace; if you want that removed, write to us at [email protected].

Analytics on our website

We use Google Analytics to measure how many people visit our public website and which pages they read. It does not run in the SorviAI app. Its script loads from Google only after you allow analytics in the consent banner, and then sends Google the details listed under website information, linked to the random ID in its _ga cookie. Google states that Google Analytics does not log or store IP addresses. We use it for audience measurement alone: its advertising features are always switched off, Google Signals is not enabled, and we do no remarketing. Event-level data is kept for 14 months; the aggregated reports built from it are not subject to that limit. Google processes this data in the United States (Google LLC).

Withdrawing consent through “Cookie settings” tells Google Analytics that consent is withdrawn, disables it and deletes its cookies from your browser.

Changes to our suppliers

We review these lists when our suppliers change. If we add or replace a supplier that processes customer content, we will announce it on the Compliance page, which holds the maintained list, and email workspace account owners at least 30 days in advance, and a customer who objects may raise it with us under the Data Processing Agreement. There is no separate subscription for these notices.

Other disclosures

We may also disclose information where we are legally required to, for example in response to a valid court order or a lawful request from a regulator or law enforcement. In India that includes a lawful order under sections 69, 69B or 79 of the Information Technology Act 2000, a written order under the IT Rules (which we answer within 72 hours), a direction from CERT-In, and, from 13 May 2027, a request under section 36 of the Digital Personal Data Protection Act 2023. As a company registered in England and Wales, we also receive requests under the law of the United Kingdom. We disclose only what we are compelled to disclose, and where we are permitted to tell you or the customer concerned, we will. Our Abuse Policy describes how we handle these requests. If our business is sold or reorganised, information may transfer to the acquiring entity, which would remain bound by this policy or a materially equivalent one.

The SorviAI application and its database run on DigitalOcean in its London region, behind Cloudflare’s network, and uploaded files are stored in DigitalOcean’s London region. Each customer’s data is held in a separate database schema, which is explained further under how we protect information. Workspaces set up for India are on the same infrastructure as everyone else, unless we have agreed something different with the customer in writing.

Data held outside India

Using SorviAI from India means your information is transferred out of India and stored in the United Kingdom, because that is where the service runs. No copy is held in India today. A backup in India is planned, but it is not in place and has no date yet. Some of the suppliers named above operate in the European Union, Switzerland and the United States, as the table shows.

• Today. The SPDI Rules allow sensitive personal data to go to another organisation, in India or abroad, only where it gives the same level of protection and the transfer is needed under a lawful contract or you have consented (rule 7). Our contracts with our suppliers bind them to protect the data they receive.
• From 13 May 2027. Under section 16 of the Digital Personal Data Protection Act 2023, personal data may go to any country unless the Indian government restricts that country by notification. No country is restricted today. If one of our suppliers is affected, we will tell workspace owners and act on it.
• Access by our team in India. Some of our employees work in India and reach customer data from there to run and support the service. They are employed by SORVI AI LTD, so their access is access by the same company, not a transfer to another organisation, and the data stays on our systems in London under this policy.

If your workspace holds personal data from the European Union, the GDPR rules on international transfers apply to it; our DPDP and GDPR Compliance page explains how. You can ask us for a copy of the terms that apply to a supplier by writing to the address in how to contact us.

We keep information only as long as we need it for the purposes set out under how we use information, or as long as the law requires. Where nothing deletes something automatically, the row says so.

Information we have deleted can remain in a backup copy until that copy is overwritten in the seven-day rotation. We do not separate it out in the meantime, and we do not use backups for anything other than recovering from a failure.

No system is perfectly secure, but these are the specific measures we take, and the limits we know about.

• Separation between customers. Every customer’s data lives in its own database schema, not in shared tables filtered by a column. Separation is enforced by the database itself, so a fault in application code cannot leak one customer’s records into another’s workspace.
• Encryption. Traffic between your browser and our servers is encrypted in transit. At rest, DigitalOcean encrypts the database volumes (LUKS, AES-XTS with 512-bit keys) and its database backups (AES-256), and states that files in its object storage are encrypted at rest.
• Private file access. Uploaded files are private by default and are served through signed links that expire, so a copied link does not grant lasting access. Files that a customer deliberately publishes, such as company logos and storefront product images, are served from public addresses that do not expire.
• Two-factor authentication. Every user can switch it on for their own account, with recovery codes. The secret used to verify your codes is stored encrypted, and each code can only be used once. Workspace administrators cannot yet require it of their users, it is not offered to Portal users, and hardware security keys and single sign-on are not supported.
• Short-lived sessions. Access tokens expire after 60 minutes and must be renewed.
• Role-based access control. Workspace administrators grant permissions per application, so a user only reaches the modules and records their role allows.
• Audit logging. Many actions are recorded with the account, timestamp, IP address and browser, so unusual activity can be traced. Coverage is incomplete: Repairs records only deletions, only a few settings screens write audit records, sign-ins through the public login, workspace selection and sign-in link exchange write no audit entry, and failed sign-ins are not logged with the account and IP address. The audit log is not yet tamper-evident, and an audit entry is not written in the same database transaction as the change it records, so a failed write can lose the entry.
• Staff access. When a member of our support staff opens a workspace as a customer’s user, which a senior engineer must approve and which is done only to resolve a support request, investigate a credible abuse report or meet a legal duty, the start of that session is recorded in the same transaction as the access, in our own platform audit log rather than the customer’s, and a banner shows in the customer’s interface. The individual actions taken during that session are not separately logged. Our director and one or two senior engineers can also connect to production databases directly; that list is reviewed every quarter, and those connections leave no audit record.
• If a breach happens. Where a personal data breach affects a customer’s data, we will tell that customer’s workspace administrators within 48 hours of confirming it, so that they can meet their own duties: from 13 May 2027 the DPDP Rules 2025 ask a Data Fiduciary to tell the Data Protection Board and each person affected without delay. Separately, we report a cyber security incident of the kinds CERT-In lists to CERT-In within 6 hours of noticing it. Where a breach affects information we control, we tell you directly, and from 13 May 2027 we also notify the Data Protection Board as those rules require.

Our Security page describes each measure in more detail, and the same statements form the security annex of our Data Processing Agreement, so we list only what is true today.

We give you the rights below, whether or not Indian law requires them yet. The section on which law applies sets out what Indian law gives you, today and from 13 May 2027.

• Access. Ask for a copy of the personal information we hold about you.
• Correction. Ask us to correct, complete or update anything inaccurate or incomplete.
• Erasure. Ask us to delete your information, where we have no continuing lawful reason to keep it.
• Restriction. Ask us to pause our use of your information while a concern is resolved.
• Portability. Ask for the information you gave us in a structured, commonly used, machine-readable format.
• Objection. Object at any time to direct marketing, and tell us if you object to any other use of your information.
• Withdraw consent. Where we rely on consent, withdraw it at any time, as easily as you gave it. This does not affect anything we did before you withdrew it.
• Nominate someone. From 13 May 2027, name another person to exercise your rights if you die or become unable to.
• Complain. Raise a grievance with our Grievance Officer, as complaints explains.
• No penalty for asking. We will not deny you service, charge you a different price or give you a worse experience because you exercised a right.

To exercise any of these, write to [email protected]. We handle each request by hand: there is no self-service tool that gathers everything we hold about one person, so a member of our team searches each system and assembles the answer. We will respond within one month of receiving your request. We do not charge a fee.

We may need to verify your identity before acting, to make sure we are not disclosing your information to someone else. Writing from the email address on your account is usually enough, and we ask only for what we need. When you ask for a copy of your information, we carry out a reasonable and proportionate search for it, and every reply names the person you can contact about it.

If your information is in a workspace run by your employer or another organisation, that organisation is the controller: send your request to them, and we will help them answer it.

Indian data protection law is changing in phases. This policy is written to meet both the law that applies today and the law that applies from 13 May 2027. Where Indian law gives you more than this policy, the law prevails.

If personal data from the European Union is held in a workspace, the GDPR may also apply to it. Our DPDP and GDPR Compliance page explains both.

Browser privacy signals

Our website and the SorviAI app do not currently read Do Not Track or Global Privacy Control signals from your browser. We do not sell personal information, and we run no advertising tracking, so there is nothing of that kind for such a signal to switch off. Google Analytics on our website and Session Replay, described under error monitoring, run only if you allow analytics in the consent banner; a browser signal does not give or refuse that answer for you.

Language

This policy is published in English. You can write to us in any language, and we answer in English.

SorviAI does not currently use an AI provider; if one is added it will be listed as a sub-processor. SorviAI generates no synthetic images, audio or video.

We do not make decisions about you based solely on automated processing that produce legal effects or otherwise significantly affect you. One automated step exists: Worklink marks an employee as absent each day when no check-in is recorded. The employer reviews and can correct that record, and it is not a decision about the employee on its own.

SorviAI is business software sold to organisations. It is not directed at children and we do not knowingly collect information from anyone under 18, the age the Digital Personal Data Protection Act 2023 treats as a child. We do not track or monitor the behaviour of anyone for advertising, or target advertising at anyone, children included.

A storefront is run by our customer. If a storefront is likely to be used by children, the business running it is responsible for following Indian law on children’s data, including verifiable parental consent from 13 May 2027.

If you believe a child has provided us with personal information, contact us at [email protected] and we will delete it.

We update this policy when the way we handle information changes. The effective date and version at the top always tell you which version you are reading.

If a change materially affects your rights or how we use your information, we will give workspace owners at least 30 days notice by email before the change takes effect. Minor corrections take effect when published. Version 1.3 adds Google Analytics on our website, which runs only if you allow analytics. It replaces version 1.2, effective 7 October 2026, which added the record we keep of your answers in the cookie consent banner and the automatic deletion of contact form attachments after 30 days. Version 1.1, effective 5 October 2026, added the consent banner and affiliate attribution through Tradedoubler and put Session Replay behind your consent. Every later version will be published here with its date, and earlier versions will be kept at this address.

For anything about this policy or your personal information, contact us using the details below. One address reaches us for everything, and we answer in English. We acknowledge every privacy enquiry within 2 working days, and a grievance within 24 hours, and answer fully within one month.

Who is responsible for data protection

If you are unhappy with how we have handled your personal information, complain to our Grievance Officer, Deepak Gupta, by emailing [email protected] or using the form on our contact page. We acknowledge your complaint within 24 hours, weekends included, look into it, and answer within one month, telling you what we have done and what happens next. The Grievance Officer’s full details are on our Legal Notice and Grievance Officer page.

From 13 May 2027, if you are not satisfied with our answer, you can complain to the Data Protection Board of India; the Act asks you to come to us first. If your complaint is about content we host rather than your own personal information, you can also appeal against the Grievance Officer’s decision to the Grievance Appellate Committee at gac.gov.in within 30 days.

The words in this policy that carry a specific legal meaning, in plain language.