Legal
Privacy notice
What we collect, why, how long we keep it, and how to stop us.
The short version
- Our websites set no cookies and use no analytics, advertising pixels or trackers.
- We collect personal data only when you contact us, fill in a form, become a client, or when we find a business contact address that a business has published so that people can contact it.
- We use it to reply, to provide our services, to run our business and, for businesses, to tell them about our services. We do not sell personal data and do not share it with advertisers.
- You can ask to see, correct or delete your data, and you can stop our emails at any time with one click or a reply.
What this notice covers
This notice covers autonomicsai.in, services.autonomicsai.in, the forms on both sites, email you exchange with us, business-to-business emails we send to businesses that have not contacted us first ("outreach"), and the business contact details of our clients' staff.
It does not cover personal data we process on behalf of a client as its processor, such as the details of a client's own customers in a quote form we built. The client is responsible for that data, under a data processing agreement with us. If you are a client's customer, please read that client's privacy notice and contact the client first.
What we collect and where it comes from
When you visit either website
Our host, Cloudflare, processes technical data needed to deliver pages and protect the sites from abuse: IP address, browser and device type, the pages requested and the time. We do not use it to identify you or build a profile.
Contact form on autonomicsai.in
Your name, email address and message. The email that delivers your message to us also includes your IP address, approximate country and browser type, which we use only to spot abuse. A counter linked to your IP address is kept for up to one hour to limit spam, then deleted automatically.
Audit and contact forms on services.autonomicsai.in
The details you enter, such as your name, business name, email address, phone number (if you give it), website, type of business and message. Each submission is stored in a Cloudflare database (Workers KV) and copied to our inbox. For spam protection we keep a counter linked to a one-way coded (hashed) version of your IP address for up to two hours. Submissions that fail our automated spam checks are kept for 30 days so that a real enquiry is not lost, then deleted.
Email and other messages
What you choose to send us, including your name, contact details, signature details, message content and attachments.
Outreach to businesses
For businesses that might benefit from our services we record: the business name, website, category, city and country; a business email address the business has published on its own website (we prefer general addresses such as info@ and generally skip addresses that name a person); the page where we found it; and the date. Business details may come from OpenStreetMap (© OpenStreetMap contributors). We do not buy email lists, and we do not use addresses from pages that ask not to receive unsolicited email. If you unsubscribe, we keep your address, or a coded token linked to it, on a suppression list so that we never email it again.
Clients
Names, job titles, business emails and phone numbers of the people we work with; contracts; invoices and payment records (we do not see or store full card numbers); and project communications.
Job applicants
The information in your application and our notes on it.
Please do not send us sensitive personal data, such as health data or government identity numbers, unless we ask for it for a contract.
Why we use it, and our legal basis
| Purpose | UK/EU GDPR basis | DPDP Act basis |
|---|---|---|
| Deliver and secure our websites | Legitimate interests (Art. 6(1)(f)) | Legitimate use (s. 7(a)); security safeguards |
| Reply to enquiries, prepare audits and proposals | Steps at your request before a contract (Art. 6(1)(b)), or legitimate interests | Voluntarily provided for a specified purpose (s. 7(a)), or consent |
| Business-to-business outreach and follow-ups | Legitimate interests (Art. 6(1)(f)); you can object at any time | See "Outreach and the DPDP Act" below |
| Keep a suppression list | Legal obligation and legitimate interests | Compliance with law (s. 7) |
| Provide services and manage the client relationship | Contract (Art. 6(1)(b)); legitimate interests for client staff | Voluntarily provided (s. 7(a)) |
| Invoicing, accounting, tax and foreign-exchange records | Legal obligation (Art. 6(1)(c)) | Compliance with law (s. 7) |
| Assess job applications | Steps before a contract; legitimate interests | Voluntarily provided (s. 7(a)) |
| Establish, exercise or defend legal claims | Legitimate interests | Exempt where necessary (s. 17(1)(a)) |
Legitimate interests. We have weighed our interests against yours. For outreach we contact only business addresses published for business contact, keep messages relevant, identify ourselves and make opting out easy. You can ask for a copy of our assessment.
Outreach and the DPDP Act. Most of our outreach goes to businesses outside India. The DPDP Act does not apply to personal data that the person concerned has made publicly available themselves. Where it does apply, we rely on consent or a legitimate use the Act permits, give this notice, and stop on request.
Consent. Where we rely on consent, you can withdraw it at any time by emailing [email protected]. This does not affect earlier processing.
AI and automated decisions. We do not make decisions about you with legal or similarly significant effects based only on automated processing. We use AI tools on business accounts to help draft and summarise, and a person reviews the result. Those accounts do not allow your data to be used to train anyone's models. See our AI policy.
Who we share it with
- Cloudflare, Inc.: hosting, security, the services-site forms database and email routing (global network, including the USA).
- Google LLC (Google Workspace): business email and documents (USA and other countries).
- Other software tools we use on business accounts that do not train on our data; payment processors that receive client payments; and our accountants. The current list is available on request.
- Professional advisers under duties of confidentiality; authorities where the law requires it; and a buyer or successor of our business, under equivalent protections.
We do not sell personal data, rent it, or share it for cross-context behavioural advertising.
International transfers
We are based in India, so if you are outside India your data will be processed in India, and our providers may process it in the USA and elsewhere. When you send UK or EU personal data to us, we apply the UK GDPR or EU GDPR to it. When we pass it to a provider in a country without an adequacy decision, we rely on the provider's safeguards: the European Commission's Standard Contractual Clauses, the UK International Data Transfer Agreement or Addendum, or the EU-US Data Privacy Framework (and its UK extension) where the provider is certified. We transfer personal data out of India only as the DPDP Act permits.
Your rights
Stopping our emails. Click the unsubscribe link in any email or reply "unsubscribe". We act on it straight away and in any case within 10 business days, free of charge. Your right to object to direct marketing is absolute: we will stop.
UK and EU. You can access your data, have it corrected or erased, restrict its use, receive it in a portable format, object to processing based on legitimate interests, withdraw consent, and complain to a supervisory authority (in the UK, the Information Commissioner's Office at ico.org.uk; in the EU, the authority in your country). We reply within one month, extendable by two months for complex requests.
India. Under the DPDP Act you can ask for a summary of the personal data we process and who we have shared it with; have it corrected, completed, updated or erased; have a grievance addressed; and nominate someone to exercise your rights if you die or become unable to. Once the relevant DPDP Rules apply we will resolve grievances within the time they set (currently 90 days at most). If you are not satisfied, you can complain to the Data Protection Board of India after using our grievance process.
Complaints to us. We acknowledge complaints within 30 days and tell you the outcome without undue delay.
To make a request, email [email protected]. We may need to confirm your identity, and we will ask only for what we need.
United States
CAN-SPAM. Our commercial emails identify us, use accurate headers and honest subject lines, include our postal address, and contain a working opt-out that we honour within 10 business days.
California. The California Consumer Privacy Act applies to businesses above thresholds set by the Act, such as annual gross revenue above US$26,625,000 (as adjusted from 1 January 2025). We are currently below them, so we believe the Act does not yet apply to us. We nevertheless do not sell or share personal information, do not use sensitive personal information, and will respond to requests to know, correct or delete it. Other US state privacy laws have similar thresholds, and the same commitments apply.
How long we keep it
| Data | Retention |
|---|---|
| Main-site form spam counter | Up to 1 hour |
| Services-site rate-limit counter (hashed IP) | Up to 2 hours |
| Submissions held by spam checks | 30 days |
| Services-site form submissions | Deleted automatically after 12 months, unless they become client records |
| Enquiries and correspondence that do not lead to a contract | Up to 24 months after the last exchange |
| Outreach records | Up to 24 months after the last contact, or sooner on request |
| Suppression list | For as long as we send outreach, keeping only the address or a coded token |
| Client contracts, invoices, payment and export records | As Indian tax, accounting and foreign-exchange law requires (generally 8 years) |
| Job applications | Up to 12 months, unless you join us or ask us to delete them sooner |
| Data needed for a legal claim | Until the claim is finally resolved |
When a period ends we delete the data or make it anonymous. Where the DPDP Rules require certain logs or data to be kept for a minimum period, we keep them for that period.
Security
We use encrypted connections (HTTPS), limit access to people who need it, use multi-factor authentication on accounts that hold personal data, store credentials securely, hash IP addresses used for rate limiting, and keep data only as long as stated above. No system is perfectly secure. If a personal data breach occurs, we will notify affected people and the relevant authorities as the law requires, including the Data Protection Board of India and, where it applies, the ICO or an EU authority within 72 hours of becoming aware of a reportable breach.
UK and EU representative
Because we are based outside the UK and EU, we may need to appoint a representative there. Until one is named on this page, contact us directly.
Children
Our websites and services are for businesses and adults. They are not directed at anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has sent us personal data, contact us and we will delete it.
Grievance Officer and contact
Sean Paul, Founder and Grievance Officer, AutonomicsAI LLP. Email [email protected], phone +91 88613 65188, or write to the registered office above.
Changes to this notice
We update this notice when our practices change and change the date at the top. Significant changes will be highlighted on our websites and, where we have your email address and the change affects you, sent to you before they apply.