Privacy PolicyPrivacy Policy

Covaratech (“Covaratech”, “we”, “us”, “our”) respects your privacy and is committed to protecting the personal data you share with us. This Privacy Policy (“Policy”) explains what personal data we collect through https://covaratech.com (the “Website”), why we collect it, how we use, store, and protect it, and the rights available to you as a data principal under the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and other applicable Indian law.

1. Introduction

This Policy should be read together with our Terms of Use. Where the Website links to or embeds third-party services, this Policy does not apply to personal data processed by those third parties, which is instead governed by their own privacy policies.

By using the Website or submitting personal data to us, you consent to the collection, use, and disclosure of your personal data in accordance with this Policy, to the extent such consent is required under applicable law.

2. Scope of this Policy

This Policy applies to personal data we collect through the Website, including when you browse the Website, submit an enquiry or request a consultation, subscribe to updates, or otherwise interact with us through the Website. It does not apply to information collected offline, or to any data processed under a separate signed client agreement, which is instead governed by the terms of that agreement.

For the purposes of this Policy, “personal data” means any data about an individual who is identifiable by or in relation to such data, as defined under the DPDP Act.

3. Personal data we collect

We may collect the following categories of personal data:

• contact and identity information you provide, such as your name, business email address, phone number, job title, and company name, when you submit a form or book a consultation;
• information about your enquiry, including the content of any message, project details, or documents you choose to share with us;
• if you chat with Julie, our AI assistant, the messages you send and any information you choose to share during that conversation (see Clause 5);
• technical and usage information collected automatically when you browse the Website, such as your IP address, browser type, device information, pages visited, referring URLs, and on-page interaction data (such as clicks, scrolling, and mouse movement, which may be captured as a pseudonymised session recording), typically through cookies and similar technologies (see Clause 5); and
• any other personal data you voluntarily provide to us, such as through email correspondence or a scheduled call.

We do not knowingly seek sensitive categories of personal data (such as financial information, health data, or government identifiers) through the Website, and ask that you not include such information in any form submission unless specifically requested.

4. How we use your personal data

We process personal data for the following purposes, on the basis of your consent or as otherwise permitted under the DPDP Act:

• to respond to your enquiries and provide the information or consultation you have requested;
• to provide automated responses to your questions and support website marketing conversations through Julie, our AI assistant;
• to operate, maintain, and improve the Website;
• to communicate with you about our Services, including updates you have opted in to receive;
• to comply with our legal obligations, and to establish, exercise, or defend legal claims; and
• for internal analytics, to understand how the Website is used and to improve its content and functionality.

We do not use personal data collected through the Website for any purpose incompatible with the purposes above without seeking your fresh consent, except where permitted or required by applicable law.

5. Julie (our AI assistant) and similar technologies

The Website features Julie, an AI-powered assistant that answers client questions and supports website marketing conversations. When you chat with Julie, we collect the content of your messages and any information you choose to share, which is processed in order to generate a response.You are always interacting with an automated system, not a Covaratech employee, when you chat with Julie.

We retain chat transcripts from your conversations with Julie in order to respond to your enquiry, improve Julie’s responses, and for our internal records, consistent with the general retention principles described in Clause 8. We may review transcripts internally for these purposes. We do not use your conversations with Julie to train any AI model.

Beyond Julie, the Website uses four third-party analytics tools:

• Simple Analytics, a privacy-friendly tool that measures aggregate page views without setting cookies, without tracking you across sites, and without collecting personal data;
• Microsoft Clarity, a product-analytics tool operated by Microsoft that helps us understand how the Website is used through usage metrics, heatmaps, and session replays of on-site interactions (such as pages viewed, clicks, scrolling, and mouse movement). Clarity sets cookies and may record a pseudonymised playback of your visit; it automatically masks text you type into form fields. Data collected through Clarity is processed by Microsoft, including on servers outside India, under the Microsoft Privacy Statement; and
• PostHog, a product-analytics tool that records page views, on-site interactions, and session replays (pseudonymised recordings of pages viewed, clicks, scrolling, and mouse movement) so we can understand how the Website is used. PostHog sets cookies and local storage identifiers on your device. Data collected through PostHog is processed by PostHog Inc. under its Privacy Policy; and
• Google Analytics, a web-analytics tool operated by Google that measures page views, traffic sources, and on-site interactions (such as pages viewed, scrolling, outbound link clicks, and approximate location derived from your IP address) so we can understand how visitors find and use the Website. Google Analytics sets cookies on your device. Data collected through Google Analytics is processed by Google, including on servers outside India, under the Google Privacy Policy; you can learn more about how Google uses this data at How Google uses information from sites that use its services.

All four tools load by default when you visit the Website. You can opt out at any time by selecting “Reject” in the cookie banner (also reachable through “Cookie settings” in the Website footer); when you do, the Website reloads and none of them are loaded again on that browser unless you change your choice. We run no advertising or cross-site tracking tools (such as Google Analytics advertising features, Google signals, or the Meta Pixel), and aside from these tools the only data collected automatically is standard hosting and server access logs. If our analytics tools change, this clause will be updated to name the new tool and link to its own privacy policy. The Website may also use essential cookies required for it to function correctly; you can control or disable cookies through your browser settings, which may affect certain features of the Website, including Julie.

6. Disclosure of personal data

We do not sell personal data. We may share personal data with:

• service providers who process data on our behalf, such as cloud hosting, email, and scheduling providers, our analytics providers (including Microsoft, which operates Microsoft Clarity, PostHog Inc., which operates PostHog, and Google, which operates Google Analytics, see Clause 5), and the AI provider that powers Julie, under contractual obligations to protect it;
• professional advisors, such as legal or accounting counsel, where necessary;
• government authorities or regulators, where required by applicable law or a valid legal process; and
• a successor entity, in the event of a merger, acquisition, or sale of assets, subject to that entity being bound by materially similar privacy commitments.

Any third party with whom we share personal data is permitted to use it only for the purpose for which it was shared, and is contractually or otherwise required to implement reasonable security safeguards.

7. Cross-border data transfers

Personal data collected through the Website may be stored or processed on servers located outside India, including where our cloud service providers operate infrastructure abroad. Where we transfer personal data outside India, we take reasonable steps to ensure it continues to be protected in a manner consistent with this Policy and applicable law, unless the Central Government restricts transfer to a particular country or territory under the DPDP Act.

8. Data retention and security

We retain personal data only for as long as necessary to fulfil the purposes described in this Policy, or as required by applicable law, after which it is deleted or anonymised. We implement reasonable technical and organisational security safeguards, including access controls and encryption where appropriate, to protect personal data against unauthorised access, disclosure, alteration, or destruction. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Your rights

Subject to applicable law, you have the right to:

• request a summary of the personal data we hold about you and the processing activities undertaken with respect to such data;
• correction and updating of inaccurate or incomplete personal data;
• erasure of personal data that is no longer necessary for the purpose for which it was collected, unless retention is required by law;
• grievance redressal in respect of any act or omission by Covaratech regarding compliance with the DPDP Act;
• nominate another individual to exercise these rights on your behalf in the event of your death or incapacity; and
• withdraw consent at any time, as described in Clause 4, without affecting the lawfulness of processing carried out before such withdrawal.

To exercise any of these rights, please write to us using the contact details in Clause 12. We will respond to verified requests within the timelines prescribed under applicable law.

10. Children’s privacy

The Website is intended for business and professional audiences and is not directed at, and does not knowingly collect personal data from, individuals below the age of eighteen (18) years. If we become aware that we have inadvertently collected personal data from a child without verifiable parental or guardian consent, we will take steps to delete such data promptly.

11. Data breach notification

In the event of a personal data breach that affects your personal data, we will take prompt remedial action and notify the Data Protection Board of India and affected individuals in the manner and within the timelines prescribed under the DPDP Act and rules made thereunder.

12. Grievance Officer / contact us

If you have any questions, concerns, or complaints about this Policy or about how your personal data is handled, or if you wish to exercise any of the rights described in Clause 9, please contact our Grievance Officer:

Name: Julie
Email: [email protected]
Business hours: Mon-Fri, 09:00-18:00, across your team’s time zone

Complaints will be acknowledged promptly and addressed within the time period prescribed under applicable law. You also have the right to file a complaint with the Data Protection Board of India in accordance with the DPDP Act.

13. Changes to this Policy

We may update this Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. Any changes will be posted on this page with a revised “Last updated” date. Where changes are material, we will take reasonable steps to notify you, such as through a notice on the Website. Your continued use of the Website after such changes constitutes your acceptance of the revised Policy.