Privacy Policy

Avaril Technologies Pvt. Ltd. (“Avaril”, “we”, “us”, or “our”) operates a compliance platform that helps businesses generate, manage, and publish privacy documentation and consent flows under India's Digital Personal Data Protection Act, 2023 (“DPDPA”). This Privacy Policy explains what personal data we collect through our website and platform, why we collect it, how we use and protect it, and the choices and rights available to you as a Data Principal.

This Policy applies to visitors of our website, users of our platform (“Customers” or their authorized users), and individuals whose data our Customers process using Avaril (“End Users”). Where Avaril processes personal data on behalf of a Customer as a Data Processor, that Customer's own privacy notice — not this Policy — governs that processing, and this Policy instead describes Avaril's obligations as a processor.

We collect the following categories of personal data:

• Account and identity data: name, work email address, phone number, organization name, and role, collected at sign-up or via Google OAuth.
• Billing data: billing address and payment metadata processed through our payment partner (Razorpay); we do not store full card or bank details ourselves.
• Platform content: business descriptions, data-asset inventories, processing-activity records, and policy drafts that you or your organization input into Avaril to generate compliance documentation.
• Usage and device data: IP address, browser type, pages visited, timestamps, and similar diagnostic data collected automatically via cookies and server logs.
• Communications: messages you send us for support, along with any attachments or information you choose to share in them.

We process personal data only for specified, lawful purposes, including to:

• Create and administer your account, and authenticate sign-ins.
• Provide the core platform functionality you request — generating privacy policies, consent artifacts, and retention rules.
• Process payments and manage subscriptions.
• Send service-related communications, including security alerts and, where you have opted in, product updates.
• Monitor, secure, and improve the reliability of our platform.
• Comply with applicable legal obligations, including under the DPDPA and tax or accounting law.

We do not sell personal data, and we do not use platform content you upload to train third-party models beyond what is strictly necessary to generate the output you requested.

We process personal data on the basis of your consent, given at account creation or through in-product consent flows, and — where applicable under the DPDPA's “legitimate uses” provisions — for purposes such as fulfilling a contract with you, complying with a legal obligation, or responding to a medical emergency. You may withdraw consent at any time as described in Section 8, without affecting the lawfulness of processing carried out before withdrawal.

We share personal data only with:

• Service providers who process data on our behalf under contract — for example, cloud hosting, email delivery, and payment processing providers — bound by data-processing terms consistent with the DPDPA.
• Your organization, where you are an End User whose data a Customer has entered into the platform to manage their own compliance obligations.
• Regulators or authorities, where required by law, court order, or to protect the rights, property, or safety of Avaril, our users, or the public.
• A successor entity, in the event of a merger, acquisition, or sale of assets, subject to equivalent privacy protections.

We retain personal data only for as long as necessary to fulfil the purposes described in this Policy, to meet contractual commitments to our Customers, or to comply with legal, accounting, or reporting obligations. Where you close your account, we delete or anonymize personal data within a reasonable period thereafter, except where retention is required by law or for the establishment, exercise, or defense of legal claims.

We implement reasonable technical and organizational safeguards to protect personal data against unauthorized access, alteration, disclosure, or destruction, including encryption of sensitive data at rest and in transit, access controls, and multi-factor authentication for platform accounts. No system is completely secure, and we encourage you to use strong, unique credentials and enable MFA on your account.

Under the DPDPA, you have the right to:

• Access a summary of the personal data we hold about you and the processing activities carried out on it.
• Request correction, completion, or updating of your personal data.
• Request erasure of personal data that is no longer necessary for the purpose it was collected, subject to our legal retention obligations.
• Withdraw consent at any time, as easily as it was given.
• Nominate another individual to exercise these rights on your behalf in the event of death or incapacity.
• Register a grievance regarding the handling of your personal data.

To exercise any of these rights, contact our Grievance Officer using the details in Section 11. We will respond within the timelines prescribed under the DPDPA.

Our website and platform use cookies and similar technologies for authentication, session management, security, and — where you consent — analytics. You can control non-essential cookies through the cookie preferences banner presented on your first visit, or by adjusting your browser settings. Disabling essential cookies may prevent parts of the platform from functioning.

Avaril's website and platform are intended for business use and are not directed at individuals under 18. Where a Customer's use of Avaril requires processing data belonging to a child, as defined under the DPDPA, the Customer remains responsible for obtaining verifiable parental or guardian consent before submitting such data to the platform.

For questions about this Policy or to exercise your rights, contact our Grievance Officer at privacy@avaril.net. We aim to acknowledge grievances promptly and resolve them within the timelines required under the DPDPA.

We may update this Policy from time to time to reflect changes in our practices or legal requirements. We will post the updated Policy on this page with a revised “last updated” date, and where changes are material, we will provide additional notice such as an email or an in-product banner.