Privacy Policy

Avryxa Technologies Private Limited (“we”, “us”) operates Scoutlight. For the purposes of India’s Digital Personal Data Protection Act, 2023 we are a Data Fiduciary; under the GDPR we act as a controller for account data and as a processor for the content you put into your workspace.

Registered office: RZ-82, Sukhi Ram Park, Matiala Road, Uttam Nagar, New Delhi, Delhi 110059, India. Privacy contact: contact@avryxa.com.

Information you give us

• Account details: your name, email address, and the workspace you create or are invited to.
• Team information: the email addresses of people you invite and the roles you assign them.
• Content you create: campaign definitions, notes, pipeline stages, and other records you enter.
• Billing details: your billing country and the plan you choose. Card and bank details go directly to our payment gateway — we never receive or store them.
• Correspondence: messages you send us for support, and our replies.

Information we generate or obtain

• Usage records: which operations your workspace ran, when, and in what volume — used for quotas, billing, and abuse prevention.
• Business information: details of businesses discovered from publicly available sources and licensed data providers, such as trading name, address, phone number, website, category, ratings, and public review counts.
• Technical data: IP address, browser type, and server logs, retained for security and diagnostics.

Cookies

We use a small number of strictly necessary cookies, principally to keep you signed in and to protect against cross-site request forgery. We do not use advertising cookies, and we do not sell or share personal data with advertising networks.

Some business contact details are also personal data — a sole trader’s mobile number or an owner’s name, for example. We treat that information carefully:

• We collect it only from publicly available sources and licensed providers, in the context of the business's commercial activity.
• We use it to help our customers identify and contact potential business clients — a business-to-business purpose.
• We do not knowingly collect special categories of personal data, and we do not build profiles of individuals in a personal capacity.

Removal requests. If your business details appear in Scoutlight and you want them removed, email contact@avryxa.com with the business name and location. We will verify the request, remove the record from our discovery index, and suppress it from future results. Please note we cannot recall information a customer has already exported.

• To provide the service you signed up for — creating your account, running your campaigns, and showing you results. Basis: performance of a contract with you; under the DPDP Act, the purpose for which you provided the data.
• To bill you accurately and prevent abuse of quotas. Basis: contract and our legitimate interest in being paid and in protecting the service.
• To secure the platform, investigate incidents, and keep audit records. Basis: legitimate interest and legal obligation.
• To send service messages — sign-in codes, invitations, billing notices, and material changes to these policies. Basis: contract. These are not marketing and cannot be opted out of while your account is open.
• To improve the service, including in aggregated or de-identified form that does not identify you or your workspace. Basis: legitimate interest.
• To comply with tax, accounting, and other legal obligations. Basis: legal obligation.

We do not use your workspace content to train publicly available AI models, and we do not sell personal data.

We share personal data only where it is needed, and only with parties bound to protect it. By category of recipient:

• Cloud hosting and database providers, which store and serve the application.
• Transactional email delivery, which sends your sign-in codes, invitations, and account notices.
• Payment gateways, which process your payments and hold your card details under their own privacy terms.
• Business data and search intelligence providers, which supply the public business information the platform analyses.
• AI processing providers, which generate summaries and suggested messaging from the data submitted for that purpose.
• Professional advisers — accountants, auditors, and lawyers — where necessary and under a duty of confidentiality.

Each processor is engaged under contractual terms requiring appropriate security and limiting use of the data to the services they provide to us. A current list of our sub-processors is available to customers on request from contact@avryxa.com.

We may also disclose personal data where required by law, court order, or a valid request from a public authority, and to establish or defend legal claims. If the business is acquired or merged, data may transfer to the acquirer under this policy.

Some of our service providers operate outside India. Where personal data is transferred abroad, we rely on contractual safeguards with those providers requiring a standard of protection comparable to that under applicable Indian law, and, for data originating in the European Economic Area or the United Kingdom, on standard contractual clauses.

• Account and workspace data: for as long as your account is open. After you close it, we delete or anonymise the workspace within 90 days, except where we must keep records longer.
• Billing and transaction records: retained for the period required by Indian tax and company law, currently eight years.
• Security and audit logs: typically 12 months.
• Business information discovered from public sources: retained as part of our index, subject to the removal process described above.

• Data is encrypted in transit, and at rest by our hosting providers.
• Sign-in is passwordless — there are no stored passwords to leak, and one-time codes are stored hashed and expire quickly.
• Every workspace is isolated: access is authorised on each request, and one customer cannot read another's data.
• Access to production systems is restricted to personnel who need it, and administrative access is logged.

No system is perfectly secure. If a personal data breach occurs that is likely to affect you, we will notify you and the Data Protection Board of India as required by law.

Subject to applicable law, you may:

• ask what personal data we hold about you and obtain a copy of it;
• have inaccurate or incomplete data corrected or updated;
• have your personal data erased, subject to records we must retain by law;
• withdraw consent where we rely on it, without affecting processing already carried out;
• nominate another person to exercise your rights in the event of death or incapacity, as provided under the DPDP Act;
• complain to a supervisory authority — in India, the Data Protection Board.

To exercise any of these, email contact@avryxa.com. We will respond within 30 days. We may need to verify your identity first.

If you are a team member in someone else’s workspace, the workspace owner controls that content; we will refer your request to them where appropriate.

In accordance with the DPDP Act, 2023 and the Information Technology Act, 2000, our grievance officer is:

Grievances are acknowledged within 24 hours and resolved within 15 days of receipt.

The service is for business use by adults. We do not knowingly collect personal data of children under 18. If you believe a child has provided us data, contact us and we will delete it.

We will post any update here and change the date above. Where a change materially affects how we handle your personal data, we will notify you by email or in the application before it takes effect.