Privacy Policy

1. Introduction

Ayasya Digital, a unit of Ayasya, operating the {{brand.name}} platform ("we", "our", "us"), is committed to protecting your personal data and your right to privacy. This Privacy Policy explains what information we collect, how we use it, your rights in relation to it, and how to contact us with questions.

This policy applies to all users of {{brand.name}} — visitors to our marketing website (karyastra.com), registered account holders, and organisations that deploy {{brand.name}} for their teams.

By using our platform or website, you agree to the terms of this policy. If you do not agree, please discontinue use and contact us to delete your data.

2. Information We Collect

2.1 Account & Registration Data

• Full name and email address
• Organisation name and role
• Password (hashed; never stored in plain text)
• Profile photo (if uploaded voluntarily)
• Billing contact details (on paid plans)

2.2 Usage & Activity Data

• Features accessed, pages visited, and time spent in the application
• Actions taken (tasks created, comments posted, sprints planned)
• Search queries entered within the platform
• Integration events (e.g. GitHub webhooks, GitLab events)

2.3 Communications Data

• Messages submitted via contact or demo-request forms
• Support tickets and email correspondence
• Feedback and survey responses

2.4 Technical & Device Data

• IP address and general geographic location (country or city level)
• Browser type, version, and operating system
• Device type and screen resolution
• Referring URL and session identifiers
• Error logs and performance diagnostics

2.5 Data You Input Into the Platform

Content you create inside {{brand.name}} — projects, tasks, comments, uploaded documents — belongs to you. We process this content only to deliver the service and do not use it for any other purpose, including training AI models.

3. How We Collect Data

• Directly from you — when you register, fill a form, or contact us
• Automatically — via cookies, server logs, and telemetry as you use the platform
• From integrations — if you connect GitHub, GitLab, or other services, we receive webhook events and metadata you authorise
• From third-party services — including email delivery providers and analytics tools where applicable

4. Purpose of Data Processing

5. Legal Basis for Processing

Where applicable privacy regulations require it, we rely on the following legal bases:

• Performance of a contract — processing necessary to provide the platform to registered users
• Legitimate interests — security monitoring, fraud prevention, product improvement, and direct marketing to existing customers (where proportionate and not overridden by your rights)
• Consent — optional analytics cookies and marketing emails; you may withdraw consent at any time
• Legal obligation — where we must retain data to comply with applicable law

We process data in accordance with India's Digital Personal Data Protection Act, 2023 (DPDP Act). Where users are located in the European Economic Area or United Kingdom, we additionally rely on the GDPR and UK GDPR legal bases above.

6. Cookies & Tracking Technologies

We use cookies and similar technologies to operate the platform and understand how it is used. See our dedicated Cookie Policy for the full list, categories, and retention periods.

In summary:

• Essential cookies — required for authentication, CSRF protection, and basic site functionality. Cannot be disabled.
• Functional cookies — remember your preferences such as dark/light theme.
• Analytics cookies — optional; used only if Google Analytics is enabled and you have given consent.
• Marketing cookies — not currently deployed.

You can manage your cookie preferences at any time via the cookie consent banner or the Manage Preferences section of our Cookie Policy.

7. Third-Party Services & Data Sharing

We do not sell your personal data. We share it only as described below.

7.1 Service Providers

• EmailJS / Web3Forms — email delivery for form submissions and transactional messages
• Payment processors — for billing on paid plans (subject to their own privacy policies)
• Cloud infrastructure providers — for hosting the managed SaaS option
• Google Analytics — optional aggregated analytics; only loaded when enabled and consent is given

7.2 Integrations You Authorise

If you connect GitHub, GitLab, or other third-party tools, data flows between those services and {{brand.name}} under your instruction. We are not responsible for those services' privacy practices.

7.3 Self-Hosted AI

{{brand.name}}'s AI features run on open models you host via Ollama. No task content, comments, or code are sent to any third-party AI model.

7.4 Legal Disclosures

We may disclose your data if required by law, court order, or to protect the rights, safety, or property of {{brand.name}}, our users, or the public.

7.5 Business Transfers

In the event of a merger, acquisition, or sale of all or part of our assets, your data may be transferred as part of that transaction. We will notify you of any such change and any choices you may have.

8. Data Storage, Retention & Deletion

We retain your personal data only for as long as necessary for the purposes described in this policy or as required by law.

• Account data — retained for the duration of your account and deleted within 90 days of account closure
• Usage logs — retained for up to 30 days for security and debugging purposes
• Backup snapshots — retained for up to 7 days and then automatically purged
• Financial records — retained for 7 years as required by Indian taxation law
• Communications — retained for up to 3 years unless you request earlier deletion

9. Data Security

We implement industry-standard technical and organisational measures to protect your data:

• All data in transit is encrypted using TLS 1.2 or higher
• Passwords are hashed using bcrypt before storage
• Database rows are isolated per-tenant using Row-Level Security (RLS)
• Concurrency controls prevent race conditions in sensitive operations
• Access to production systems is restricted and logged
• Security patches are applied on a regular cadence

Despite these measures, no system is completely secure. In the event of a data breach affecting your rights and freedoms, we will notify you and any applicable supervisory authority within the timeframes required by law.

10. Your Rights & Privacy Controls

Depending on your location, you may have the following rights regarding your personal data:

• Right to access — request a copy of the personal data we hold about you
• Right to rectification — correct inaccurate or incomplete data
• Right to erasure — request deletion of your data ("right to be forgotten")
• Right to restriction — request that we limit processing of your data
• Right to data portability — receive your data in a structured, machine-readable format
• Right to object — object to processing based on legitimate interests or for direct marketing
• Right to withdraw consent — where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing
• Right to lodge a complaint — contact your local data protection authority

To exercise any of these rights, email us at {{brand.email}} with the subject line "Privacy Request". We will respond within 30 days (or the timeframe required by applicable law).

11. Account Deletion & Data Removal

You can delete your account at any time from your workspace settings (Settings → Account → Delete Account). Upon deletion:

• Your profile, projects, and tasks are permanently removed within 7 days
• Backup copies are purged within 90 days
• We will confirm deletion by email

Alternatively, email {{brand.email}} to request manual deletion, including deletion of data held in backups. Note that data required for legal compliance (e.g. billing records) is retained per the retention schedule above.

12. Communication Preferences

We may send you:

• Transactional emails — password resets, account notices, billing receipts. These cannot be opted out of while your account is active.
• Product updates — release notes and feature announcements. You can unsubscribe via the link in any such email.
• Marketing communications — only sent with your explicit consent. Unsubscribe at any time.

To update your email preferences, visit your account settings or email {{brand.email}}.

13. Children's Privacy

{{brand.name}} is not directed at individuals under 18 years of age. We do not knowingly collect personal data from minors. If you believe a minor has provided us with their data, please contact us and we will delete it promptly.

14. International Data Transfers

{{brand.name}} is operated by Ayasya Digital, incorporated in India. Data may be stored or processed in countries outside India, including in the European Economic Area and the United States, by our infrastructure and service providers. We ensure such transfers are protected by appropriate safeguards including Standard Contractual Clauses (SCCs) or equivalent mechanisms as required by applicable law.

For self-hosted deployments, data is stored entirely on our / your infrastructure as per the arrangement or mutual discussion and is subject only to your own data governance policies.

15. Regulatory Compliance

We design {{brand.name}} to support compliance with the following frameworks:

• India — DPDP Act 2023: Our primary regulatory framework as an Indian company
• GDPR / UK GDPR: For users in the EU and UK
• SOC 2 Type II: Our architecture is designed for SOC 2-ready deployment (certification in progress)

Compliance with privacy law ultimately depends on your own deployment and configuration choices. We provide the controls; you are responsible for using them appropriately for your jurisdiction.

16. Contact Us About Privacy

For any questions, requests, or complaints regarding this policy or your personal data:

• Email: {{brand.email}}
• Phone: {{brand.phone}}
• Post: Data Privacy, Ayasya Digital, Remote-first · Worldwide

If you are located in the EU/UK and are not satisfied with our response, you have the right to lodge a complaint with your local data protection supervisory authority.

17. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top, notify registered users by email for material changes, and post a notice on our website. We encourage you to review this page periodically.

Continued use of {{brand.name}} after a policy update constitutes acceptance of the revised terms. If you do not agree with a material change, please contact us to discuss options or close your account.