Privacy Policy

At Tavra Labs Pvt Ltd ("Tavra Labs", "we", "us", or "our"), we value your privacy and are committed to protecting your personal data. This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and the rights you have. It is published in accordance with the Digital Personal Data Protection Act, 2023 ("DPDP Act") and applicable rules, and the Information Technology Act, 2000 together with the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"). For the purposes of the DPDP Act, Tavra Labs acts as a Data Fiduciary and you, the individual whose personal data we process, are a Data Principal.

1. Personal Data We Collect

You can visit our website without telling us who you are. We only collect personal data that you choose to provide, and a limited amount of technical data collected automatically.

Data you provide

• Your name, email address, and the contents of any message you send us through our contact form or by email;
• Any other details you voluntarily include when you get in touch or engage our services.

Data collected automatically

• Technical identifiers such as IP address, browser type, operating system, and device information;
• Basic usage data such as pages visited and time of access, where available.

We collect only the data we need, and we do not use your personal data to make solely automated decisions that significantly affect you.

2. How We Use Your Data

We use the personal data we collect to:

• Respond to your enquiries and communicate with you about your request;
• Provide, operate, and improve our website and services;
• Maintain the security and integrity of our website;
• Comply with applicable legal and regulatory obligations.

3. Consent and Legal Basis

Where the DPDP Act requires it, we process your personal data on the basis of your consent, which you give — for example — when you submit our contact form. Your consent is sought through a clear request, is limited to the purposes described in this Policy, and you may withdraw it at any time. Withdrawing consent is as easy as giving it: simply email us at ops@tavralabs.com. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. Where permitted, we may also process data for "legitimate uses" recognised under the DPDP Act, such as responding to a request you have voluntarily made.

4. How We Share Data

We do not sell or rent your personal data. We may share it only in limited circumstances:

• Data Processors: trusted third parties who process data on our behalf under contract, such as our website hosting provider and our contact-form delivery service (FormSubmit). They may use your data only to provide services to us.
• Legal requirements: where disclosure is required by law, regulation, or a valid request from a court or public authority.

5. Cookies

Our website currently uses only essential cookies and local storage necessary for the site to function and to remember your language preference. We do not currently use analytics or advertising cookies. If this changes, we will update our Cookie Policy and obtain your consent where required. You can control cookies through your browser settings.

6. International Data Transfers

We are based in India, and some service providers we use may process data outside India. Where personal data is transferred internationally, we take appropriate steps to ensure it remains protected to a standard consistent with this Policy and applicable law, and we do not transfer data to any territory restricted by the Central Government under the DPDP Act.

7. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including to respond to your enquiry and to meet legal, accounting, or reporting requirements. When it is no longer needed, we securely delete or anonymise it.

8. Security

We implement reasonable security safeguards, including appropriate technical and organisational measures, to protect your personal data against unauthorised access, loss, misuse, or alteration, consistent with the SPDI Rules and the DPDP Act. Access to personal data is restricted to authorised personnel. No method of transmission over the internet is completely secure, however, and we cannot guarantee absolute security.

9. Your Rights as a Data Principal

Subject to applicable law, you have the right to:

• Access a summary of the personal data we process about you and how we process it;
• Correction, completion, and updating of your personal data;
• Erasure of your personal data where it is no longer required;
• Grievance redressal from us in respect of your data (see Grievance Officer below);
• Nominate another individual to exercise your rights in the event of death or incapacity;
• Withdraw consent at any time.

To exercise any of these rights, contact us at ops@tavralabs.com. We may need to verify your identity before acting on your request, and we will respond within the timelines prescribed under applicable law. Please use accurate information and do not suppress material information when exercising your rights, as required by the DPDP Act.

10. Grievance Officer

In accordance with the DPDP Act and the Information Technology Act, 2000, you may contact our Grievance Officer with any question, concern, or complaint about how we handle your personal data:

We will acknowledge and endeavour to resolve grievances within 30 days, and in any case within the timelines prescribed under applicable law. If you are not satisfied with our response, you may have the right to lodge a complaint with the Data Protection Board of India.

11. Children's Privacy

Our website and services are not directed to children under 18, and we do not knowingly collect their personal data. Where we become aware that we process a child's personal data, we will do so only with verifiable consent of a parent or lawful guardian as required by the DPDP Act, and we do not undertake tracking, behavioural monitoring, or targeted advertising directed at children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

12. Data Breach

In the event of a personal data breach, we will take prompt remedial action and notify the Data Protection Board of India and affected Data Principals in the manner and within the timelines required under the DPDP Act and applicable rules.

13. Links to Other Websites

Our website may contain links to external sites we do not operate. We are not responsible for the privacy practices of those sites and encourage you to review their policies independently.

14. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with a revised "last updated" date. If we make material changes, we will take reasonable steps to notify you.

15. Contact Us