Privacy Policy

1. Compliance with the DPDP Act 2023 (India)

As an Indian entity headquartered in Udaipur, Rajasthan, GCR Innovations adheres strictly to the provisions of the Digital Personal Data Protection Act, 2023 (DPDP Act). We act as a Data Fiduciary regarding the personal information you share with us directly, and as a Data Processor on behalf of our enterprise clients when deploying AI products (such as conversational bots and document assistants).

2. Information We Collect

We collect data under the following circumstances:

• Inquiry & Contact Information: Name, work email address, company name, phone or WhatsApp number, and details provided when requesting a product demo or consultation.
• AI Product Interaction Data: When you deploy or test our AI Chatbots or Workflow tools, session metadata, inquiry transcripts, and status logs are captured to maintain operational continuity.
• Technical & Usage Analytics: IP address, browser type, operating system, and navigation paths collected to analyze website functionality and prevent security vulnerabilities.

3. Purpose of Data Processing

We process your data strictly for legitimate business objectives, including:

4. Data Security & Storage Architecture

We apply defense-in-depth enterprise security measures to protect your information:

• Encryption: All data is encrypted in transit using TLS 1.3 and at rest using AES-256 standard encryption.
• Data Residency: Client data is processed within Indian cloud regions (AWS Mumbai / GCP Delhi) or within your private VPC upon enterprise agreement.
• Access Controls: Role-based access controls (RBAC) and multi-factor authentication are mandatory for all production systems.

5. Your Rights as a Data Principal

Under applicable Indian data protection regulations, you hold the following rights:

• The right to access a summary of your personal data processed by us.
• The right to correct, update, or complete inaccurate data.
• The right to request erasure of personal data that is no longer necessary.
• The right to withdraw consent for processing at any time.
• The right to readily available grievance redressal.

6. Data Retention Policy

We retain inquiry and contact information only as long as necessary to fulfill the operational business relationship, support active product contracts, or meet statutory legal requirements. When no longer required, data is irreversibly anonymized or securely purged.