Privacy PolicyPrivacy Policy

01Who we are

Aavishield is an endpoint security product built and operated by Aavish AI Lab ("we", "us"). You can reach us about privacy at [email protected].

When a company ("customer") uses Aavishield to protect its devices, that company decides what is monitored and why. Under India's Digital Personal Data Protection Act, 2023 the customer is the Data Fiduciary and we act as its Data Processor; under the GDPR the customer is the controller and we are a processor. For our own website, sales and billing data we act as the Data Fiduciary or controller.

02Data we collect

What we collect depends on how you interact with Aavishield.

• Website visitors and prospects: name, work email, company, role, team size and anything you write in the demo request form.
• Customer administrators: name, work email, password (stored only as a hash), role, sign-in history, two-factor settings and actions taken in the console (audit log).
• Employees of customers: name, work email, department, team, devices enrolled and portal account details.
• Device data from the agent: hostname, operating system and version, agent version, IP address, installed applications and security posture (disk encryption, firewall, updates, screen lock, antivirus).
• Security events from the agent: websites blocked or flagged by policy, blocked application launches, blocked downloads with file name and risk score, and data loss prevention findings (the destination, file name, detector types and a short masked preview of what matched).
• Activity monitoring, only on devices the customer enables it for: periodic screenshots, activity level, open applications and work session times.
• Billing data: billing contact, company tax details and payment status. Card and bank details are handled by our payment processor, not stored by us.

03How we use data

We use personal data only to:

• Provide the service: enforce the customer's security policies on its devices and show the results to its administrators.
• Secure the service: authenticate users, detect abuse, keep audit logs and investigate incidents.
• Support customers: answer tickets and emails and troubleshoot problems the customer reports.
• Bill customers and meet legal, tax and accounting obligations.
• Respond to demo requests and send service emails such as sign-in codes and security alerts.
• Improve the product using aggregated, de-identified usage information.

04Data loss prevention and monitoring

Data loss prevention in Aavishield is monitor-only: it records findings and never blocks the employee's upload. To classify content, files may be inspected in memory by our scanning service, including OCR of images and, where enabled, analysis by an AI model. We store the finding and a short masked preview, not a copy of the file.

Screenshot monitoring is off by default and is enabled per device by the customer. Customers are responsible for telling their employees what is monitored and for having a lawful basis to do so.

05Who we share data with

We do not sell personal data and we do not share it for advertising. A customer's data is visible only to that customer's authorised users, never to other organisations on the platform.

We use service providers who process data on our behalf under contract, for: cloud hosting and storage, network delivery and protection, transactional email, payment processing, and AI model providers used to classify content for data loss prevention. We may disclose data if the law requires it, or to protect the rights and safety of our users and the public.

06How we protect data

Security is our product, so we hold ourselves to it.

• Policy bundles sent to devices are signed with Ed25519 and verified on the device.
• Each organisation's data is scoped to that organisation.
• Per-organisation certificate authority keys are stored encrypted at rest.
• Screenshots and files are served only through short-lived signed links.
• Internal scanning services accept only authenticated requests.
• Sign-in uses a second factor: an emailed one-time code or an authenticator app.

07How long we keep data

Security events and monitoring data are kept for the retention period the customer configures, or our default, and then deleted. Account data is kept while the customer's subscription is active and for a limited period afterwards for legal, tax and audit purposes. Demo request data is kept for up to 24 months unless you ask us to delete it sooner.

08Your rights

Depending on where you live, you can ask to access, correct, update or erase your personal data, withdraw consent, nominate someone to exercise your rights, and raise a grievance. If your data came to us through your employer's use of Aavishield, please contact your employer first; we will help them respond.

To exercise your rights or raise a grievance, email [email protected]. We aim to respond within 30 days. You may also complain to the Data Protection Board of India or your local data protection authority.

09International transfers

Our service providers may process data in countries other than yours. Where we transfer data, we do so as permitted by applicable law and with contractual safeguards in place.

10Children

Aavishield is a business product. It is not directed at children and we do not knowingly collect children's personal data.

11Changes to this policy

We may update this policy as the product changes. We will post the new version here with a new date, and tell customers about material changes by email or in the console.