Privacy Policy

1. Introduction

Innovly Private Limited (“we,” “our,” or “the Company”) provides the DLP Secure platform (the “Service”). This Privacy Policy explains how we collect, use, disclose, and protect personal information when you visit our website, use our platform, or engage with our services.

By accessing or using DLP Secure, you agree to this Privacy Policy. If you do not agree, please do not use the Service.

2. Information We Collect

2.1 Information You Provide

• Account Information: name, email address, company name, job title, and phone number when you register or request a demo.
• Billing Information: payment details processed through our secure third-party payment processors.
• Support Data: information you share when contacting our support team.

2.2 Information Collected Automatically

• Usage Data: pages visited, features used, session duration, and interaction patterns on our website.
• Device Data: browser type, operating system, IP address, and device identifiers.
• Cookies: we use cookies and similar technologies for analytics, authentication, and personalization.

2.3 Endpoint and Communications Data (Enterprise Deployments)

When your organization deploys DLP Secure, our Agent — installed on endpoint devices, with system access — monitors data-transfer activity across the channels enabled in your organization’s policy.

How this data is handled depends on the detection mode your organization has configured:

Cloud-Based Detection: where enabled by your organization, relevant file or communications content is transmitted via an encrypted connection to our servers, where our AI content-classification engine evaluates it against your organization’s configured sensitive-data categories (for example, personal, financial, or health information, or source code). The classification result — together with a record of the detection event (timestamp, device, channel, rule triggered, action taken) — is stored in our database for reporting and audit purposes.

Local Processing: by default, detection occurs entirely on the endpoint device using a local model. File and communications content are analyzed on-device and are not transmitted to our servers in this mode. Only policy-violation alerts or summary metadata, without underlying content, may sync to your organization’s management dashboard, if configured.

Your organization controls which channels are monitored and which detection mode applies, and acts as the data controller (data fiduciary, under Indian law) for its personnel’s data collected through the Service. We process this data as a data processor, on your organization’s instructions.

3. How We Use Your Information

• Detect and help prevent unauthorized or non-compliant transfer of sensitive data, as configured by your organization’s policies
• Process transactions and send related information
• Send administrative notifications, updates, and security alerts
• Respond to your requests, comments, and questions
• Monitor and analyze usage trends to improve user experience
• Detect, prevent, and address technical issues and security threats

4. Data Sharing and Disclosure

We do not sell your personal information. We may share data with:

• Service Providers: third-party vendors who assist in operating our platform (e.g., cloud hosting, analytics, payment processing).
• AI Processing: Cloud-Based Detection is evaluated by our AI content-classification engine. Where this relies on infrastructure we operate ourselves, no additional third party has access to your data during this process.
• Legal Requirements: when required by law, regulation, legal process, or governmental request.
• Business Transfers: in connection with a merger, acquisition, or sale of assets.
• With Consent: when you have given explicit consent to share your information.

5. Data Security

We implement industry-standard security measures, including encryption in transit (TLS 1.2+) — including on the connection between the Agent and our servers — encryption at rest (AES-256), access controls, audit logging, and regular security assessments. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

6. Data Retention

• Detection-event records and classification results (e.g., timestamps, device or user identifiers, rule triggered, action taken): retained for up to 12 months from the date of collection, consistent with Terms of Service Section 15, after which they are automatically deleted or anonymized, unless an extended retention period has been separately agreed or continued retention is required by law.
• Underlying file or communications content processed during Cloud-Based Detection: processed transiently for classification and not persisted beyond scan completion, unless your organization enables extended retention.
• Backups: Customer Data may persist briefly in encrypted backup or disaster-recovery systems after it is deleted from active systems; these copies are not used for active processing and are deleted in the ordinary course, consistent with Terms of Service Section 15.
• Content processed under Local Processing Mode never reaches our servers and is not retained by us; its retention is governed by your organization’s own device and data policies.
• We otherwise retain personal information for as long as necessary to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements, after which it is securely deleted or anonymized.

7. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Object to or restrict processing of your data
• Data portability
• Withdraw consent at any time

If you are an employee or other personnel of an organization using DLP Secure, and you have questions about data collected about you through a monitored device, please contact your organization directly in the first instance, since it controls the Service’s configuration and monitoring policies. We support our enterprise customers in responding to such requests as required by applicable law.

To exercise these rights with respect to your own account, billing, or support data, contact us at contact@innovly.co.

8. International Data Transfers

Where applicable law requires it, we take steps to safeguard personal data transferred across borders. For data subject to India’s Digital Personal Data Protection Act, 2023 and its Rules of 2025, cross-border transfer is generally permitted except to countries or territories the Central Government restricts by notification; we will comply with any such restrictions once notified. If you or your personnel are located outside India, other data protection frameworks (such as the GDPR) may also apply to your data; where they do, we rely on mechanisms such as standard contractual clauses as appropriate.

9. Children’s Privacy

DLP Secure is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child, we will take steps to delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy on our website and updating the “Last updated” date. Your continued use of the Service constitutes acceptance of the updated policy.

11. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us:

• Email: contact@innovly.co
• Phone: +91 887 000 7553
• Company: Innovly Private Limited, Coimbatore, India