Privacy Policy

We use the information we collect for the following purposes:

If you are located in the European Economic Area (EEA) or United Kingdom, we process your personal data based on the following legal grounds:

• Consent: For marketing communications and optional cookies/analytics
• Contractual Necessity: To provide the Services you have subscribed to
• Legitimate Interests: To improve our Services, prevent fraud, and ensure security
• Legal Obligation: To comply with applicable laws and regulations

We do not sell, rent, or trade your personal information. We may share your data with:

• Payment Processors: Razorpay, PayPal, and other payment gateways for processing transactions securely. These processors are PCI-DSS compliant and handle your payment data according to their own privacy policies
• Cloud Infrastructure Providers: Trusted, industry-certified cloud service providers for hosting, data storage, processing, and email delivery
• Analytics Providers: Analytics and performance monitoring tools for website and platform usage insights (data is anonymized/aggregated)
• Authentication Providers: Google OAuth for social sign-in functionality
• Business Transfers: In connection with a merger, acquisition, or sale of assets, your data may be transferred as part of the transaction
• Legal Requirements: When required by law, court order, or governmental authority, or to protect our rights and the safety of our users
• With Your Consent: When you explicitly authorize sharing (e.g., sharing sites publicly or with specific team members)

We implement industry-standard security measures to protect your data:

• Encryption: All data in transit is encrypted using TLS 1.2+ (HTTPS). Data at rest is encrypted using AES-256 encryption
• Access Controls: Role-based access controls, multi-factor authentication, and session management with automatic timeouts
• Infrastructure: Hosted on industry-certified, secure cloud infrastructure with regular security patches and monitoring
• Payment Security: Payment data is processed by PCI-DSS Level 1 compliant payment processors. We never store full credit/debit card numbers on our servers
• Session Management: Secure session tokens, device tracking, and ability to terminate sessions remotely
• Regular Audits: Periodic security assessments and vulnerability scanning

While we strive to protect your personal data, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security but are committed to promptly notifying affected users in the event of a data breach.

• Account Data: Retained for the duration of your active account and for up to 90 days after account deletion to allow for recovery
• Survey & Project Data: Stored according to your subscription plan. Default retention is 2 months for Basic/Professional plans after survey completion, with extended retention available on Enterprise plans
• Payment Records: Retained for 7 years as required by Indian tax and financial regulations
• Communication Records: Support tickets and correspondence retained for 3 years for quality and dispute resolution purposes
• Analytics Data: Anonymized analytics data may be retained indefinitely for trend analysis
• Email Marketing Data: Your email preferences and consent records are retained until you withdraw consent or delete your account

You may request early deletion of your data at any time, subject to legal retention requirements.

We are committed to responsible email communication practices and comply with applicable anti-spam laws including CAN-SPAM Act, GDPR, and India's Information Technology Act.

Your data is primarily processed and stored on servers located in India. Depending on service requirements, your data may also transit through or be stored in data centers in other regions. When we transfer data internationally, we ensure appropriate safeguards are in place:

• Standard Contractual Clauses (SCCs) approved by relevant authorities
• Data processing agreements with all third-party service providers
• Compliance with applicable cross-border data transfer regulations

Depending on your location, you may have the following rights regarding your personal data:

• Right to Access: Request a copy of the personal data we hold about you
• Right to Rectification: Request correction of inaccurate or incomplete personal data
• Right to Erasure: Request deletion of your personal data (subject to legal retention obligations)
• Right to Restrict Processing: Request that we limit how we use your data
• Right to Data Portability: Request your data in a structured, machine-readable format
• Right to Object: Object to processing based on legitimate interests or for direct marketing
• Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent

To exercise any of these rights, please contact our Data Protection Officer at dpo@aeroyantra.com. We will respond to your request within 30 days.

If you are located in the EEA, you also have the right to lodge a complaint with your local data protection authority.

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes:

• We will post the updated policy on this page with a revised "Last Updated" date
• We will notify registered users via email for significant changes
• We may display a prominent notice on our platform

Your continued use of our Services after any changes constitutes acceptance of the updated Privacy Policy.

In accordance with the Information Technology Act, 2000 and the rules made thereunder, the name and contact details of the Grievance Officer are as follows:

We aim to resolve all complaints and grievances within 30 days of receipt.