Privacy notice

1. Who we are and what this notice covers

This privacy notice explains how iViRTH ("iViRTH", "we", "us") handles personal data collected through ivirth.in (the "website"). iViRTH is an R&D company based in Uttar Pradesh, India, that builds digital-twin platforms and intelligent infrastructure. For the purposes of the Digital Personal Data Protection Act, 2023 ("DPDP Act"), iViRTH is the Data Fiduciary for personal data you give us through this website.

This notice does not cover (a) our related properties ivirth.com and ivirth.online, which publish their own notices, or (b) personal data processed inside a pilot or deployment, which is governed by the project agreement and a deployment-specific notice (see section 13).

Legal entity name and registered office: To be confirmed (published here before launch). Contact for everything in this notice: hello@ivirth.in.

2. The short version

3. Information we collect

Information you give us

• Enquiry and pilot-request forms (home page and Request a Pilot): name, organisation, work email, optional phone, visitor type, project type, location, approximate scale, and the message you write.
• Email you send to hello@ivirth.in and the content of the correspondence that follows.
• Meeting and site-assessment details you share with us after an enquiry, such as site location, ownership, utilities and contacts.

Information collected automatically

• Server and hosting logs: IP address, date and time, requested URL, referrer, browser and device type, and response status. Our hosting provider generates these to deliver the site and protect it from abuse.
• Interaction events: when you click a primary call-to-action, start or submit a form, open the case study, or click an email link, the page records a short event name in your browser's in-page data layer. These events contain no name, email or message text. Today they are not transmitted anywhere unless an analytics service is enabled (see section 6).

What we do not collect through this website

• No user accounts or passwords, and no payment card or bank details.
• No biometric data, precise location, contacts or microphone/camera access (the site sends a Permissions-Policy header disabling camera, microphone and geolocation).
• No advertising profiles, and no personal data purchased from list brokers.
• Please do not put sensitive personal data (for example health, financial or government identity numbers) in the free-text field. We do not need it to respond to an enquiry.

4. How the enquiry forms work

The forms on this website do not post your details to a database. When you press Send, the page prepares an email in your own email application, addressed to hello@ivirth.in. Nothing reaches us until you send that email. The message then travels through your email provider and ours, and is stored in our mailbox.

If we later connect the forms to a form service or CRM, we will update this notice first and list the provider in section 7. The honeypot field in the form is used only to discard automated spam and stores nothing.

5. Why we use your information and our legal basis

We use your information only for the purposes above, or for a closely related purpose we tell you about first.

6. Who we share it with

We do not sell or rent personal data. We share it only with:

• Service providers (processors) that help us run the website and our communications, bound by contract to act on our instructions: our static-site hosting and content-delivery provider, our email provider, and, if we adopt them, a form service, CRM or analytics provider. We will list any provider that receives your form data in this notice before we start using it.
• Professional advisers such as lawyers, accountants and auditors, under confidentiality duties.
• Government and law-enforcement bodies where the law requires it, for example a valid order or a cyber-security incident report to the Indian Computer Emergency Response Team (CERT-In).
• A successor organisation if iViRTH is restructured, merged or acquired, in which case this notice will continue to apply to your data until you are told otherwise.

Personal data submitted for a pilot is shared with partners (for example an installation or hosting partner) only as set out in the project agreement.

7. Where your data is processed

Our hosting, content-delivery and email providers operate global infrastructure, so data may be processed outside India. We choose providers with appropriate contractual and technical safeguards, and we will follow any restriction on transfers to specified countries that the Government of India notifies under section 16 of the DPDP Act. If you need your project data kept in India (data residency), tell us at the start; it is a design requirement we scope per deployment.

8. How long we keep it

When retention ends we delete or irreversibly anonymise the data, and we ask processors to do the same.

9. How we protect it

We apply reasonable security safeguards appropriate to the data: encrypted connections (HTTPS), security response headers, least-privilege access to mailboxes and project files, vendor selection and contracts, and a documented route for security reports (security.txt). The website is a static site with no database of visitor data. No online service is perfectly secure, so we cannot promise absolute security. If a personal-data breach affects you, we will notify you and the authorities as the law requires. More on our approach: Security and data governance.

10. Your rights

Under the DPDP Act you may:

• obtain a summary of the personal data we process about you and the processing activities, and the identities of those we have shared it with;
• ask us to correct, complete or update your data;
• ask us to erase your data, unless we must keep it by law;
• withdraw consent at any time (withdrawal does not affect processing already done, and we may then be unable to continue the related service);
• have your grievance addressed, and nominate another person to exercise these rights for you if you die or become incapacitated.

Use the process on Data rights and grievances. We may need to confirm your identity first. If we cannot resolve your complaint, you may approach the Data Protection Board of India once it is operational and you have used our grievance process.

11. Children

This website is intended for organisations and adults. We do not knowingly collect personal data of anyone under 18 through it. Where a school, campus or learning programme uses iViRTH technology, the institution and iViRTH follow the rules on verifiable parental consent and on tracking and targeted advertising directed at children set out in our children and minors policy.

12. Pilots and deployments are different

When we install infrastructure or run a digital-twin pilot, the personal data involved (if any) depends on what is installed and what the use case needs. For each pilot we agree in writing, and tell the people affected through a deployment notice or on-site signage:

• what data is collected, why, and whether it identifies anyone;
• who is the Data Fiduciary and who is the processor. At a school or university this is normally the institution, with iViRTH acting as its processor;
• the lawful basis or consent route, retention period and deletion process;
• who can see the data, with role-based access and an audit trail where implemented.

Smart Solar Bench V1.0 Base. The pilot-deployed V1.0 Base does not run edge AI, computer vision or on-device AI analytics. If a future variant adds sensing that could relate to people, such as occupancy or footfall, we will carry out a privacy review, prefer aggregate and non-identifying measures, and publish what is collected before it is deployed.

Helix identities and digital twins. A Human Twin is scoped to the minimum data a use case needs. A digital twin does not inherently require biometric identification; if a deployment ever uses biometrics it will be only where the law permits, under a separate written agreement, with explicit consent and a stated retention period.

13. Links and other websites

Our pages link to other websites, including the official portals of the programmes that recognise iViRTH (Startup India, DPIIT, MSME, Digital India and Start in UP) and our related properties. Those sites have their own privacy practices; please read their notices.

14. Changes to this notice

We will post changes here with a new version number and date. If a change materially affects how we use data you have already given us, we will tell you directly where we can. Earlier versions are available on request.

15. Contact and grievances

Questions, requests and complaints: hello@ivirth.in, subject line "Privacy". Grievance Officer details and the grievance process are on Data rights and grievances.