Privacy
Privacy Policy
The short version: we collect what we need to talk to you and do good work, we don’t sell it, and you can ask us to see, fix or delete it at any time.
About this policy
This policy explains how Gavi (“Gavi”, “we”, “us”, “our”) collects, uses, stores and discloses personal information when you visit this website, book a call with us, or work with us. We’re based in India, and we handle personal information in line with the Digital Personal Data Protection Act, 2023 (the DPDP Act), the Information Technology Act, 2000, and the rules made under them.
If you’re a client, your engagement agreement may include additional terms about data we handle on your behalf. Where it does, that agreement applies alongside this policy.
What we collect
We only collect what we need to talk to you and do the work:
- Contact details such as your name, email address, phone number, company and role.
- Project information you choose to share, like what you’re building, your current systems, timelines and budget.
- Correspondence such as emails you send us and notes from our calls with you.
- Billing information for clients, such as business name, GSTIN, PAN or tax details , billing address and payment records. We don’t store card numbers.
- Technical information collected automatically when you browse, such as IP address, browser and device type, pages viewed, referring site, and approximate location.
We don’t ask for sensitive information (such as health or financial hardship details) and ask that you don’t send it to us. You can browse this site without telling us who you are.
How we collect it
Mostly directly from you: when you book a call, email us, talk with us, or sign an agreement. Some information comes from the tools we use to run the site (see cookies and analytics), and occasionally from public sources such as your company website or LinkedIn profile when we prepare for a call you’ve booked.
How we use it
We use personal information to:
- respond to your enquiries and run the calls we arrange with you;
- scope, quote, deliver and support the work you engage us for;
- send invoices, manage payments and keep business records;
- understand how the site is used so we can improve it, and measure whether our advertising works;
- protect the security of our systems and prevent misuse;
- meet our legal, tax and regulatory obligations.
We don’t sell personal information, and we don’t add you to a mailing list unless you ask to be on one. If we ever send you marketing, every message will include a way to opt out.
Overseas disclosure
Our lead engineer works from Australia, and some of our service providers store data in other countries, including the United States. When personal information is transferred outside India, we protect it through confidentiality obligations, contractual terms and access controls, and we don’t transfer it to any country the Government of India has restricted under the DPDP Act.
Client systems and data
When we build or run software for you, we may have access to personal information held in your systems, such as your customers’ data. We handle it only on your instructions and for the purpose of the engagement, with the least access needed. Your repositories, cloud accounts and keys stay yours. The confidentiality and data handling terms in your engagement agreement apply to that information, and we’ll return or delete it at the end of the engagement as agreed.
Storage and security
We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access or disclosure. That includes encrypted storage and transport, multi-factor authentication, role-based access, and keeping access limited to the people who need it. No system is perfectly secure, so if a personal data breach happens, we’ll notify you and the Data Protection Board of India as the DPDP Act requires, and report cyber security incidents to CERT-In where the law requires it.
How long we keep it
We keep personal information only as long as we need it for the purposes above. Enquiries that don’t turn into work are deleted or de-identified within two years. Client and financial records are kept for as long as the law requires, which in India is generally up to eight years for accounting and tax records.
Access, correction and your choices
You can ask to see the personal information we hold about you, ask us to correct it, or ask us to delete it where we’re not required to keep it. To make a request, email us at [email protected] and we’ll respond within 30 days. We may need to verify your identity first, and if we can’t meet a request, we’ll explain why.
Under the DPDP Act, you can also withdraw any consent you’ve given us at any time, as easily as you gave it, and nominate someone to exercise your rights if you die or become unable to. We process personal information with your consent, or for the legitimate uses the Act allows, such as information you’ve given us voluntarily for a specific purpose like arranging a call.
If you’re in the European Union or the United Kingdom, you also have rights under the GDPR, including to object to or restrict processing and to data portability. We rely on our legitimate interests in responding to enquiries and running our business, on contract when we work together, and on your consent for non-essential cookies where that’s required.
Complaints
If you think we’ve mishandled your personal information, please email us at [email protected]first so we can put it right. We’ll acknowledge your complaint within 7 days and aim to resolve it within 30. If you’re not satisfied with our response, you can complain to the Data Protection Board of India.
Changes to this policy
We may update this policy as our services or the law change. The latest version will always be on this page, with the date it was last updated at the top. If a change materially affects how we use information we already hold, we’ll let affected clients know.
Contact us
Questions about privacy? Email us at [email protected]. You can also read our terms.