Trust & Legal

India Privacy Notice

Version 1.0Last updated: 30 May 2026Effective: 30 May 2026

Issued under the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("IT Rules 2011").

1. Identity of the Data Fiduciary

  • Name: ZenzoLabs
  • Privacy contact: privacy@zenzolabs.com
  • Grievance Officer: see Grievance Officer page (mandatory under DPDP Section 10 and IT Rules 2011)
  • Data Protection Officer (DPO): not required at present because ZenzoLabs is not currently classified as a Significant Data Fiduciary under DPDP Section 10(2). We will appoint a DPO and notify you if our status changes.

2. Personal data we process

We process the categories of personal data described in Privacy Notice section 2. We do not collect Aadhaar numbers. We may collect PAN for B2B invoicing where required by Indian tax law; PAN is handled as sensitive personal data under the IT Rules 2011.

3. Itemised purposes (DPDP Section 5)

We process your personal data for these specific, itemised purposes:

  • Provide, operate, and secure the Service you have signed up for.
  • Manage your account, authenticate you, and respond to support requests.
  • Issue invoices and meet our statutory accounting obligations.
  • Detect, prevent and investigate fraud, abuse, and security incidents.
  • Send transactional communications (e.g. password resets, security notices).
  • Where you have consented, send marketing communications you can withdraw at any time.
  • Where you have consented, run analytics to improve the Service.
  • Comply with applicable law and lawful requests from authorities.

4. Lawful basis

We rely on your consent (DPDP Section 6) for the processing described above, except where a certain legitimate use applies under DPDP Section 7 (such as compliance with a legal obligation, response to a medical emergency, or employment-related processing). Consent can be withdrawn as easily as it was given.

5. Children

The Service is not directed to anyone under 18 years (the DPDP definition of a child). We do not knowingly process the personal data of children and we do not engage in targeted advertising, tracking, or behavioural monitoring of children. If you believe a child has provided personal data to us, contact privacy@zenzolabs.com for prompt deletion.

6. Cross-border transfer (DPDP Section 16)

To deliver the Service we transfer personal data outside India to the following destinations:

  • United Kingdom — for primary hosting on Contabo (Ubuntu VPS in the UK).
  • United States of America — for source-code hosting (GitHub), container registry (GHCR), email (GoDaddy), analytics (Google), and large-language-model processing (OpenAI, Anthropic, xAI, Google) when invoked by you.

These transfers are permitted under DPDP Section 16 because the Central Government has not at present restricted transfers to these countries. We monitor MeitY notifications continuously; if a country becomes restricted we will discontinue or relocate the affected processing and notify you.

7. Your rights as a Data Principal (DPDP Sections 11–14)

  • Right to access a summary of your personal data and the processing we carry out.
  • Right to correction, completion, updating and erasure of your personal data.
  • Right of grievance redressal — see Grievance Officer page.
  • Right to nominate another individual to exercise your rights in case of death or incapacity.
  • Right to withdraw consent at any time, as easily as you gave it.

To exercise any of these, email privacy@zenzolabs.com with subject "DPDP Request — [your right]". We acknowledge within 48 hours and resolve within the period prescribed by the DPDP Rules (currently 30 days, often shorter for grievances).

8. Security measures

We follow the security measures described in our Security Policy and which meet "reasonable security practices and procedures" under the IT Rules 2011: TLS in transit, encryption at rest where supported by our hosting provider, role-based access control, audit logging, MFA on administrative accounts, and a privacy-firewall design that never sends raw business data to third-party LLMs.

9. Breach notification

If a personal data breach occurs we will:

  • Notify CERT-In within 6 hours as required by the CERT-In Directions of 28 April 2022 (where the incident falls within their reportable categories);
  • Notify the Data Protection Board of India and affected Data Principals in accordance with DPDP Section 8(6) and the DPDP Rules;
  • Provide guidance on protective steps and remediation.

10. Retention

We retain personal data for the durations described in Privacy Notice section 6, and only for as long as is necessary for the specified purpose or required by law.

11. Languages

This notice is published in English. You may request a translation into Hindi or any other language listed in the Eighth Schedule of the Constitution of India by writing to privacy@zenzolabs.com.

12. Complaints to the regulator

If you are not satisfied with our response, you may complain to the Data Protection Board of India (constituted under DPDP Section 18). Until the Board's portal is fully operational you may also raise concerns through cybercrime.gov.in for cyber-incident matters, or contact CERT-In at incident@cert-in.org.in.

Questions about privacy?

Email privacy@zenzolabs.com. We reply within 2 business days.

All documents