Enterprise Privacy & Data Governance

Privacy & Data Policy

VyomAI Technologies Inc. and VyomAI Solutions Pvt. Ltd. (“VyomAI”, “we”, “us”) are committed to maintaining uncompromising standards of confidentiality, data integrity, and ethical AI governance. This document outlines how we process, store, and defend enterprise client assets and personal information.

Effective Date: October 18, 2026Document: v3.2.0 (Enterprise)SOC 2 Type II & ISO 27001 Aligned

Core Privacy Commitments

Zero Model Training on Client Data

Your proprietary datasets, codebases, prompts, and embeddings are strictly isolated and NEVER used to train or fine-tune public foundation models.

AES-256 & TLS 1.3 Encryption

All data at rest is encrypted via AES-256 with Hardware Security Module (HSM) keys. Data in transit is protected via modern TLS 1.3 ciphers.

Zero Trust Architecture

Strict role-based access control (RBAC), biometric MFA, ephemeral SSH sessions, and continuous audit trails for engineering access.

Global Compliance Ready

Full adherence to EU GDPR, UK GDPR, California CCPA/CPRA, and India Digital Personal Data Protection Act (DPDP 2023).

01. Scope & Introduction

This Privacy & Data Policy applies to all services, web applications, APIs, bespoke machine learning platforms, and technical consulting provided by VyomAI Technologies Inc. and VyomAI Solutions Pvt. Ltd. (collectively, “VyomAI”).

When you visit our public portal (vyomai.com), submit inquiries, engage our engineering teams for custom AI development, or access our deployed customer VPC systems, this policy governs the collection, processing, storage, and defense of all related data assets.

02. Information We Collect

We categorize the data collected into three primary streams to ensure explicit clarity:

  • Direct Client Inquiries & Account Information: Full name, professional email address, telephone number, organization name, project scope documentation, and technical requirements submitted via our discovery forms.
  • Engineering Deliverable Data: Repository schemas, architectural specifications, test datasets, and environment configurations explicitly provided by enterprise clients under mutual non-disclosure agreements (NDAs) for project execution.
  • Automated Telemetry & System Logs: Anonymized HTTP request headers, IP address (hashed), browser client identity, timestamped interaction metrics, and page latency logs utilized for infrastructure defense and DDoS mitigation.

03. Strict AI Model Training Safeguards

Binding Contractual Guarantee

At VyomAI, we recognize that our clients' data, proprietary algorithms, and enterprise domain knowledge constitute their greatest competitive moat. We maintain an unequivocal, non-negotiable architectural policy:

No Public Model Fine-Tuning: Client datasets, prompts, embeddings, and API inputs are NEVER used to train, retrain, or improve foundational open-weights models or shared AI infrastructure.
Dedicated VPC Deployment: All generative AI pipelines, vector stores, and neural networks are deployed within client-isolated virtual private clouds (VPC) with zero cross-tenant contamination.
Ephemeral Context Windows: In-flight LLM inferences utilize ephemeral memory spaces that are zeroed immediately upon response generation and socket closure.

04. How We Process & Use Data

VyomAI processes client and personal data solely under legitimate, well-defined legal grounds:

  • To execute custom software engineering contracts, AI model architectures, and cloud deployments.
  • To provide continuous technical support, bug remediation, and SLA-backed infrastructure maintenance.
  • To generate transparent project milestone estimates, architecture proposals, and billing schedules.
  • To maintain cybersecurity defenses, prevent malicious bot attacks, and protect client intellectual property.
  • To fulfill statutory legal compliance requirements, tax filings, and international regulatory filings.

05. Storage, Retention & Security Standards

VyomAI implements comprehensive technical and organizational safeguards across all software lifecycle tiers:

Encryption at Rest

FIPS 140-2 validated AES-256 cryptographic algorithms with annual key rotation via AWS KMS and HashiCorp Vault.

Encryption in Transit

Mandatory TLS 1.3 encryption across all API gateways, edge reverse proxies, and internal microservice mesh.

Access Governance

Zero Trust Network Architecture (ZTNA), mandatory hardware MFA keys, and audit logging retained in WORM storage.

Data Retention & Purge

Inactive project test data is cryptographically shredded within 30 calendar days following client handover acceptance.

06. Third-Party Sub-Processors

We never sell, rent, or monetize your personal or enterprise information to data brokers or third parties. We partner exclusively with enterprise-grade cloud providers subject to strict Data Processing Agreements:

ProviderFunctionData Center Location
Amazon Web Services (AWS)VPC Cloud Compute, Model Inference, Object StorageUS-East, EU-Central (Frankfurt), AP-South (Mumbai)
Microsoft AzureEnterprise Cloud Hosting & Private OpenAI InstancesNorth Europe, West US, Central India
MongoDB AtlasEncrypted Application Database & Vector SearchMulti-Region Enterprise Clustered

07. Your Statutory Rights

Regardless of your geographic location, VyomAI grants you robust control over your personal data:

01

Right to Access & Portability

Request a complete JSON/CSV export of all personal information we maintain regarding your account.

02

Right to Rectification & Correction

Update inaccurate or incomplete records promptly upon notifying our privacy operations desk.

03

Right to Erasure (“Right to be Forgotten”)

Request complete cryptographic deletion of all personal records, subject only to statutory tax retention duties.

08. Cookies & Telemetry Tracking

We maintain a minimal cookie policy. We only set cookies strictly necessary for site authentication, dark/light theme state, and session continuity. We do not employ third-party cross-site advertising pixels or surveillance trackers.

09. Cross-Border Data Transfers

For international clients located in the European Economic Area (EEA), the United Kingdom, or Switzerland, all data transfers are executed pursuant to the European Commission's Standard Contractual Clauses (SCCs) (Module 1 Controller-to-Controller and Module 2 Controller-to-Processor), guaranteeing equivalent data protection levels.

10. Contact Privacy Officer & DPO

To exercise your privacy rights, file a Data Subject Access Request (DSAR), or inquire about enterprise DPA execution, please connect with our Data Protection Officer:

VyomAI Privacy Office & Data Protection Officer

VyomAI Solutions Pvt. Ltd. • Greater Noida, Ghaziabad, Uttar Pradesh 201009, India

Official Email: privacy@vyomaisolutions.com / info@vyomaisolutions.com

Response Window: We acknowledge all privacy inquiries within 48 business hours.