Data protection

Last updated: 24 October 2026

This page sets out how Elevare Research & Deployment Lab (“Elevare”, “we”, “us”) protects the data entrusted to us, and the commitments we make to organizations that use our Services. It sits alongside our Privacy policy (elevare.in/legal/privacy), which explains what personal data we collect and your rights over it.

Our principles

• Your data is yours. We process it to provide the Services, and for nothing else.
• We do not use customer data to train AI models without written permission.
• We do not sell data, or use it for advertising.
• We collect the least we need, and keep it no longer than we need it.

Our role

For data an organization puts into our Services, the organization is the Data Fiduciary under the DPDP Act and we are its Data Processor. We process that data only on its documented instructions, under a data processing agreement, which is available on request.

For data about our own visitors, waitlist and customers’ account holders, we are the Data Fiduciary, as set out in our Privacy policy.

Security measures

• Encryption in transit (TLS) and at rest.
• Each organization’s data kept separate from every other organization’s.
• Access for our staff only where needed to run or support the Services, with strong authentication, and logged.
• Secrets kept out of code, and personal data such as IP addresses hashed where we only need to recognize repeats.
• Rate limits and input checks that keep abuse out.
• Backups, and recovery we test.
• Security logs kept for at least one year.

AI and model providers

Some Services send data to AI model providers to produce a result. We use providers under terms that keep the data confidential and stop them training their models on it, and send them only what a request needs.

Where a Service acts on its own, it acts within limits the organization sets, and keeps a record of what it did.

Sub-processors

We use carefully chosen providers for hosting, databases, email delivery, payments and AI models. Each is bound by a written contract to protect the data at least as well as we do. Customers can ask for the current list, and we give notice before adding a sub-processor that will handle their data.

Breaches

If a personal data breach occurs, we act at once to contain it. We inform affected customers without delay, and the affected people and the Data Protection Board of India as the DPDP Rules, 2025 require, including a detailed report to the Board within 72 hours of becoming aware of it.

Retention and deletion

Customers can export their data at any time while their account is open and for 30 days after it closes. We then delete it from live systems, and from backups as they cycle out, within 90 days, apart from records the law requires us to keep.

Requests from authorities

We disclose customer data to a government authority only when the law obliges us to. Where the law allows, we tell the customer first so it can respond.

Questions

Security reports, questions, or a request for our data processing agreement: write to [contact email].