Privacy Policy
Effective Date: November 2026. This Privacy Policy governs the collection, processing, retention, and protection of enterprise and personal data by Sambhav AI & Tech Services under India's Digital Personal Data Protection Act, 2023 (DPDP Act) and the General Data Protection Regulation (GDPR).
1. Overview & Regulatory Framework
Sambhav AI & Tech Services ("Sambhav", "we", "our", or "us") operates as an enterprise technology consulting and software engineering firm headquartered in Maharashtra, India. We operate strictly in a professional business-to-business (B2B) context.
This Privacy Policy explains how we collect, process, safeguard, and dispose of business and personal data submitted through sambhavaintech.com (the "Site"). Our data practices adhere to two governing frameworks:
DPDP Act, 2023
We serve as a Data Fiduciary under the Digital Personal Data Protection Act, 2023. We collect only necessary enterprise consultation data under specified consent and lawful business grounds.
GDPR & UK GDPR
Where we interact with prospective enterprise clients or visitors located within the European Economic Area (EEA) or the United Kingdom, Sambhav serves as a Data Controller under Regulation (EU) 2016/679.
2. Lawful Grounds for Processing
We process personal and organizational data only where a substantiated lawful basis exists:
When you submit a consultation request on our Contact page, processing your name, professional title, corporate email, and project challenge is necessary to respond, assess architectural feasibility, and prepare preliminary discussion materials.
For optional telemetry and analytics cookies (Google Analytics 4), processing is grounded strictly in affirmative, freely given consent. We enforce zero analytics tracking until you click "Accept Analytics" on our cookie banner.
Protecting our site against distributed attacks, bot form spam, and malicious injections using transient IP rate-limiting and Cloudflare Turnstile token verification.
Compliance with applicable corporate governance, taxation, and accounting records under Indian corporate law once an enterprise prospect progresses into a formal executed engagement.
3. Information Collected via the Enterprise Consultation Form
When an enterprise representative submits an inquiry via /contact, we collect only the business data necessary to conduct technical scoping:
| Data Category | Specific Information | Business Purpose |
|---|---|---|
| Identity & Role | Full Name and Corporate Designation | To address you properly and understand your organizational scope. |
| Enterprise Identity | Company / Organisation Name | To verify corporate identity and prevent engagement conflicts. |
| Direct Communication | Business Work Email Address | Direct channel to reply with technical proposals and schedule calls. |
| Domain & Technical Scope | Industry Vertical & Area of Interest | Matches your inquiry with our domain specialists (Infrastructure, Manufacturing, Healthcare, AI/ML, Automation). |
| Challenge Narrative | Operational Challenge Description | Enables senior engineering consultants to prepare contextual architecture insights prior to an initial discovery call. |
| Security Telemetry | Transient IP Address & Turnstile Verification Token | Restricted to in-memory sliding window rate-limiting (max 5 submissions per 15 min) and bot mitigation. Not combined with ad networks. |
4. Data Processing Pipeline & Security Measures
Sambhav implements technical, physical, and organizational safeguards to ensure confidentiality, integrity, and availability:
- Encrypted Transit: All web traffic and form submissions are encrypted in transit using Transport Layer Security (TLS 1.3).
- Input Sanitization: Form fields undergo server-side strict sanitization and character escaping to prevent cross-site scripting (XSS) and injection attacks.
- Anti-Bot & Abuse Shields: Submissions are validated through invisible Cloudflare Turnstile cryptographic checks and honeypot traps.
- Secure Dispatch: Inquiries are routed via the Resend API infrastructure over authenticated TLS directly to Sambhav's enterprise email boxes with multi-factor authentication (MFA) enforcement.
5. Cookies, Google Consent Mode v2 & Telemetry
We maintain strict accent discipline in our technical telemetry:
- Zero Pre-Consent Tracking: When you first arrive, Google Consent Mode v2 initializes all storage flags to
denied. No Google Analytics 4 scripts are fetched or injected until you explicitly click "Accept Analytics". - Immediate Purge on Rejection: If you select "Reject Non-Essential" or update your preference via the footer, any pre-existing analytics identifiers (
_ga,_ga_*) are actively cleared from your browser document. - Global Privacy Control (GPC): If your browser transmits a GPC opt-out signal (
navigator.globalPrivacyControl), our platform automatically respects this signal and disables non-essential telemetry by default.
Cookie & Storage Disclosure Table
| Identifier | Provider | Category | Lifespan | Purpose |
|---|---|---|---|---|
| sambhav_cookie_consent | Sambhav (1st Party) | Strictly Necessary | 12 Months | Stores whether the visitor accepted or rejected optional analytics telemetry. |
| _ga | Google Analytics 4 | Measurement (Optional) | 2 Years | Distinguishes unique enterprise sessions in aggregate. Off until accepted. |
| _ga_* | Google Analytics 4 | Measurement (Optional) | 2 Years | Maintains session state and aggregated interaction counts. Off until accepted. |
| cf_clearance / Turnstile | Cloudflare | Strictly Necessary | Session / Ephemeral | Verifies human origin and prevents automated spam attacks on our consultation form. |
You can reopen your choices at any time by clicking the "Cookie Preferences" link in the website footer.
6. Data Retention & Deletion Schedule
We store enterprise business inquiries only for the duration required to evaluate, scope, and conduct commercial discussions:
- Uncontracted Inquiries: Consultation inquiries that do not result in a commercial advisory or implementation engagement are safely archived and permanently deleted within 24 months from the date of the last communication.
- Contracted Enterprise Engagements: Client project data, formal architectural blueprints, and correspondence are governed under individual Master Services Agreements (MSAs) and retained for 7 to 8 years in compliance with statutory Indian taxation and corporate record-keeping laws.
- Security Log Telemetry: In-memory IP rate-limiting records are cleared automatically on a 15-minute sliding window.
7. Your Rights under DPDP Act & GDPR
Depending on your jurisdiction, you hold enforceable rights regarding your personal information:
Under India's DPDP Act, 2023:
- • Right to Access Information: Request a summary of personal data and processing activities.
- • Right to Correction & Erasure: Rectify inaccurate details or request deletion of obsolete records.
- • Right of Grievance Redressal: Direct grievances to our designated Grievance Officer.
- • Right to Nominate: Nominate an individual to exercise rights in the event of death or incapacity.
Under GDPR (EEA / UK Visitors):
- • Right to Access (Art. 15): Obtain confirmation and copies of personal data held.
- • Right to Rectification (Art. 16): Correct inaccurate personal data.
- • Right to Erasure (Art. 17): "Right to be forgotten" where processing is no longer required.
- • Right to Restriction & Objection (Arts. 18, 21): Limit or object to specific processing grounds.
- • Right to Data Portability (Art. 20): Receive data in a structured, machine-readable format.
8. Statutory Grievance Redressal & Supervisory Escalation
In accordance with Section 12 of India's DPDP Act, 2023 and GDPR Article 38, we have established a dedicated desk for data protection inquiries, access requests, and grievance redressal:
Data Protection & Grievance Redressal Officer
Sambhav AI & Tech Services · Maharashtra, Republic of India
Regulatory Escalation Channels:
India: If your data grievance is not resolved to your satisfaction by our Grievance Officer within 30 days, you hold the statutory right to lodge a formal complaint with the Data Protection Board of India.
European Union / UK: If you are based in the EEA or UK, you hold the right to lodge a complaint with your local Data Protection Authority (DPA) or the UK Information Commissioner's Office (ICO).