Privacy Policy

This draft covers the public website and anticipated SaaS operations. The website identifies RlAA Tech as the AYOZRA operator. RlAA Tech must confirm its precise legal status and determine its role under applicable Indian data protection and privacy laws before this draft is treated as final.

Depending on features used, information may include account and contact details, business profile information, event and project records, user-generated content, support enquiries, device and log data, and subscription transaction references. Do not collect more information than is necessary for a stated purpose.

Payment card and banking credentials are expected to be handled by the selected payment provider. Do not store full card numbers, CVV values, UPI PINs or banking passwords in AYOZRA systems.

Information may be used to provide and secure the service, manage accounts and subscriptions, respond to enquiries, maintain records, troubleshoot issues, prevent abuse and meet legal obligations. The operator must map each purpose to the applicable legal basis and provide required notices and choices.

Information may be shared with infrastructure, hosting, database, analytics, communications and payment service providers where required to operate the service. The operator must maintain a current processor list, assess cross-border transfers where applicable and put appropriate contractual safeguards in place.

The operator must define retention periods by data category and purpose, including account records, support enquiries, billing records, logs and backups. Requests for access, correction, erasure or other rights should be handled through a documented process subject to applicable law.

The website may use essential technologies required for operation. Non-essential analytics or advertising technologies must not be enabled until the operator has documented the technologies, purposes, consent or opt-out requirements and retention settings.

Reasonable technical and organisational safeguards should be used to protect information. No system can be represented as risk-free. The operator must maintain an incident response process and comply with applicable breach notification obligations.

The service is intended for business users and is not designed to solicit personal information from children. The operator must add a verified privacy contact and a process for handling data principal requests before publication.