Privacy Policy

1. Who we are

Krylox LLP is an MLOps and AI inference engineering firm registered in India (Data Fiduciary under the Digital Personal Data Protection Act, 2023, “DPDPA”). Our registered address and principal place of business is Chennai, Tamil Nadu, India. You can contact us at hello@krylox.ai.

2. Data we collect

We collect only what is necessary to respond to your enquiry:

• Contact form: first name, last name, work email, company name, service of interest, and a free-text message.
• Usage data: standard server logs (IP address, browser type, pages visited). These are not linked to your identity and are retained for 30 days.

We do not use advertising cookies, tracking pixels, or third-party analytics that profile you across sites.

3. Legal basis for processing

We process your personal data on the following bases under the DPDPA:

• Consent (§6): when you submit our contact form, you consent to us processing the data provided for the purpose of responding to your enquiry. Your consent is free, specific, informed, and unambiguous.
• Certain legitimate uses (§7): where you have voluntarily provided your personal data to us and have not indicated that you do not consent to its use for the purpose for which it was provided.

4. How we use your data

Your data is used solely to:

• Respond to your enquiry and assess your technical requirements.
• Send you information relevant to the services you asked about.

We do not sell, rent, or share your personal data with third parties for marketing purposes.

5. Data processors

We engage the following Data Processors under valid contracts, who process your data only on our behalf and for the purposes described above:

• Resend Inc. (USA), email delivery. Processes your name and email address solely to transmit our reply.
• Vercel Inc. (USA), website hosting, analytics, and performance monitoring. Processes your IP address, browser type, and pages viewed to serve this site and produce aggregate traffic and performance statistics.
• Apollo Data Company, Inc. (USA), website visitor identification. Only where you have consented, processes your IP address, pages viewed, and any identifier associated with prior email correspondence, in order to identify the organisation you are visiting from for our business development purposes.

We remain responsible for compliance with the DPDPA in respect of all processing undertaken by these processors on our behalf (§8(1)).

6. Withdrawal of consent

Where consent is the basis of processing, you may withdraw it at any time. Withdrawal is as easy as giving consent, simply email hello@krylox.ai. Upon withdrawal we will, within a reasonable time, cease processing and direct our Data Processors to do the same, unless processing without your consent is authorised under the DPDPA or any other law (§6(4)–(6)). Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

7. Retention

Enquiry data is retained only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable law. Once the specified purpose is no longer being served, we erase the data and direct our processors to do the same (§8(7)). In practice this is typically no longer than 3 years after the last interaction.

8. Children's personal data

Our services are directed at businesses and professionals. We do not knowingly collect or process personal data of children (individuals under 18 years of age). If we become aware that we have inadvertently received personal data of a child, we will erase it without undue delay. We do not undertake behavioural monitoring of children or targeted advertising directed at children (§9).

9. Personal data breach notification

In the event of a personal data breach that compromises the confidentiality, integrity, or availability of your personal data, we will notify the Data Protection Board of India and each affected Data Principal in the manner prescribed under §8(6) of the DPDPA.

10. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure, and to prevent personal data breaches (§8(4)–(5)). All data is transmitted over HTTPS.

11. Your rights (DPDPA 2023)

As a Data Principal you have the following rights under the DPDPA:

• Right to access information (§11): obtain a summary of the personal data we are processing about you, the processing activities undertaken, and the identities of any other Data Fiduciaries or Data Processors with whom your data has been shared.
• Right to correction, completion, and updating (§12): request that we correct inaccurate or misleading data, complete incomplete data, or update your data.
• Right to erasure (§12): request erasure of your personal data where it is no longer necessary for the specified purpose and retention is not required by law.
• Right to grievance redressal (§13): raise a grievance about the performance of our obligations or the exercise of your rights under the DPDPA. We will respond within 72 hours of receipt.
• Right to nominate (§14): nominate another individual to exercise these rights on your behalf in the event of your death or incapacity.

To exercise any of these rights, email our Grievance Officer at hello@krylox.ai. If your grievance is not resolved to your satisfaction, you may approach the Data Protection Board of India in the manner prescribed under the DPDPA (§13(3)).

12. Cookies

We store one functional preference: a cookie_consent value in your browser's local storage, recording whether you accepted or declined non-essential tracking. It is stored whichever choice you make, and is necessary for the site to honour it.

If you accept, we load the Apollo website tracker, a third-party service that identifies the organisation associated with your IP address and records the pages you view, so that our team can follow up with interested organisations. If you decline, this script is never loaded. You can change your decision at any time by clearing this site's local storage in your browser.

We also use Vercel Web Analytics and Vercel Speed Insights, which collect aggregate page view and performance data without setting cookies. We do not use Google Analytics or any advertising network.

13. Cross-border data transfers

Your data may be processed by our Data Processors outside India (see §5 above). Resend Inc., Vercel Inc., and Apollo Data Company, Inc. are all located in the United States, and data processed by them is transferred outside India accordingly. Such transfers are subject to any restrictions notified by the Central Government under §16 of the DPDPA. We ensure that processors outside India are bound by contractual obligations equivalent to those required under the DPDPA.

14. Governing law

This policy is governed by the laws of India, including the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000. Any disputes shall be subject to the exclusive jurisdiction of the courts of Chennai, Tamil Nadu.

15. Changes

We may update this policy from time to time. Material changes will be noted at the top of this page with an updated date.