Privacy Policy

1. About this Privacy Policy

This Privacy Policy explains how Vezras Technologies Private Limited ("Vezras", "we", "us" or "our") handles personal data when an individual visits our website, requests or uses a demo, communicates with us, applies for a role, attends an event, or uses services supplied by Vezras. "Personal data" means information that identifies an individual or can reasonably be linked to an individual.

This policy should be read together with any customer agreement, data processing addendum, consent statement or other notice presented for a specific interaction. Where a customer agreement governs Customer Content, that agreement controls to the extent of any inconsistency.

2. Vezras's role and scope

Vezras acts in different privacy roles depending on the context:

• For website visitors, prospects, business contacts, job applicants and users who deal directly with Vezras, Vezras generally determines why and how personal data is processed.

• For data submitted to, connected with or generated through an enterprise customer’s use of Vezras ("Customer Content"), the customer generally determines the purposes of processing and Vezras processes that data on the customer’s documented instructions.

If you use Vezras through your employer or another organisation, that organisation’s privacy notice may provide the primary information about how your personal data is handled. Requests concerning Customer Content should usually be directed to that organisation; Vezras will support the customer as required by applicable law and contract.

3. Personal data we collect

1. Contact and identity data. Name, work email address, telephone number, job title, organisation and similar business-contact information when provided.

2. Demo account data. For demo accounts, Vezras collects the user’s name and work email address.

3. Account and access data. User role, permissions, account status, authentication and security information used to establish and manage access.

4. Inquiry and relationship data. Information provided in forms, meeting requests, proposals, contracts, events and records of our business relationship. This includes information from a demo or partnership form you begin but do not finish, captured once a work email address has been entered.

5. Communications and support data. Messages, meeting details, feedback, support requests and related records.

6. Technical and usage data. IP address, browser and device information, operating system, timestamps, referring pages, diagnostic logs, feature usage and security events.

7. Website analytics data. Information collected through Google Analytics 4 on vezras.com, including online identifiers and information about website interactions.

8. Customer Content. Business data, documents, records, prompts, queries, outputs, metadata and other information that a customer or authorised user submits, connects or makes available through the services. Customer Content may contain personal data selected by the customer.

9. Recruitment data. Application materials, employment and education history, interview information, work-authorisation information and information supplied by references or recruitment partners.

10. Compliance data. Information reasonably required for security, fraud prevention, dispute handling, audits and compliance with legal obligations.

4. How we collect personal data

• directly from you through forms, demos, meetings, events, support channels and job applications;

• from a demo or partnership form you begin completing on our website, captured once you have entered a work email address, even if you do not submit the form;

• from the organisation that provides you access to Vezras or asks us to interact with you;

• automatically from browsers, devices and service activity through logs and website analytics technologies;

• from systems and applications that a customer expressly authorises Vezras to connect with;

• from service providers, recruitment partners and business partners; and

• from lawful public sources, such as company websites and professional networking platforms.

5. How we use personal data

• provide, configure, operate, support and maintain the website, demos and enterprise services;

• authenticate users, administer accounts and enforce access permissions;

• connect customer-authorised data sources and generate analyses, alerts, recommendations, scenarios and other service outputs;

• respond to enquiries, arrange demonstrations, provide support and manage customer relationships and contracts;

• monitor performance, diagnose errors, improve usability and develop service functionality;

• protect users, customers, Vezras and others by preventing misuse, fraud and security incidents;

• send service notices and, where permitted, information about Vezras offerings, events and updates;

• evaluate job applications and manage recruitment;

• maintain business records, establish or defend legal claims, comply with applicable law and respond to lawful requests; and

• create aggregated or de-identified information that does not reasonably identify an individual.

6. Legal grounds for processing

Where applicable law requires a legal basis or other lawful ground for processing, Vezras relies on the ground appropriate to the circumstances, which may include consent, performance of a contract or steps requested before entering a contract, compliance with legal obligations, permitted legitimate uses, or legitimate interests where recognised by applicable law and not overridden by an individual’s rights. Where processing is based on consent, consent may be withdrawn prospectively, subject to applicable legal and contractual limitations.

7. Customer Content and Vezras Enterprise OS

Vezras Enterprise OS is designed to connect authorised information across a customer’s existing systems, contextualise that information and provide decision-support insights. Vezras does not obtain unrestricted access to a customer’s systems merely because an integration is available.

• The customer decides which systems, records and users are connected and is responsible for having authority to provide or make that data available.

• Vezras processes Customer Content only to provide, secure, maintain and support the contracted services and as otherwise documented in the applicable customer agreement.

• Customer Content is hosted in Amazon Web Services (AWS) in the ap-south-1 (Mumbai, India) region.

• Access to Customer Content by Vezras personnel is limited to authorised personnel and legitimate operational purposes, such as implementation, support, troubleshooting, security and service maintenance.

• Vezras applies role-based and permission-aware access controls designed to respect the customer’s authorised access model.

• Prompts, queries and AI-generated outputs may contain personal data where a customer or authorised user includes or exposes personal data to the service.

8. AI-enabled features and model training

Vezras currently uses Amazon Bedrock for AI model access, including DeepSeek V3.2. AI features may analyse Customer Content and generate recommendations, summaries, explanations, scenarios or other outputs for authorised users.

No AI training with Customer Content. Vezras does not use Customer Content, including data obtained through customer-authorised integrations, prompts, queries or AI-generated outputs, to train foundation models or general-purpose AI models.

AI-generated outputs may be incomplete or inaccurate. Vezras provides decision-support capabilities; customers and their authorised users remain responsible for reviewing outputs and for business, employment, financial or other consequential decisions. Vezras’s service design requires human authorisation for consequential action rather than treating an AI recommendation as an independent final decision.

9. Service providers and customer-authorised integrations

Service providers used by Vezras

• Amazon Web Services (AWS), including Amazon Bedrock — cloud infrastructure and AI model access;

• Cloudflare — DNS, content delivery, network performance and security services; and

• Google Workspace — business email and communications.

These providers may process personal data only to the extent necessary for the services they provide to Vezras, subject to applicable contractual and security obligations.

Customer-authorised data-source connectors

Vezras also supports integrations that customers choose to connect through OAuth or other authorised mechanisms. Current examples include Zoho Books, Zoho CRM, Zoho People, Zoho Projects, Zoho Sprints, HubSpot, Salesforce and GitHub. For these integrations, Vezras retrieves data that the customer has authorised Vezras to access in order to provide the service. These connected services are not treated as Vezras service providers merely because a customer connects them.

10. How we disclose personal data

• authorised users and administrators of the relevant customer account;

• service providers identified above and other professional advisers or vendors where necessary to operate Vezras and subject to appropriate obligations;

• third-party services or integrations selected or authorised by a customer or user;

• auditors, insurers, financial institutions and professional advisers where reasonably necessary;

• government bodies, regulators, courts or law-enforcement bodies where disclosure is required by applicable law or a valid legal process; and

• an acquirer, successor or relevant counterparty in connection with a merger, financing, reorganisation or sale of assets, subject to appropriate safeguards.

Vezras does not sell personal data for monetary consideration. We may also disclose personal data at your direction or with your consent.

11. Hosting, data location and international processing

Customer Content processed by Vezras Enterprise OS is hosted in AWS ap-south-1 (Mumbai, India), including the production environment used for Customer Content. Vezras’s service providers may separately process limited business-contact, communications, analytics, network or technical data in locations where they operate. Where an international transfer of personal data is subject to legal requirements, Vezras will use an appropriate lawful transfer mechanism or safeguard as required by applicable law.

12. Data retention and deletion

Unless a longer period is required by law or a customer agreement requires a shorter period, Vezras applies the following standard retention periods:

A demo or partnership form you begin but do not submit is treated as a sales/contact enquiry for retention purposes, and follows the same standard retention period above, measured from when it was last updated.

Customer Content after termination

Following termination or expiry of a customer’s services, Vezras will delete that customer’s Customer Content from active production systems within 30 days, unless the customer requests earlier deletion, the applicable customer agreement provides otherwise, or retention is required by law. Residual copies may remain in protected backups for up to 3 years in accordance with Vezras’s backup-retention schedule. Backup copies are not used for ordinary business purposes and are accessed or restored only where necessary for disaster recovery, security, legal obligations or other legitimate continuity purposes.

13. Security

Vezras uses administrative, technical and organisational measures designed to protect personal data and Customer Content against unauthorised access, loss, misuse, alteration or disclosure. Measures include role-based access controls, authentication, encryption where appropriate, logging, monitoring, vulnerability management, personnel controls and incident-response procedures. Access to Customer Content by Vezras personnel is restricted to authorised personnel with a legitimate operational need.

No method of transmission or storage is completely secure. Users are responsible for safeguarding their credentials, using approved access methods and promptly reporting suspected unauthorised activity.

14. Authentication, cookies and similar technologies

vezras.com

The Vezras marketing website uses Google Analytics 4 (measurement ID G-HX38X46HYY) to understand website traffic and usage. Google Analytics may use analytics cookies and related identifiers. Vezras also uses Google Fonts for website presentation. Vezras does not currently use Hotjar, Meta Pixel or other advertising trackers on vezras.com.

Where consent is required by applicable law for non-essential analytics technologies, Vezras will obtain the required consent before using them. Browser settings may also allow users to block or delete cookies.

demo.vezras.ai

The Vezras demo/product does not use cookies for authentication. Authentication uses bearer tokens stored in the user’s browser localStorage. localStorage is browser storage and is not a cookie, but it is a similar client-side storage technology. Users should sign out when using a shared or untrusted device.

15. Your rights and choices

Depending on applicable law and the circumstances, you may have rights concerning your personal data, including rights to request information about or access to personal data, correct inaccurate data, request deletion, withdraw consent where processing is based on consent, opt out of marketing, raise a grievance, nominate another person where applicable, or complain to a competent data-protection authority.

To exercise a right relating to data Vezras controls directly, contact us using Section 19. We may need to verify your identity or authority. For Customer Content, please normally submit your request to the customer organisation that controls your account or data. If Vezras receives such a request directly, we may refer it to the relevant customer and will provide assistance as required by applicable law and contract.

16. Children's privacy

Vezras’s website and enterprise services are intended for organisations and business users and are not directed to children. Vezras does not knowingly seek to collect children’s personal data through the website or direct marketing. If you believe a child has provided personal data to Vezras without appropriate authorisation, please contact us.

17. Third-party services and links

The website or services may link to or integrate with third-party websites, applications and services. Their privacy practices are governed by their own notices. Customers should review the relevant third-party terms and privacy notices before authorising an integration.

18. Changes to this policy

We may update this Privacy Policy to reflect changes in our services, data practices or legal obligations. We will post the revised version and update the effective date. Where required by applicable law, or where a change materially affects how personal data is used, we will provide additional notice or obtain consent as required.

19. Contact and grievance redressal

Questions, privacy-rights requests and grievances may be sent to:

We will acknowledge and address privacy requests and grievances in accordance with applicable law and our internal processes. If you are not satisfied with our response, you may have the right to contact the competent data-protection authority.