Privacy Policy

CyberInitiation is a brand of CINITIATION TECHNOLOGIES PRIVATE LIMITED, a company registered in India under CIN U73100DL2025PTC454312.

This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you visit cyberinitiation.in (the “Site”), use our free tools, run our AI chatbot, or engage our services.

We are the “Data Controller” for the personal data described below.

We collect the following categories of information:

a) Information you provide directly

• Contact & lead forms: name, email, phone number, company name, revenue range, service interest, project details, budget range, timeline.
• Free tools: the store URL you submit to our Store X-Ray, Speed Test, Stack Detector, and Revenue Leak Calculator tools.
• AI chatbot: the messages you send us through CYBERINITIATION AI, plus any contact details you voluntarily provide for lead follow-up.
• Newsletter: email address and name (if provided).
• Client accounts: when you engage us for services, we collect additional business information (billing address, GST number, etc.).

b) Information collected automatically

• Analytics: pages viewed, time on page, referral source, device type, browser, and general geographic location (country/city level).
• Technical: IP address, browser type, operating system, and session identifiers.
• Performance: Core Web Vitals data collected via Vercel Analytics.

c) Information from third parties

• Clerk: if you sign in to any authenticated area of our Site, Clerk provides us with your account identifier and email.
• Store X-Ray: when you submit a store URL, we fetch publicly available performance data from Google PageSpeed Insights on your behalf.

We use your information for the following purposes:

• To respond to your inquiries — reaching out about your audit request, project, or support question.
• To provide our services — including performance audits, headless builds, migrations, and AI automation.
• To run our free tools — Store X-Ray, Speed Test, Stack Detector, and Revenue Leak Calculator require the URL you provide to function.
• To operate our AI chatbot — your conversations are processed to generate responses and, when you show buying intent, to route you to our team.
• To send transactional and marketing emails — including audit reports, project updates, and occasional newsletters (you can unsubscribe at any time).
• To improve our Site and services — using aggregated, anonymised analytics.
• To comply with legal obligations — such as tax, accounting, and regulatory requirements under Indian law.

We process your personal data under the following legal bases:

• Consent — when you voluntarily submit a form, subscribe to our newsletter, or use our AI chatbot.
• Contract — when you engage us for services, we process data to perform the contract.
• Legitimate interests — for security, fraud prevention, and improving our services.
• Legal obligation — to comply with tax, accounting, and regulatory requirements.

Under India's Digital Personal Data Protection Act, 2023 (“DPDP Act”), you provide consent by an unambiguous affirmative action (such as submitting a form). Under GDPR, you provide consent by clicking submit or similar clear action.

We share limited personal data with the following processors. Each is bound by its own privacy policy and data processing agreement:

• Clerk — authentication and user management. Privacy policy
• Vercel — hosting, edge infrastructure, and analytics. Privacy policy
• Sanity — content management system. Privacy policy
• Resend — transactional email delivery. Privacy policy
• Groq — AI inference for our chatbot. Groq does not train on your data when using paid-tier infrastructure. Privacy policy
• OpenAI — for AI features. We use API-tier access which does not train on submitted data. Privacy policy
• Google Analytics 4 & PageSpeed Insights — analytics and performance data. Privacy policy

We never sell, rent, or trade your personal information to third parties for marketing purposes.

We retain personal data for the following periods:

• Contact & lead forms: 24 months from last interaction, unless you ask us to delete earlier.
• AI chatbot conversations: 90 days for training and quality, then deleted.
• Newsletter subscribers: until you unsubscribe.
• Client records: as required by Indian tax and company law (typically 8 years).
• Analytics data: as per the retention settings of Google Analytics (default 14 months) and Vercel Analytics (aggregated, no personal data).

Under the DPDP Act (India) and GDPR (EU), you have the following rights:

• Right to access — request a copy of the personal data we hold about you.
• Right to correction — request that we correct inaccurate information.
• Right to erasure — request that we delete your personal data (subject to legal retention obligations).
• Right to withdraw consent — at any time, for any processing based on consent.
• Right to data portability — receive your data in a structured, machine-readable format.
• Right to lodge a complaint — with the Data Protection Board of India or your local supervisory authority (in the EU).

To exercise any of these rights, email us at info@cyberinitiation.in. We respond within 30 days.

We implement the following security measures:

• Encryption in transit — all data transmitted via HTTPS/TLS 1.2+.
• Encryption at rest — databases and backups are encrypted.
• Access control — role-based access; production data is accessible only to required engineers.
• Infrastructure — hosted on Vercel Edge with SOC 2-compliant providers.
• Monitoring — anomaly detection and audit logging across all systems.
• Backups — daily encrypted backups with 30-day retention.

No system is 100% secure. If we ever experience a data breach affecting your personal data, we will notify you and the relevant authorities within the timelines required by law (72 hours under GDPR; as prescribed under the DPDP Act).

Some of our service providers are located outside India (primarily in the United States and the European Union). When we transfer personal data internationally, we ensure appropriate safeguards:

• Standard Contractual Clauses (SCCs) with EU-based processors.
• Data Processing Agreements with all sub-processors.
• Reliance on adequacy decisions where applicable.

Our services are intended for businesses and are not directed at children under 18. We do not knowingly collect personal data from anyone under 18. If you believe we have collected such data, please contact us immediately and we will delete it.

We may update this Privacy Policy periodically. When we make material changes, we will notify you via email (if you have an account) or by prominent notice on the Site. The “Last Updated” date at the top of this page reflects the most recent revision.

For any privacy questions, requests, or complaints, contact: