Who we are and what this Policy covers
Data Fiduciary. AXIOMAERA Private Limited, a company incorporated under the Companies Act, 2013 (CIN U62011MH2026PTC467707), with its registered office in Maharashtra, India (“Axiomaera”, “we”, “us”), determines the purpose and means of processing the personal data described in this Policy and is the Data Fiduciary for it.
Scope. This Policy applies to the website at axiomaera.com, its language versions and any page that links to it (the “Site”). It does not apply to Khoj, Airavata or any other product or service of Axiomaera. Each of those is governed by its own privacy notice, shown to you before any personal data is collected there.
Relationship to the law. Nothing in this Policy limits any right you have under the Digital Personal Data Protection Act, 2023 (the “Act”), the Digital Personal Data Protection Rules, 2025 (the “Rules”), the Information Technology Act, 2000 or any other law in force in India. Where this Policy and the law differ, the law prevails.
Words we use
In this Policy, “personal data”, “processing”, “Data Principal”, “Data Fiduciary”, “Data Processor”, “consent”, “personal data breach” and “Board” have the meanings given to them in the Act. In short:
Personal data is any data about an individual who can be identified by or in relation to that data.
Data Principal is the individual the personal data relates to, which on this Site means you. For a child, it includes their parent or lawful guardian; for a person with a disability, their lawful guardian acting on their behalf.
Data Processor is a company that processes personal data on our behalf and on our written instructions.
Board means the Data Protection Board of India established under the Act.
The personal data we collect
We collect personal data only in the following ways, and no other:
When you write to us. Through the contact form: your full name, work email address, organisation, the topic you select and the contents of your message. Please do not include sensitive personal data such as financial, health, biometric or government identity information in a message; we do not need it.
When you request early access to Airavata. Your full name, work email address, organisation and, if you choose to give it, your role, together with a record of the consent you give by ticking the box on the form.
When you apply to work with us. If you choose the careers topic, anything you decide to share about your experience. We will tell you separately before collecting anything more, such as a CV.
When you browse. Technical data that every web server receives: your IP address, browser and device type, the page requested, the referring page, and the date and time of the request. We also receive aggregate, cookieless page-view statistics.
When you choose a language. A single cookie that remembers your preferred language. It contains only a two-letter language code.
We do not collect personal data from third-party sources, data brokers or social networks, and we do not combine the data you give us with data obtained elsewhere.
Why we process it, and on what legal basis
We process each category of personal data only for the purposes stated here, and only to the extent necessary for them:
To reply to your enquiry or early-access request. Basis: your consent under section 6 of the Act, given when you submit the form after being shown the notice beside it.
To contact you about Airavata early access. Basis: your specific consent, given by ticking the consent box. We use it for that purpose alone, not for marketing of anything else.
To keep the Site secure and working. This covers detecting abuse, preventing fraud, enforcing rate limits on forms and investigating security incidents. Basis: the legitimate uses permitted under section 7 of the Act, including compliance with law and directions issued under it.
To comply with the law. This covers maintaining logs required by directions of the Indian Computer Emergency Response Team (CERT-In) under section 70B of the Information Technology Act, 2000, and responding to lawful requests from authorities. Basis: section 7 of the Act.
To understand how the Site is used. Aggregate page-view counts only, without cookies and without identifying you.
We will not use your personal data for any purpose that is not compatible with these, unless we first give you a fresh notice and, where the law requires, obtain your fresh consent.
Consent, and withdrawing it
Where we rely on consent, it is free, specific, informed, unconditional and unambiguous, as section 6 of the Act requires. It is given by a clear affirmative action, never by a pre-ticked box or by silence.
You may withdraw consent at any time, as easily as you gave it, by writing to privacy@axiomaera.com from the address you used. Withdrawal does not affect processing lawfully carried out before it. Once you withdraw, we stop processing and erase the personal data concerned within a reasonable time, unless the law requires us to keep it.
Cookies and similar technologies
The Site uses one cookie, and only after you choose a language. It is set by axiomaera.com, contains your two-letter language code, expires after twelve months and is used for nothing else.
We do not use advertising cookies, tracking pixels, fingerprinting or session-recording tools. Our analytics provider, Vercel Analytics, counts page views without cookies and without storing anything on your device.
You can delete or block the language cookie in your browser at any time. The Site will continue to work; it will simply show English until you choose again.
Who we share it with
We do not sell, rent, trade or license personal data to anyone, and we never will.
We share personal data only with Data Processors who help us run the Site, under written contracts that require them to process it solely on our instructions, keep it confidential and protect it with reasonable security safeguards, as section 8(2) of the Act requires:
Vercel Inc. hosts and delivers the Site and provides cookieless analytics.
Resend delivers the emails generated when you submit a form to our team.
Our email provider stores the correspondence that follows.
We may also disclose personal data where a law in force in India requires it, or in response to a lawful order of a court, tribunal or authority with jurisdiction. Where the law permits, we will tell you before we do.
If Axiomaera is involved in a merger, demerger, acquisition or similar arrangement approved under law, personal data may pass to the successor entity, which will remain bound by this Policy until it gives you notice of its own.
Transfers outside India
The Site is delivered through a global network, so some technical data and form submissions may be processed by our Data Processors on servers outside India. Section 16 of the Act permits such transfers except to countries or territories that the Central Government restricts by notification. We will not transfer personal data to any restricted country or territory, and our contracts require each Data Processor to give your personal data protection no weaker than this Policy, wherever it is processed.
How long we keep it
We keep personal data only for as long as the purpose for which it was collected is being served, and then erase it, as section 8(7) of the Act requires:
Enquiries and early-access requests: until the conversation is concluded, and in any case no later than 24 months after our last exchange with you.
Records of consent and withdrawal: for as long as needed to demonstrate that we acted lawfully on them, after which they are erased.
Server and security logs: for the minimum period required by law, including the DPDP Rules, 2025 and directions issued by CERT-In, after which they are deleted.
Language cookie: twelve months, or until you delete it.
Before we erase personal data because its purpose has been served, we will, where the Rules require it, give you at least 48 hours’ notice so that you can tell us if you wish it kept.
How we protect it
We protect personal data with reasonable security safeguards, as required by section 8(5) of the Act and the Rules. These include:
Encryption of data in transit (HTTPS with HTTP Strict Transport Security) and at rest with our Data Processors.
A strict Content Security Policy, protection against framing and other hardening headers on every page.
Validation, size limits and rate limits on every form, so nothing malformed or abusive reaches our systems.
Access limited to the people who need it to reply to you.
Logging and monitoring sufficient to detect, investigate and remediate unauthorised access.
No system is perfectly secure. If you believe your data or the Site has been compromised, please tell us at once at privacy@axiomaera.com.
If something goes wrong
If a personal data breach affects you, we will inform you without delay, in plain language, of what happened, its likely consequences, what we have done to limit them, what you can do to protect yourself, and whom to contact.
We will also inform the Data Protection Board of India, and any other authority the law requires, in the form and within the time prescribed by the Rules, and report the incident to CERT-In where its directions require it.
Your rights
Under the Act you have the following rights, which you may exercise free of charge:
Access (section 11): to obtain a summary of the personal data we hold about you and the processing we carry out, and the identities of those we have shared it with.
Correction, completion and updating (section 12): to have inaccurate or incomplete personal data corrected, completed or updated.
Erasure (section 12): to have your personal data erased, unless we are required by law to keep it.
Withdrawal of consent (section 6): at any time, with effect for the future.
Grievance redressal (section 13): to have any complaint about our handling of your personal data heard and answered.
Nomination (section 14): to nominate another person to exercise these rights on your behalf in the event of your death or incapacity.
To exercise a right, write to privacy@axiomaera.com from the email address you used with us, or tell us how we can otherwise verify that you are the person concerned. We will confirm receipt, may ask for the minimum information needed to verify your identity, and will act on your request within the period prescribed by the Rules.
Children and persons with disabilities
The Site is meant for adults acting for themselves or their organisations. We do not knowingly collect personal data from anyone under eighteen, and we do not track, profile or direct advertising at children.
If you are the parent or lawful guardian of a child, or the lawful guardian of a person with a disability, and you believe their personal data has reached us without your verifiable consent, write to us and we will erase it.
Your duties
Section 15 of the Act asks every Data Principal to comply with the law, not to impersonate another person, not to suppress material information when providing personal data, not to register false or frivolous grievances, and to provide only verifiably authentic information when exercising the right to correction or erasure. A breach of these duties can attract a penalty under the Act.
Grievance Officer and how to reach us
Our Grievance Officer answers every question and complaint about personal data on this Site:
Grievance Officer, AXIOMAERA Private Limited, Maharashtra, India
Email: privacy@axiomaera.com
Acknowledgement: within 72 hours of receipt.
Resolution: as soon as possible, and in any case within the period prescribed by the Rules.
If you are not satisfied with our response, you may, after exhausting this process as section 13(3) of the Act requires, file a complaint with the Data Protection Board of India.
Links to other sites
The Site links to other websites, including those of our partners and programmes, and to khoj.axiomaera.com. Each operates under its own privacy policy. We are not responsible for the practices of sites we do not control, and we encourage you to read their policies before sharing anything with them.
Changes to this Policy
We will update this Policy when our practices or the law change. The date at the top always shows when it last changed. If a change materially affects how we process personal data you have already given us, we will tell you directly before it takes effect and, where the law requires, ask for your consent again.
Language of this Policy
This Policy is published in English, which is its authoritative version. Other parts of the Site are offered in twelve Indian languages for your convenience. If you would like help understanding this Policy in your language, write to privacy@axiomaera.com and we will explain it to you.