This policy describes our general approach to personal data. For how our AI product handles data specifically, see the CULTTER.AI Privacy & Data page. For a formal request about your data, use the Data Request form.
Who we are
ZIVOX is a technology and digital solutions company based in India. In this policy, "ZIVOX", "we", "us" and "our" refer to ZIVOX. Our operating address is Bapudham Chandrahiy, Motihari, Bihar, India.
For privacy questions, contact info@zivox.co.in.
Scope of this policy
This policy applies to personal information we process when you:
- visit the ZIVOX website;
- submit a form on any ZIVOX page (contact, quote, consultation, enquiry, application, feedback, report or request);
- ask to be notified when AI Innovation Challenge 2027 registration opens;
- submit a sponsorship or collaboration enquiry;
- submit a grievance through the Grievance Redressal Portal;
- subscribe to our newsletter;
- request access to, or use, CULTTER.AI;
- communicate with us by phone or email;
- engage us for services.
Information we collect
We aim to collect the minimum needed. Depending on the form you use, this may include:
| Category | Examples | Required? |
|---|---|---|
| Identity & contact | Name, email address, phone number | Usually required to reply |
| Organisation details | Company name, website URL | Optional unless relevant |
| Enquiry content | Message, project details, requirements | Required |
| Application data | Experience, portfolio link, resume URL | Required for applications |
| Feedback data | Rating, comments, publish permission | Required for feedback |
| Challenge notification request | Preferred contact method (Email or WhatsApp), either an email address or a 10-digit mobile number, and your consent | Required for that form |
| Sponsorship enquiry | Full name, organization, work email, optional phone, interest category and message | Required except phone |
| Grievance | Full name, email, optional phone, category, subject, description, optional reference number, and the grievance reference we issue back to you | Required except phone and reference |
| Team directory | Name, designation(s), profile photo, biography and any professional details ZIVOX publishes about its own staff | Published only when the administrator marks the profile visible |
| Technical data | Page path, browser user-agent string | Recorded automatically with submissions |
| Consent records | Consent flag, timestamp | Recorded automatically |
We do not ask for government identifiers, financial account numbers, health information or biometric data through our public forms. Please do not submit such information.
Why we process your information
We process personal information for these specific purposes:
- responding to enquiries, quote requests and consultation bookings;
- preparing proposals and delivering services you have requested;
- assessing job and internship applications;
- sending newsletters you have subscribed to;
- providing access to and support for CULTTER.AI;
- investigating reported issues, security incidents and abuse;
- handling data requests and grievances, including recording the grievance reference;
- notifying you when AI Innovation Challenge 2027 registration opens, if you asked us to;
- responding to sponsorship and collaboration enquiries;
- publishing a team directory of ZIVOX staff who have been approved for publication;
- meeting legal, accounting and regulatory obligations.
We do not use your information for purposes unrelated to those you were told about when you provided it, unless you agree or the law requires it.
Legal basis and consent
We rely on your consent for most processing, obtained through the explicit consent checkbox on each form. Where processing is necessary to perform a contract with you, or to comply with a legal obligation, we rely on that basis instead.
You may withdraw consent at any time. Withdrawal does not affect processing already carried out. To withdraw, use the Data Request form and select "Withdraw consent".
How long we keep information
| Type | Indicative retention |
|---|---|
| General enquiries | Up to 24 months from last contact |
| Project and client records | Duration of engagement plus 7 years (accounting records) |
| Job applications | Duration of the recruitment process, then up to 12 months unless you ask us to keep it longer |
| Newsletter subscriptions | Until you unsubscribe |
| Feedback | Until withdrawn, or 24 months |
| Challenge notification requests | Until you are notified that registration has opened, or until withdrawn |
| Sponsorship enquiries | Up to 24 months from last contact |
| Data requests & grievances | As required to demonstrate compliance |
| Technical logs | Short, limited period for security and diagnostics |
Where retention is no longer justified, information is deleted or irreversibly anonymised.
Who we share information with
We do not sell or rent personal information. We may share it only with:
- Service providers who host our systems, deliver email or provide AI processing — under confidentiality and purpose limits. This includes the infrastructure that stores form submissions and the image host that serves profile photographs;
- Professional advisers such as accountants or legal counsel, where necessary;
- Authorities where we are legally required to disclose.
Where information is transferred outside India, we take steps to ensure an appropriate level of protection is maintained and that processing remains limited to the stated purpose.
Where information is stored
To be transparent about the systems actually involved:
- Form submissions — contact, sponsorship, challenge-notification and grievance entries are written to a Google Firebase Realtime Database operated by ZIVOX. These records are readable only by an authenticated ZIVOX administrator; they are never read directly by a website visitor.
- Team photographs — profile images are stored and delivered by Cloudinary. Only the resulting image address is stored alongside the team record.
- Website hosting — the public site is served by Netlify, which processes technical request data as part of normal hosting and security.
- Administrator access — the Admin Panel is protected by authenticated Google Firebase sign-in restricted to named ZIVOX administrator addresses. Signing in sets an HTTP-only session cookie.
Website visitors cannot read other people's submissions, and cannot write to the database other than by submitting a form, which the server validates before storing.
How we protect information
- Access to systems is authenticated and restricted by role.
- Data in transit is encrypted using standard protocols.
- User input is validated and sanitised to reduce injection and cross-site scripting risk.
- Backend access controls limit what can be read or written even if a client is tampered with.
- Access is reviewed when responsibilities change.
No system is perfectly secure. If a breach affecting your rights occurs, we will notify affected individuals and the relevant authority as required.
Your rights
Subject to applicable law and reasonable verification of your identity, you may request:
- Access — confirmation of what we hold about you;
- Correction — correction of inaccurate or incomplete information;
- Erasure — deletion where retention is no longer justified;
- Restriction — limiting how we process your information;
- Portability — a copy in a structured, commonly usable format;
- Withdrawal of consent — at any time;
- Grievance — a complaint about how we handled your information.
Submit rights requests through the Data Request form. We aim to acknowledge promptly and to respond within the period required by applicable Indian data-protection law.
Children
Our website and services are intended for users aged 18 and above. We do not knowingly collect information from children. If you believe a child has provided information to us, contact us and we will delete it.
Cookies and local storage
Our website uses minimal storage, and no advertising or cross-site tracking cookies.
- Announcement popup — a single browser-session flag records that you have already seen the AI Innovation Challenge 2027 announcement, so it does not reappear on every page. It is cleared when you close the browser.
- Admin Panel session — an HTTP-only cookie keeps an administrator signed in. It is set only after an administrator signs in, and is never set for public visitors.
- Fonts — typefaces are requested from Google Fonts; your browser contacts Google's servers to fetch them, which may disclose your IP address to Google.
We do not run advertising networks, cross-site behavioural tracking, or sell data to brokers. See our Cookie Policy for more detail and how to control storage.
Changes to this policy
We may update this policy as our services change. The review date at the top of this page will be updated accordingly. Material changes affecting how we use your information will be communicated where practicable.
This document is provided for transparency and general information. It does not constitute legal advice. ZIVOX's approach is designed to support compliance with applicable Indian data-protection requirements and to be improved over time.
Review against the DPDP Act, 2023
We have reviewed this policy against the Digital Personal Data Protection Act, 2023. Updating a policy page is not, by itself, evidence of compliance: several operational requirements depend on information that must be confirmed by ZIVOX management rather than assumed here. The following items are recorded as outstanding and are not claimed as complete:
- Grievance Officer particulars. A named Data Protection / Grievance Officer with confirmed designation and contact details must be published. Until an officer is named, the Grievance Redressal Portal publishes the grievance mailbox only.
- Registered entity details. The legal entity name, registered address and registration number must be confirmed before they can be published.
- Retention periods. The periods shown above are indicative. They require confirmation against ZIVOX's actual record-keeping obligations.
- Response timelines. No statutory response commitment is stated on this website unless ZIVOX has approved one in writing.
- Consent records. Each form records that consent was given at the time of submission; a formal consent audit trail and withdrawal workflow beyond the data request form still requires an operational decision.
- Breach notification procedure. A documented procedure for notifying affected individuals and the Data Protection Board of India requires internal approval.
- Cross-border transfer assessment. Confirmation of where each processor stores data, and of any transfer safeguards relied upon, requires review.
Questions about any of the above can be sent to info@zivox.co.in or raised through the Grievance Redressal Portal.
Questions about this document? Email info@zivox.co.in or use our Grievance Redressal process.