Privacy Policy

1. Scope & Commitment

Clytrio (“we,” “us,” or “our”), establishing as Clytrio Private Limited, headquartered in Thrissur, Kerala, India, is a growth, technology, and digital engineering company. We provide strategic growth consultancy, full-stack website and application development, AI integrations, workflow automation, performance marketing, and enterprise search optimization to businesses across India and international markets.

We respect your privacy and believe that business transparency is fundamental to enduring commercial partnerships. This Privacy Policy explains what happens to personal data provided to us or collected automatically when you visit clytrio.com (the “Website”), utilize our online calculators and audit utilities, or contact us to request proposals, audits, or partnership discussions.

This policy applies exclusively to data collected through this Website, direct inquiry forms, and communications initiated via our official channels. It does not replace negotiated Master Services Agreements (MSAs), Non-Disclosure Agreements (NDAs), or Data Processing Agreements (DPAs) executed with retained enterprise clients.

2. Information We Collect

We collect information strictly necessary to provide accurate proposals, deliver digital services, maintain website security, and facilitate legitimate B2B correspondence. We classify collected data into three categories:

A. Information You Provide Directly

• Project & Contact Enquiries: When you complete our consultation or discovery forms (such as on our Contact or Partnership pages), we collect your name, business email address, phone number, company or brand name, existing website URL, estimated project budget, and notes detailing your technical or marketing objectives.
• Free Calculator Inputs: When using tools such as our Meta Ads ROI Calculator, Local SEO Checker, or Landing Page Grader, you may input commercial parameters (monthly ad spend, conversion rates, target keywords, landing page URLs) alongside your work email to generate audit breakdowns.
• Direct Correspondence: If you communicate with us via email, WhatsApp, or telephone, we retain the content of the communication and the contact credentials provided to follow up on your request.

B. Information Collected Automatically (Technical Telemetry)

• Device & Network Identifiers: Your Internet Protocol (IP) address, approximate geographic location (city and region level, derived from IP), browser type and version, operating system, device hardware type, and language preference.
• Usage Data & Server Logs: Pages viewed, referring URLs, timestamps of requests, click sequences, time spent on individual pages, and HTTP response codes.
• Security Tokens: Cloudflare Turnstile bot-detection challenges and verification tokens, used exclusively to shield our form endpoints from malicious automated scraping and denial-of-service spam.

C. Sensitive Personal Data

Clytrio does not collect sensitive personal data such as biometric records, passwords, genetic information, religious affiliations, or sexual orientation via the public website. For corporate billing, financial transactions are handled via accredited commercial banking institutions or authorized payment gateways; we do not store full credit card numbers or banking passwords on our public servers.

3. Lawful Basis & Purposes of Processing

Under Indian personal data protection standards and international data governance principles, we process personal information only when we have a recognized lawful basis:

4. Growth Tools, Calculators & Lead Ingestion

Clytrio publishes several interactive calculation utilities at /tools, including the Meta Ads ROI Calculator, Local SEO Checker, and Landing Page Grader. When using these utilities:

• Client-Side Processing: Calculations for ROI modeling run primarily in your local browser runtime.
• Lead Capture: If you request an executive audit summary or customized growth strategy by submitting your work email, that email is securely transmitted to our backend database (Supabase) via authenticated API endpoints protected by server-side rate-limiting.
• No Spam Commitment: We do not sell, rent, or trade tool-derived contact lists to third-party data brokers. You may unsubscribe from follow-up communications at any time by replying directly or contacting privacy@clytrio.com.

5. Cookies & Telemetry

We use cookies and browser storage mechanisms to maintain session integrity, prevent bot exploitation, and understand general site engagement. For complete details regarding every cookie vendor and lifetime, please review our comprehensive Cookie Policy or adjust your preferences via the Cookie Preferences interface.

You may adjust or withdraw non-essential cookie permissions at any time. Strictly necessary cookies (such as Cloudflare Turnstile verification and anti-tamper security tokens) do not require consent as they are indispensable for secure transmission.

6. Third-Party Service Providers (Data Processors)

To deliver modern, high-availability digital infrastructure, Clytrio engages reputable third-party cloud and enterprise software providers. We ensure all sub-processors adhere to stringent security benchmarks and contractual confidentiality commitments:

• Hosting & Edge Delivery: Vercel Inc. (USA / Global CDN) — Delivers server-rendered web assets, edge middleware, and application logging.
• Database & Storage: Supabase Inc. (AWS infrastructure, encrypted at rest via AES-256) — Stores structured form submissions, contact requests, and security audit logs with Row-Level Security (RLS).
• Bot Protection & Security: Cloudflare Inc. (Turnstile) — Evaluates browser telemetry to protect submission forms without invasive third-party tracking.
• Aggregate Web Analytics: Google LLC (Google Analytics 4) — Provides privacy-centric aggregate usage telemetry with IP anonymization enabled.
• Transactional Communication: Resend Inc. / Enterprise SMTP gateways — Processes transactional notifications confirming client inquiry receipts.

7. Cross-Border Data Transfers

As a technology company operating modern cloud architectures, personal information submitted through our website may be routed through or stored in data centers maintained by our infrastructure partners located outside India (e.g., in the United States or European Union).

When such transfers occur, we verify that our cloud providers maintain industry-standard safeguards (including ISO/IEC 27001 certifications, SOC 2 Type II compliance, and Standard Contractual Clauses) to ensure an equivalent level of protection to that mandated under the DPDP Act 2023.

8. Data Retention & Security

Retention Periods

We retain personal information only for the duration necessary to satisfy the specific purpose for which it was gathered:

• General Enquiries & Audit Requests: Retained in our CRM and database for a maximum of 24 months following the last meaningful correspondence, after which records are securely purged or anonymized.
• Contractual & Billing Records: For clients who engage Clytrio for professional services, billing records, signed contracts, and transaction receipts are retained for 8 years to comply with statutory taxation and corporate audit requirements under the Indian Companies Act and Income Tax Act.
• Security Server Logs: Web server and firewall logs are rotated and deleted automatically every 30 to 90 days.

Technical Security Measures

We implement comprehensive technical and organizational safeguards:

• Strict HTTPS encryption across the entire domain using modern TLS 1.3 cryptographic suites.
• Database isolation with PostgreSQL Row-Level Security (RLS) and environment-level access keys restricted to authorized engineering personnel.
• Continuous vulnerability scanning and automated protection against SQL injection, cross-site scripting (XSS), and CSRF attacks.

Important Notice: While we deploy robust safeguards, no method of digital transmission over the public internet or electronic cloud storage is entirely immune from sophisticated breaches. We encourage all users to exercise diligence when submitting proprietary information online.

9. Your Rights as a Data Principal (Under DPDP Act 2023)

Under India's Digital Personal Data Protection Act, 2023, and subject to applicable statutory exemptions, you hold specific enforceable rights regarding your personal data:

• Right to Access: You may request a summary of personal data about you that is processed by Clytrio, the identities of third parties with whom it has been shared, and any other information prescribed by law.
• Right to Correction & Erasure: You have the right to request correction of inaccurate or misleading data, completion of incomplete records, and erasure of personal data that is no longer necessary for the purpose it was collected.
• Right to Grievance Redressal: You have the right to readily available means of grievance redressal regarding any act or omission by Clytrio regarding our obligations.
• Right to Nominate: You may nominate an individual who, in the event of death or incapacity, shall exercise your rights as a data principal.
• Right to Withdraw Consent: Where processing is predicated on consent, you may withdraw that consent at any time without affecting the lawfulness of processing conducted prior to withdrawal.

To exercise any of these rights, email our data governance cell at privacy@clytrio.com with the subject line “DPDP Rights Request”. We will acknowledge your request within 24 hours and process it within statutory timelines.

10. Children's Information

Clytrio's website, technology services, and digital growth consulting are strictly intended for commercial entities, enterprise stakeholders, and adult professionals aged 18 and older. We do not knowingly solicit or collect personal information from individuals under 18 years of age. If you believe a minor has submitted personal data through our website, please notify us immediately at privacy@clytrio.com, and we will delete the data without delay.

11. Modifications to this Privacy Policy

We may periodically update this Privacy Policy to reflect modifications in our commercial operations, technical infrastructure, or applicable statutory notifications issued under the DPDP Act or related regulations.

When revisions occur, the “Last Reviewed” and “Effective Date” at the top of this document will be updated. Continued use of our website following the posting of an updated policy constitutes your acknowledgement of the revised practices.

12. Contact Information & Grievance Redressal

If you have questions, feedback, or legal inquiries regarding this Privacy Policy or our data management practices, please contact us through our dedicated communication channels: