Srivexa Privacy Policy

Last Updated: April 7, 2026 Version: 1.0

1. Introduction and Data Controller Identity

Welcome to Srivexa. Your privacy is important to us. This Privacy Policy explains how Srivexa ("Company," "we," "us," "our," or "Srivexa") collects, uses, discloses, and protects your personal data when you use our Project Management platform, whether through our SaaS service at www.srivexa.com or through self-hosted deployments.

Data Controller: Srivexa, No. 42, Tech Hub Road, Hitec City, Hyderabad, Telangana 500081, India, is the data controller responsible for the personal data we collect and process. For data protection inquiries, you may contact our Data Protection Officer at [email protected] or by mail at the address above.

Jurisdiction and Applicability: This Privacy Policy applies to users in all regions. If you are located in the European Union, United Kingdom, or other jurisdictions with specific data protection regulations (such as GDPR, UK GDPR, or LGPD), you have enhanced rights as described in this policy and in our Data Protection Addendum available upon request.

2. What Data We Collect

We collect personal data from you in several ways when you use Srivexa. The data we collect depends on how you use the Service and whether you use the SaaS platform or a self-hosted deployment.

2.1 Account Data

When you create an account or use the Service, we collect:

• Full name and email address
• Phone number (optional)
• Job title and company name
• Password (hashed and encrypted; we never store passwords in plain text)
• Account creation and last login timestamps
• Billing and payment information (for SaaS subscriptions)
• Profile picture or avatar (optional)
• Authentication credentials and session tokens
• Two-factor authentication settings and recovery codes

2.2 Usage Data

We automatically collect information about how you interact with the Service:

• Projects, tasks, and workspaces you create or access
• Time spent on the Service (login duration, session length)
• Features you use (reporting, integrations, exports)
• Collaborations and team interactions (who you share projects with, comments you make)
• Search queries and filters applied
• API calls made and their frequency
• Import and export activities
• File uploads and downloads
• Notification preferences and settings
• Custom workflows and automation configurations

2.3 Technical Data

We collect technical information about your device and connection:

• IP address and general geolocation (country/region level, not street address)
• Browser type and version
• Operating system and device type
• Device identifiers (device ID, browser fingerprint)
• Referrer URL and pages visited
• Cookies and tracking pixels (see Section 8)
• Connection type (broadband, mobile network)
• Crash reports and error logs
• Performance metrics (page load times, API response times)
• Mobile app version and installation data

2.4 Communications Data

When you communicate with us or other users, we collect:

• Support tickets, emails, and chat messages you send to our support team
• Your feedback, surveys, and product reviews
• Comments, mentions, and messages within the Service
• Call recordings or transcripts if you participate in support calls (with your consent)
• Notification preferences and communication history

2.5 Data You Provide Directly

• Documents, images, files, and attachments you upload to projects or tasks
• Text, spreadsheets, presentations you create or import
• Custom field data and metadata you add to tasks
• Integration credentials (API keys, OAuth tokens) when you connect third-party services

3. How We Use the Data

We use the personal data we collect for the following purposes:

3.1 Service Delivery

• Creating and maintaining your account
• Processing your login and authentication
• Displaying your projects, tasks, and team information
• Enabling real-time collaboration and notifications
• Providing customer support and responding to inquiries
• Delivering reports and analytics about your work
• Processing payments and managing your subscription
• Sending transactional emails (password resets, receipts, usage alerts)

3.2 Improvements and Development

• Analyzing usage patterns to understand which features are most valuable
• Identifying bugs, errors, and performance issues
• Developing new features and improvements based on user behavior
• Conducting A/B testing and multivariate testing
• Training machine learning models to improve recommendation and automation features
• Personalizing the Service based on your preferences and usage history

3.3 Communication and Marketing

• Sending service announcements, updates, and security notices
• Sending marketing communications about new features, promotions, or events (with your consent)
• Responding to your questions and requests
• Conducting surveys and gathering feedback
• Notifying you about changes to our Terms of Service or Privacy Policy

3.4 Safety and Compliance

• Detecting, preventing, and addressing fraud, abuse, and security incidents
• Enforcing our Terms of Service and other agreements
• Complying with legal obligations, court orders, and government requests
• Protecting the rights, property, and safety of the Company, users, and the public
• Conducting internal audits, security assessments, and compliance reviews
• Investigating and resolving disputes

3.5 Legal and Business Purposes

• Aggregating data for business analytics and reporting
• Measuring and improving the effectiveness of marketing campaigns
• Creating de-identified datasets for research purposes
• Mergers, acquisitions, asset sales, or business restructuring

4. Legal Basis for Processing

Under data protection laws such as the GDPR, we process your personal data based on the following legal grounds:

4.1 Contract

Processing personal data is necessary to perform the contract with you (the Terms of Service). This includes creating your account, providing the Service, processing payments, and delivering customer support.

4.2 Legitimate Interests

We process personal data when it is necessary for our legitimate business interests, and these interests are not overridden by your privacy rights. Examples include:

• Improving and developing the Service
• Detecting and preventing fraud and abuse
• Conducting security research and vulnerability testing
• Marketing and business analytics
• Defending our legal rights
• Aggregating and de-identifying data for research

4.3 Consent

For certain types of processing—such as marketing communications, optional analytics, or use of optional cookies—we obtain your explicit consent. You may withdraw consent at any time by updating your preferences or contacting us.

4.4 Legal Obligation

We process personal data when required by law, such as tax reporting, financial regulations, or responding to lawful government requests.

4.5 Vital Interests

In rare circumstances, we may process personal data to protect your vital interests or the vital interests of others (e.g., emergency situations).

5. Data Sharing and Third-Party Processors

We do not sell your personal data. However, we may share your data with third parties in the following circumstances:

5.1 Service Providers and Data Processors

We work with trusted third-party service providers who process personal data on our behalf:

• Cloud Infrastructure: AWS for hosting, storage, and backup
• Payment Processing: Stripe for processing subscriptions and payments
• Email Services: SendGrid for transactional and marketing emails
• Analytics: Mixpanel for usage analytics and performance monitoring
• Support Tools: Intercom for customer support tickets
• Integrations: Third-party services you explicitly authorize (GitHub, Jira, Slack, Microsoft Teams, etc.) for integration with Srivexa
• Monitoring and Security: Sentry and Datadog for infrastructure monitoring and security event logging

All service providers are bound by data processing agreements that ensure they process your data only as instructed and maintain appropriate security measures.

5.2 Team Members and Collaborators

Your name, email, and profile information may be visible to other team members within shared workspaces, projects, and tasks. Comments, updates, and shared documents are visible to users you have explicitly shared them with. The visibility of your data depends on the permissions and access controls you or your workspace administrator configure.

5.3 Business Partners and Integrations

If you connect third-party services to Srivexa (e.g., Jira for issue tracking, Slack for notifications), we share the minimum necessary data to enable the integration. You control which integrations are enabled and can revoke access at any time.

5.4 Legal and Compliance

We may disclose your personal data when required by law, court order, government request, or regulatory authority. We will provide you with notice of such requests unless legally prohibited from doing so. We may also disclose data to protect our legal rights, enforce our agreements, or respond to claims of illegal activity.

5.5 Business Transfers

If Srivexa is acquired, merged, or in the event of bankruptcy or asset sale, your personal data may be transferred as part of that transaction. We will provide notice of any such change in ownership or control of your data.

5.6 De-Identified and Aggregated Data

We may share de-identified and aggregated data (such as usage statistics, feature adoption rates, or anonymized metrics) with business partners, researchers, and the public for business intelligence, research, and marketing purposes. De-identified data is data that cannot reasonably be linked back to you.

6. International Data Transfers

Srivexa is operated primarily from the United States. If you are located outside the United States, your personal data will be transferred to, stored in, and processed in the United States or other countries where we operate.

6.1 GDPR Transfers

For users in the European Union and United Kingdom, we rely on appropriate legal mechanisms for international data transfers:

• Standard Contractual Clauses (SCCs): We have executed Standard Contractual Clauses with service providers to ensure adequate safeguards for data transfers
• Adequacy Decisions: We transfer data to countries where the European Commission has issued an adequacy decision
• Your Consent: By accepting these Terms and Privacy Policy, you consent to the transfer of your personal data to countries outside the EU/UK
• Data Protection Addendum: We maintain a Data Protection Addendum that details transfer mechanisms and your rights

You have the right to request information about transfer mechanisms by contacting our Data Protection Officer.

6.2 Risk Mitigation

We implement additional safeguards when transferring data internationally, including:

• Encryption in transit and at rest
• Access controls and role-based permissions
• Regular security audits and penetration testing
• Contractual obligations on service providers

7. Data Retention

We retain your personal data for as long as necessary to provide the Service, comply with legal obligations, and fulfill the purposes described in this Privacy Policy.

7.1 Active Account Data

While your account is active, we retain:

• Account information (name, email, billing address)
• Project and task data you have created
• Usage logs and analytics data
• Communications and support records

7.2 Inactive Account Data

If your account is inactive for 24 months, we may send you a notice and subsequently delete your account and associated data. You may prevent deletion by logging in or contacting support.

7.3 Deleted Account Data

When you request account deletion or your account is terminated:

• Your account is marked as deleted and is no longer accessible
• Your personal data is deleted from live systems within 30 days
• Your data is retained in backup systems for 90 days for disaster recovery purposes
• After the retention period, all copies of your data are permanently deleted
• Some data may be retained if legally required (e.g., for tax or audit purposes)

7.4 Transaction and Payment Data

• Payment records and invoices are retained for 7 years for tax and accounting purposes
• Billing data is retained longer than other account data due to legal and financial regulatory requirements

7.5 Security and Abuse Logs

• IP addresses and access logs are retained for 90 days to detect and prevent abuse
• Security incident logs may be retained longer if necessary for investigation and legal compliance

7.6 Self-Hosted Deployments

For self-hosted deployments, you are responsible for all data retention and deletion. We may collect limited telemetry data (feature usage, error logs) which is retained for 12 months.

8. User Rights and Data Subject Requests

Depending on your location, you have the following rights regarding your personal data:

8.1 Right to Access

You have the right to request and obtain a copy of the personal data we hold about you. This includes information about what data we collect, how we use it, and who it is shared with. You can access much of this information directly through your account settings.

How to Request: Log into your account and use the "Download My Data" feature, or contact [email protected] with the subject line "Data Subject Access Request."

Response Timeframe: We will provide your data or explain why we cannot within 30 days. For complex requests, we may extend this by 60 days. We may request additional information to verify your identity.

8.2 Right to Rectification (Correction)

You have the right to correct inaccurate personal data. You can update much of your information directly through your account settings (name, email, phone, job title).

How to Request: Log into your account and update your profile, or contact [email protected] to request corrections that you cannot make yourself.

Our Obligation: We will correct inaccurate data promptly, and inform relevant recipients of the correction where applicable.

8.3 Right to Erasure ("Right to be Forgotten")

You have the right to request deletion of your personal data in certain circumstances. However, we may be unable to delete data if:

• We are legally required to retain it (tax records, regulatory requirements)
• It is necessary to fulfill contractual obligations
• It is necessary for our legitimate business interests or legal defense
• You shared the data within collaborative projects

How to Request: Contact [email protected] with the subject line "Erasure Request." Provide details about which data you wish deleted.

Our Response: We will delete data within 30 days unless a legal basis for retention applies. We will explain any reasons we cannot fully comply.

8.4 Right to Restrict Processing

You have the right to request that we restrict (limit) how we process your personal data. This is useful if you believe data is inaccurate or if you object to processing. Restricted data will be retained but not actively used.

How to Request: Contact [email protected] with the subject line "Restriction Request." Specify what processing you want restricted.

8.5 Right to Data Portability

You have the right to receive your personal data in a structured, commonly-used, portable format (CSV, JSON) and to transmit it to another service. This right applies to data you provided and data generated by your use of the Service.

How to Request: Log into your account and use the "Export My Data" feature to download your data in portable formats, or contact [email protected].

Data Included: Projects, tasks, attachments, settings, and usage history.

8.6 Right to Object

You have the right to object to certain types of processing, including:

• Marketing communications
• Profiling and automated decision-making
• Processing for legitimate business interests

How to Request: Contact [email protected] or manage your preferences in account settings.

8.7 Right to Withdraw Consent

If we process your data based on your consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.

How to Withdraw: Update your preferences in account settings or contact [email protected].

8.8 Right to Lodge a Complaint

If you believe we have violated your privacy rights, you have the right to lodge a complaint with your national data protection authority:

• EU: Contact your national Data Protection Authority
• UK: Contact the Information Commissioner's Office (ICO) at ico.org.uk
• California: Contact the California Privacy Protection Agency (CPPA)
• Other Jurisdictions: Contact your equivalent data protection regulator

8.9 Exercising Your Rights

To exercise any of these rights:

1. Contact our Data Protection Officer at [email protected]
2. Provide sufficient information to identify you and your request
3. Specify which right you are exercising
4. Provide proof of identity (we may request additional verification)

We will respond within the applicable legal timeframe. We may charge a fee or decline requests that are manifestly unfounded, excessive, or repetitive.

9. Cookies and Tracking

We use cookies, pixels, and similar tracking technologies to collect information about your browsing behavior and improve your experience.

9.1 Types of Cookies

Essential Cookies (No Consent Required)

• Session cookies that maintain your login and security
• CSRF protection tokens
• Language and preference settings
• Load balancing cookies

Analytics Cookies (Consent Required)

• Google Analytics to track feature usage and behavior
• Mixpanel for product analytics
• Hotjar for session recordings and heatmaps (optional)

Marketing Cookies (Consent Required)

• Advertising pixels from Google, Facebook, LinkedIn for retargeting campaigns
• Conversion tracking pixels to measure campaign effectiveness
• Lead scoring cookies to understand user intent

9.2 Cookie Consent

When you first visit Srivexa, we display a cookie consent banner. Essential cookies are set immediately. Analytics and marketing cookies are set only after you provide explicit consent. You can withdraw consent at any time.

Manage Preferences: Visit your account settings > Privacy > Cookie Preferences to update your selections.

9.3 Third-Party Cookies

We use cookies from third-party services such as:

• Google Analytics (analytics)
• Stripe (payment processing)
• Intercom (customer support)
• LinkedIn Insight Tag (marketing)
• Facebook Pixel (marketing)

These services have their own privacy policies, and we are not responsible for their practices.

9.4 Do Not Track (DNT)

Some browsers include a "Do Not Track" feature. We do not currently respond to DNT signals, but you can opt out of analytics and marketing cookies through your account preferences.

9.5 Local Storage and Similar Technologies

We use browser local storage, session storage, and similar technologies to store your preferences, session information, and cached data. These technologies function similarly to cookies and are subject to your cookie preferences.

10. Security Measures

We implement comprehensive technical, administrative, and physical security measures to protect your personal data from unauthorized access, disclosure, alteration, and destruction.

10.1 Encryption

• In Transit: All data transmitted between your device and our servers is encrypted using TLS 1.2 or higher
• At Rest: Sensitive data in databases is encrypted using AES-256 encryption
• Application Level: Passwords are hashed using bcrypt or similar cryptographic algorithms
• Backup Data: All backups are encrypted and stored in secure facilities

10.2 Access Controls

• Role-based access control (RBAC) restricts who can access what data
• Multi-factor authentication (MFA) is available for all accounts
• API authentication uses industry-standard tokens with expiration and rotation
• Privileged access to databases is restricted to authorized operations staff with audit logging

10.3 Infrastructure Security

• Firewalls and intrusion detection systems protect network perimeter
• Regular vulnerability scanning and penetration testing
• Web Application Firewall (WAF) to protect against common attacks
• DDoS mitigation and rate limiting
• VPC isolation and network segmentation

10.4 Monitoring and Incident Response

• 24/7 monitoring for security threats and anomalous behavior
• Automated alerting for suspicious activities
• Incident response plan with defined escalation procedures
• Log retention for forensic investigation
• Regular security audits and compliance assessments

10.5 Data Minimization

• We collect only the minimum personal data necessary to provide the Service
• Old data is securely deleted when no longer needed
• Access to personal data is limited to staff who need it for their job

10.6 Limitations

While we implement robust security measures, no system is completely immune to breaches. We cannot guarantee absolute security, and you use the Service at your own risk. If a security breach occurs involving your personal data, we will notify you within 72 hours in accordance with applicable law.

11. Children's Privacy

Srivexa is not intended for children under the age of 13 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal data from children. If we become aware that we have collected data from a child, we will delete that data and terminate the child's account immediately.

Parents and Guardians: If you believe your child has created an account or provided information to Srivexa, please contact us at [email protected] immediately.

For users between 13 and 18 years old (or the age of majority in your jurisdiction), we provide additional privacy protections and limit processing to what is necessary for providing the Service.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by:

• Sending an email to your registered email address
• Posting a notice on our website
• Requiring your explicit consent if the change is material

The "Last Updated" date at the top indicates when this policy was last modified. Your continued use of Srivexa after changes become effective constitutes your acceptance of the updated Privacy Policy. We recommend reviewing this policy periodically.

13. Contact Information and Data Protection Officer

If you have questions about this Privacy Policy, your personal data, or wish to exercise your privacy rights, please contact:

Srivexa Email: [email protected] Data Protection Officer: [email protected] Mailing Address: No. 42, Tech Hub Road, Hitec City, Hyderabad, Telangana 500081, India Phone: +91-40-6666-7777 Website: www.srivexa.com

Response Timeframe: We will respond to inquiries within 5 business days.

For EU/UK Residents: If you are not satisfied with our response, you have the right to lodge a complaint with your national Data Protection Authority:

• EU: https://edpb.ec.europa.eu/about-edpb/board/members_en
• UK: https://ico.org.uk/

For California Residents: If you are not satisfied with our response, you have the right to contact the California Privacy Protection Agency (CPPA) at https://cppa.ca.gov/

Appendix: Summary of Key Privacy Terms

END OF PRIVACY POLICY