Privacy Policy

Yaragudi Ltd (“Yaragudi”, “we”, “us”) builds an EU AI Act compliance intelligence platform. This Privacy Policy explains what personal data we collect from visitors to yaragudi.com and customers of our services, why we collect it, how we use it, and the rights you have under the UK GDPR and EU GDPR.

This policy applies to data collected through our marketing website. Personal data processed inside our platform on behalf of customers is governed by our Data Processing Agreement.

1. Data we collect

Information you give us

When you fill in our contact form, we collect:

• Your full name and work email address
• Your company name and role
• Optional context: number of AI systems in production, clouds in use, compliance timeline, and any free-text message

Information collected automatically

• IP address and approximate location (country and city), used for security and abuse prevention
• Browser user-agent string
• Pages viewed, time spent, and referrer (collected via Vercel Web Analytics if enabled — currently not enabled)

We do not use third-party advertising cookies, tracking pixels, or session replay tools.

2. How we use your data

• To respond to your enquiry and arrange a discovery call
• To assess whether Yaragudi is a fit for your organisation
• To improve our website and product based on aggregated traffic patterns
• To detect and prevent abuse of our infrastructure

We do not sell, rent, or share your personal data with third parties for their own marketing purposes. We do not add you to a marketing list without explicit opt-in.

3. Lawful basis (UK GDPR / EU GDPR Article 6)

• Legitimate interest — to respond to your enquiry and pursue a potential business relationship
• Consent — if and when you explicitly opt in to marketing communications

4. Sub-processors and data location

We use the following sub-processors to operate our website:

• Vercel Inc. — website hosting and serverless functions. Data residency: global edge network with primary processing in the EU and US.
• Resend Inc. — transactional email delivery (contact form notifications). Data residency: US.
• Cloudflare Inc. — DNS and email routing. Data residency: global.

For each sub-processor we have either a Standard Contractual Clauses (SCC) agreement in place or rely on the EU-US Data Privacy Framework. Full sub-processor list is available on request.

5. How long we keep your data

• Contact form submissions — retained for 24 months from last contact, then deleted
• Server logs — retained for 30 days
• Email correspondence — retained for the duration of the business relationship plus 6 years for tax and contract record-keeping (UK Companies Act 2006)

6. Your rights

Under the UK GDPR and EU GDPR you have the right to:

• Access the personal data we hold about you
• Correct any inaccurate or incomplete data
• Request deletion of your data (“right to be forgotten”)
• Restrict or object to our processing
• Data portability — receive your data in a structured, machine-readable format
• Withdraw consent at any time, where we rely on consent as the lawful basis
• Lodge a complaint with the UK Information Commissioner’s Office (ICO) or your national supervisory authority

To exercise any of these rights, email hello@yaragudi.com. We will respond within 30 days.

7. Security

We protect your data using industry-standard measures including TLS 1.3 in transit, AES-256 at rest where supported, principle-of-least-privilege access controls, and sub-processor due diligence. We are working toward SOC 2 Type II certification.

8. Changes to this policy

We will post any material changes to this page and update the “Last updated” date above. For substantive changes affecting your rights we will notify you by email where we hold your contact details.

9. Contact

Data controller: Yaragudi Ltd, registered in the United Kingdom. Email hello@yaragudi.com for any privacy questions.