01Who we are
ZyphraSec (“ZyphraSec”, “we”, “us”) is a cyber security consulting company based in Hyderabad, Telangana, India. This policy explains what personal data we collect through zyphrasec.com, why we collect it, and the choices you have.
For any privacy question, write to reach@zyphrasec.com or call +91 81093-33217.
02Information we collect
We keep collection to the minimum needed to respond to you and run a secure website.
- Contact form: your name, work email, company, the service you are interested in, the urgency level you select, and your message.
- Direct communication: anything you send us by email, phone or social media.
- Technical data: our hosting provider automatically records server logs, such as IP address, browser type, pages requested and timestamps. These are used for security monitoring and reliability.
Our website does not use advertising cookies, analytics trackers or tracking pixels, and we do not build marketing profiles of visitors.
Do not submit passwords, credentials, private keys or live incident evidence through the contact form. If you are dealing with an active incident, contact us and we will set up a secure channel.
03How we use your information
- To reply to your inquiry, scope a security engagement and send proposals you ask for.
- To deliver services under a signed agreement.
- To protect our website and users, including detecting abuse and attacks.
- To meet legal, accounting and regulatory obligations.
We never sell your personal data, and we do not use it for third-party advertising.
04Consent and legal basis
We process personal data in line with India’s Digital Personal Data Protection Act, 2023 (DPDP Act). When you submit the contact form or email us, you consent to us using your details to respond to that request. Some processing is also needed to comply with law or to keep our systems secure. You can withdraw your consent at any time (see Your rights).
05Third-party services
We share data only with providers that help us run the website and our business, and only as much as they need:
- Google: contact form submissions are processed through Google Apps Script and stored in our Google Workspace account. Our pages also load fonts from Google Fonts, which means Google receives your IP address when the page loads.
- Content delivery: the background video on our homepage is served from a content delivery network (Amazon CloudFront), which receives standard request data such as your IP address.
- Hosting and email providers that store or transmit our website and messages.
- Authorities, when we are legally required to disclose information.
Some of these providers may process data outside India. When they do, we rely on their contractual and security commitments to protect it.
06Client engagement data
Information we access while delivering services is treated as strictly confidential. This includes systems, logs, vulnerabilities, threat data and incident evidence. It is governed by the non-disclosure and service agreements we sign with each client, not by this website policy.
07How long we keep data
- Inquiries that do not become engagements: up to 24 months, then deleted.
- Client records: for the duration of the contract and as required by law, for example tax and accounting rules.
- Server logs: according to our hosting provider’s retention settings.
08How we protect data
Protecting data is our business. Our controls include HTTPS everywhere, a strict Content Security Policy, hardened security headers, least-privilege access to inquiry data and multi-factor authentication on our accounts. No system is perfectly secure, but if a breach affecting your data occurs, we will notify you and the authorities as the law requires.
09Your rights
Under the DPDP Act you can:
- Ask what personal data we hold about you and how it is used.
- Ask us to correct, complete, update or erase your data.
- Withdraw your consent.
- Nominate another person to exercise your rights if you die or are incapacitated.
- Raise a grievance with us. If you are not satisfied with our response, you can complain to the Data Protection Board of India.
Email reach@zyphrasec.com with the subject line Privacy Request. We will verify your identity and respond within 30 days.
10Children
Our website and services are intended for businesses and professionals. They are not directed at anyone under 18, and we do not knowingly collect children’s data.
11Grievance officer
Grievance Officer, ZyphraSec
Hyderabad, Telangana, India
Email: reach@zyphrasec.com
Phone: +91 81093-33217
12Changes to this policy
We may update this policy as our services or the law change. The “last updated” date at the top will always show the current version. We will highlight significant changes on this page.