Privacy Policy

1. Introduction

Udaan Technologies (“we”, “us”, or “our”) is a software development and technology services company incorporated in India, with its registered office at A-26, Sector 10, Indirapuram, Ghaziabad, Uttar Pradesh – 201014, India. We have been delivering digital solutions since 2014 for clients across 15+ countries.

This Privacy Policy explains how we collect, use, store, share, and protect personal information when you visit www.udaantechnologies.com (the “Website”), submit a form, use our AI chatbot, or otherwise interact with us online.

It applies to all visitors, prospective clients, job applicants, and anyone else who provides information through the Website. It does not govern personal data processed under separate agreements we hold with our business clients as a data processor on their behalf.

By using the Website you acknowledge that you have read and understood this Privacy Policy. If you do not agree with any part of it, please discontinue use of the Website.

2. Information We Collect

2.1 Information You Provide Directly

We collect personal information that you voluntarily submit through the forms on our Website. The specific fields depend on which form you use:

Contact Form

• Full name, email address, phone number
• Skype ID or WhatsApp number (optional)
• Project title, description, requirements
• Estimated budget and timeline
• Uploaded files (PDFs, documents — up to 5 MB, PDF/DOC/DOCX only)

Project Estimator

• Full name, email address, phone number
• Company name
• Service type, desired features, estimated timeline
• Additional notes

Consultation Request Form

• Full name, email address, phone number
• Company name
• Project type and message

Job Application Form

• Full name, email address, phone number
• LinkedIn profile URL
• Cover letter text
• Resume file (PDF/DOC/DOCX, up to 5 MB)

Newsletter Sign-Up

• Email address

2.2 AI Chatbot Conversations

Our Website includes an AI-powered chat widget operated via the Anthropic Claude API. Any messages you type into the chatbot are sent to Anthropic's servers for processing in real time. We do not store chatbot conversation history in our own database after the session ends; the conversation exists only in your browser's memory for the duration of your visit. Anthropic may retain conversation data in accordance with its own privacy policy.

2.3 Automatically Collected Technical Data

When you visit the Website, certain data is collected automatically by our hosting infrastructure and analytics tools:

• IP address — collected temporarily by Vercel (our hosting provider) for rate limiting and security purposes; not persisted to our database
• Browser and device information — browser type and version, operating system, screen resolution, device category
• Usage data — pages visited, referral source, time spent on pages, clicks, and scroll depth (via Google Analytics GA4)
• Approximate geographic location — derived from IP address at city/region level (via Google Analytics)
• Cookies and similar technologies — see Section 11 and our Cookie Policy for full details

Google Analytics operates under a consent-default-denied configuration on our Website. Analytics cookies are not set and no data is sent to Google until you explicitly accept analytics cookies via our cookie consent banner.

3. How We Use Your Information

We use the personal information we collect for the following purposes:

Service Delivery and Communication

• To respond to your enquiries, project requirements, or consultation requests
• To send you a project cost and timeline estimate when you use the Project Estimator
• To process and evaluate job applications and communicate with candidates throughout the hiring process
• To send transactional emails (confirmations, follow-ups) related to your interaction with us
• To send our newsletter and occasional service updates, where you have subscribed or consented

Website Operation and Security

• To maintain the security and performance of our Website and prevent abuse (e.g., rate limiting repeated form submissions by IP address)
• To diagnose technical issues and monitor uptime

Analytics and Improvement

• To understand how visitors use the Website so we can improve content, navigation, and user experience
• To measure the effectiveness of our marketing and service pages

Legal and Compliance

• To comply with applicable laws, regulations, and court orders
• To enforce our Terms of Service and protect the rights and safety of Udaan Technologies and third parties

We do not sell, rent, or trade your personal information to any third party for their own marketing purposes.

4. Legal Basis for Processing

Our primary legal framework is the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”) of India.

For users who are residents of the European Economic Area (EEA), the United Kingdom, or other jurisdictions with similar data protection laws, we additionally rely on the following lawful bases under the GDPR where applicable:

• Consent — for analytics cookies and newsletter subscriptions. You may withdraw consent at any time.
• Contract performance — when processing is necessary to respond to your service enquiry or evaluate your job application, as these are pre-contractual steps taken at your request.
• Legitimate interests — for website security, fraud prevention, and operational analytics, where these interests are not overridden by your rights and freedoms.
• Legal obligation — where we are required to retain or disclose data by applicable law.

5. Data Sharing and Third-Party Services

We do not sell your personal data. We share it only with the service providers listed below, who process data on our behalf under contractual obligations and their own privacy and security commitments.

Vercel Inc. — Hosting & Edge Infrastructure

Our Website is hosted on Vercel's global edge network. Vercel processes all HTTP requests to our domain, which means your IP address and request metadata pass through Vercel's infrastructure. Vercel also provides edge functions that power our API routes. Data is processed in accordance with Vercel's Privacy Policy.

Supabase Inc. — Database

Form submissions (contact, estimator, consultation) are stored in a PostgreSQL database hosted on Supabase. This includes the structured fields you submit: name, email, phone, company, and project details. Supabase provides encrypted storage and access controls. Data is processed in accordance with Supabase's Privacy Policy.

Resend Inc. — Transactional Email

When you submit a contact, consultation, estimator, newsletter, or job application form, your submission data is forwarded to Resend to deliver transactional confirmation and notification emails to you and to our team. Resend receives the fields included in the form (name, email, message content, etc.). Data is processed in accordance with Resend's Privacy Policy.

Anthropic PBC — AI Chatbot

Our on-site chatbot is powered by the Anthropic Claude API. Any message you send in the chat widget is transmitted to Anthropic's servers to generate a response. We send only the conversation messages (no other personal profile data). Anthropic processes this data under its Privacy Policy. The chatbot is rate-limited to 30 requests per 15 minutes per IP.

Google LLC — Analytics (GA4)

When you consent to analytics cookies, we use Google Analytics 4 (measurement ID: G-2NGF112SPN) to collect anonymised usage statistics. Google Analytics uses cookies to track pageviews, session duration, referral sources, and approximate geographic location. Google processes this data under its Privacy Policy. You can opt out at any time via our cookie consent banner or by installing the Google Analytics Opt-out Browser Add-on.

Other Disclosures

We may also disclose your personal information if required by law, court order, or government authority, or if we reasonably believe that disclosure is necessary to protect the rights, property, or safety of Udaan Technologies, our clients, or the public.

6. International Data Transfers

Udaan Technologies is based in India, and we process your data primarily within India. However, because we use cloud-based third-party service providers, your personal data may be transferred to and processed in other countries — including the United States and the European Union — where these providers operate their infrastructure.

Specifically:

• Vercel processes data on servers in the US and globally via its edge network
• Supabase stores data in the AWS region selected at project creation (typically US East)
• Resend processes email data primarily in the United States
• Anthropic processes API requests in the United States
• Google Analytics processes data in the United States

These providers maintain appropriate technical and organisational safeguards, including Standard Contractual Clauses (SCCs) for EU data transfers, SOC 2 certification, and encryption in transit and at rest. By using the Website and submitting information, you acknowledge that your data may be transferred to these jurisdictions.

7. Data Retention

We retain personal information for as long as necessary to fulfil the purposes for which it was collected, or as required by law. Our general retention periods are:

• Contact, consultation, and estimator form submissions — retained for the duration of any resulting project or business relationship, and for up to 3 years thereafter for business records and dispute resolution purposes
• Job applications — retained for 6 months after a hiring decision is made for the relevant role; extended with your consent if we wish to consider you for future positions
• Newsletter subscriptions — retained until you unsubscribe; you can unsubscribe at any time via the link in any email we send
• Google Analytics data — retained for 14 months in Google's systems (our configured retention window)
• AI chatbot conversations — not stored in our systems; conversations exist only in your browser's session memory and are discarded when you leave the page
• IP addresses for rate limiting — held in server memory for a rolling 15-minute window; not written to any persistent storage

When personal data is no longer required, we delete or anonymise it. Where deletion is not immediately possible (e.g., data in backup archives), we isolate it from further processing until deletion is feasible.

8. Data Security

We implement reasonable and appropriate technical and organisational security measures to protect your personal information against unauthorised access, accidental loss, destruction, or disclosure. Our measures include:

• Encryption in transit — all data exchanged between your browser and our Website is encrypted using TLS (HTTPS); enforced via HSTS headers
• Encryption at rest — data stored in Supabase (PostgreSQL) is encrypted at the storage layer
• Access controls — only authorised Udaan Technologies personnel with a legitimate need can access form submission data; access is role-based and logged
• API security — all API route handlers implement CSRF origin/referer validation, input sanitisation, and rate limiting
• File upload restrictions — uploaded files are limited to 5 MB and accepted only in PDF, DOC, and DOCX formats; files are validated server-side before storage
• Security headers — our Website serves Content Security Policy (CSP), X-Frame-Options, X-Content-Type-Options, and Referrer-Policy headers
• Infrastructure security — Vercel and Supabase both hold SOC 2 Type II certification and manage physical and network security of the underlying infrastructure

No method of transmission over the internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal data, we cannot guarantee absolute security. If you believe a security incident has occurred, please notify us immediately at info@udaantechnologies.com.

9. Your Rights

Rights Under Indian Law (SPDI Rules, 2011)

Under the Information Technology (SPDI) Rules, 2011, you have the right to:

• Review — access and review the personal information we hold about you
• Correction — request that we correct inaccurate or incomplete personal information
• Withdrawal of consent — withdraw consent you have previously given for the collection and use of your sensitive personal data; withdrawal may affect our ability to provide certain services
• Grievance redressal — raise a grievance with our designated Grievance Officer (see Section 14)

Additional Rights for EEA / UK / GDPR-Jurisdiction Users

If you are located in the European Economic Area, the United Kingdom, or another jurisdiction that provides equivalent data protection rights, you additionally have:

• Right of access — obtain a copy of the personal data we hold about you
• Right to rectification — have inaccurate or incomplete data corrected without undue delay
• Right to erasure (“right to be forgotten”) — request deletion of your personal data where there is no overriding legitimate ground for us to retain it
• Right to restriction of processing — ask us to restrict how we use your data in certain circumstances
• Right to data portability — receive your data in a structured, machine-readable format and transmit it to another controller, where technically feasible
• Right to object — object to processing based on legitimate interests, including profiling
• Right to withdraw consent — at any time, where processing is based on consent, without affecting the lawfulness of processing before withdrawal
• Right to lodge a complaint — with your local data protection supervisory authority (e.g., your national DPA within the EU, or the ICO in the UK)

To exercise any of the above rights, contact us at info@udaantechnologies.com with the subject line “Privacy Rights Request”. We will respond within 30 days. We may need to verify your identity before fulfilling your request.

10. Children's Privacy

Our Website and services are intended for business professionals and are not directed at children under the age of 18. We do not knowingly collect personal information from anyone under 18 years of age. If you are a parent or guardian and believe that a child under your care has provided us with personal information, please contact us at info@udaantechnologies.com and we will promptly delete such information from our records.

11. Cookies and Tracking Technologies

We use cookies and similar browser-based technologies to operate the Website, remember your preferences, and (with your consent) collect analytics data. Our Website uses a consent banner that defaults to denying non-essential cookies until you actively accept them.

For a detailed breakdown of the cookies we use, their purpose, duration, and your opt-out options, please read our Cookie Policy.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the services we offer, or applicable law. When we make material changes, we will update the “Last updated” date at the top of this page. For significant changes, we may also provide a more prominent notice (for example, a banner on the Website).

We encourage you to review this page periodically to stay informed. Your continued use of the Website after any change constitutes acceptance of the updated policy.

13. Contact Us & Data Protection Enquiries

If you have any questions, concerns, or requests relating to this Privacy Policy or the way we handle your personal information, please contact us:

• Email: info@udaantechnologies.com
• Phone: +91-120-4101115
• Registered Office: A-26, Sector 10, Indirapuram, Ghaziabad, Uttar Pradesh – 201014, India

We aim to acknowledge all privacy-related enquiries within 2 business days and to resolve them within 30 days. Complex requests may require additional time, in which case we will keep you informed of progress.

14. Grievance Officer

As required under Rule 5(9) of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, Udaan Technologies has designated a Grievance Officer to address any complaints or concerns about the collection or use of your personal data.

Grievance Officer
Name: Director, Udaan Technologies
Organisation: Udaan Technologies
Address: A-26, Sector 10, Indirapuram, Ghaziabad, Uttar Pradesh – 201014, India
Email: info@udaantechnologies.com
Phone: +91-120-4101115

The Grievance Officer will acknowledge your complaint within 24 hours and endeavour to resolve it within 30 days of receipt, in accordance with the requirements of the Information Technology Act, 2000 and its rules.