Privacy Policy

1. Introduction & Overview

At iRyot Technologies (“Company”, “we”, “us”), we respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, process, store, retain, and safeguard your information when you visit https://app.iryot.com or use our cloud search intelligence application.

2. Information We Collect

We collect only the minimum necessary data to provide our services:

• Account Information: Email address, mobile / WhatsApp number for transaction verification and alert delivery, and account preferences when registering or logging in.
• Search Analytics Data: Read-only aggregate Google Search Console metrics (query impressions, clicks, click-through rates, and average SERP positions) when you connect your website or run on-demand audits.
• Payment Information: Billing details, transaction reference IDs, and subscription records. Note: We never store your full credit card number, CVV, UPI PIN, or banking passwords; all online transactions are securely processed through our primary PCI-DSS Level 1 compliant gateway (Razorpay Software Pvt. Ltd.).
• Technical Logs: IP address, browser type, and timestamps for security, fraud prevention, and session maintenance.

3. Google API Services & Limited Use Policy

iRyot’s use and transfer of information received from Google APIs adhere strictly to the Google API Services User Data Policy, including the Limited Use requirements:

• Read-Only Access: We request only read-only search console permissions (webmasters.readonly) to compute CTR gaps and identify striking-distance keywords.
• Zero Reselling: We never sell, lease, or monetize your search data or website traffic statistics to third parties, data brokers, or advertisers.
• No Model Training: Your private Google Search Console telemetry is never used to train generalized artificial intelligence models.

4. Data Security & Encryption

We implement industry-standard administrative, technical, and physical safeguards:

• All network transmissions are encrypted in transit via TLS 1.3 with SHA-256 signatures.
• Stored credentials and OAuth tokens are secured using AES-256 encryption at rest.
• Automated security telemetry protects against unauthorized access, DDoS, and credential injection.

5. Your Data Protection Rights (GDPR & DPDP Act, 2023)

Under applicable data privacy regulations, you have the right to:

• Access: Request copies of the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete information.
• Erasure (Right to be Forgotten): Request the permanent deletion of your account and stored metrics at any time.
• Data Portability: Export your generated keyword rankings and social studio content in universal formats.
• Consent Withdrawal: Revoke consent for marketing and operational notifications at any time.

To exercise any of these rights, contact our Data Protection Desk via email at support@iryot.com. Requests are fulfilled within 48 business hours.

6. Cookies & Consent Management (DPDP & GDPR Compliance)

We operate under a strict Privacy-by-Default consent framework in compliance with the Digital Personal Data Protection (DPDP) Act, 2023 and the General Data Protection Regulation (GDPR):

• Essential Cookies: Strictly necessary cookies (iryot_session, iryot_cookie_consent) are utilized purely to maintain secure authenticated logins, CSRF defenses, and user preferences.
• Telemetry & Analytics (Google Analytics & Meta Pixel): Third-party measurement tags (Google Tag Manager, Google Analytics 4, and Meta Pixel) are completely blocked and prevented from executing until you provide explicit affirmative consent via our interactive Cookie Consent banner.
• Revoking Consent: You may modify or withdraw your cookie consent at any time via the "Cookie Preferences" control located in the site footer.

7. Data Retention Schedule

In accordance with data minimization principles, we enforce defined retention periods for all collected telemetry:

• Google Search Console Analytics Cache: Retained for a rolling maximum of 90 days to generate comparative trendlines and striking-distance alerts, after which older telemetry is permanently purged from active memory.
• On-Demand Webpage Audit Logs: Crawl diagnostics, heading structures, and Core Web Vitals telemetry are retained for 30 days to allow historical comparison, and are automatically deleted thereafter.
• Billing & Financial Records: Transaction IDs, commercial digital payment receipts, and reconciliation ledger records are retained for 8 statutory financial years in accordance with mandatory Indian taxation and financial recordkeeping requirements (Section 44AA of the Income Tax Act, 1961), after which they are securely expunged. Payment credentials (card numbers, UPI PINs, net banking passwords) are never processed or stored on our servers and are handled exclusively by RBI-licensed payment aggregators (Razorpay).
• Account Deletion: Upon receiving an account closure request, all associated domain authorizations, cached queries, and personal records are permanently erased within 48 business hours.

8. Third-Party Sub-Processors & Data Infrastructure

To deliver our cloud software, we engage reputable third-party infrastructure providers that maintain strict confidentiality, SOC 2 compliance, and ISO 27001 certifications:

9. Designated Grievance Officer & Legal Redressal

In accordance with Rule 3(2) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and Section 12 of the Digital Personal Data Protection Act, 2023, the details of our designated Grievance & Data Protection Officer are provided below: