Privacy Policy
This notice explains what personal data AiRotor Labs Pvt. Ltd. ("AiRotor", "we") collects through AiServeSOLAR, why, how long we keep it, who we share it with, and the rights you have. It is written to meet the Digital Personal Data Protection Act, 2023 (DPDP Act) and the DPDP Rules, 2025 in India, and follows the principles of the EU/UK General Data Protection Regulation (GDPR) for users outside India.
1. Who is responsible for your data
For your account and usage data, AiRotor Labs Pvt. Ltd. is the Data Fiduciary (GDPR: controller). For the inspection data your organisation uploads (imagery, plant layouts, defects, reports), your organisation is the Data Fiduciary and AiRotor processes that data on its behalf as a Data Processor, under its agreement with us.
2. What we collect
| Data | Why we need it | Lawful basis |
|---|---|---|
| Name / username, work email, organisation, role | Create and run your account, control what you can access, send account emails (verification, password reset) | Consent; performance of your organisation's contract |
| Password (stored only as a one-way bcrypt hash) and two-factor secret | Sign-in security | Consent; security of the service |
| IP address, sign-in times, and a log of actions you take (audit log) | Security, fraud and abuse prevention, investigating incidents, legal record-keeping | Legitimate use / legal obligation (DPDP Rules require logs to be kept) |
| Files you upload and work you record (annotations, defect updates, work orders) | Deliver inspection results to your organisation | Your organisation's contract |
| Device location — only in the field view, only if you allow it in your browser | Guide field crews to a defect; may be saved with field updates you submit | Consent (you can refuse or revoke it in your browser) |
| Billing contact details (organisation admins) | Invoicing and payments | Contract; legal obligation (tax) |
Drone imagery is captured over solar plants for inspection. It may incidentally show people or vehicles; we do not use it to identify anyone, and it is used only to inspect the plant.
We do not knowingly collect data from children. AiServeSOLAR is a business tool for people aged 18 and over.
3. Where your data is stored and how it is protected
- Data residency: application servers, database and file storage run on Amazon Web Services in the Mumbai region (ap-south-1), India.
- Encryption: all traffic uses HTTPS/TLS with HSTS; stored files are encrypted at rest by AWS.
- Access control: each organisation's data is isolated from every other organisation; inside an organisation, access is limited by role and per-project assignment.
- Account security: bcrypt password hashing, optional two-factor authentication, sign-in rate limits and account lockout, sessions that end when the password changes, and short-lived signed links for file downloads.
- Accountability: security-relevant actions are recorded in an audit log; error monitoring is configured not to collect personal data.
4. Who we share it with
We never sell personal data or share it for advertising. We share it only with these service providers (sub-processors), each bound by contract to protect it, and only as needed:
| Provider | Purpose | Location |
|---|---|---|
| Amazon Web Services | Hosting, database, file storage, transactional email | India (Mumbai) |
| Anthropic | AI-assisted analysis of inspection images, video frames and orthomosaics (inspection content only, not account data) | United States |
| Razorpay | Subscription payments (organisation admins) | India |
| Sentry | Application error monitoring (configured without personal data) | United States |
Transfers outside India are made only to countries not restricted by the Government of India under section 16 of the DPDP Act. We may also disclose data when required by law, a court or a government authority.
5. How long we keep it
- Account data: for as long as your account is active. When you or your organisation close the account, we delete or anonymise it within 30 days, unless the law requires us to keep it longer.
- Security and audit logs: at least one year, as required by the DPDP Rules, then deleted.
- Inspection data: for as long as your organisation's subscription and instructions require; returned or deleted on your organisation's written request at the end of the contract.
- Billing records: as long as Indian tax law requires.
6. Your rights
Under the DPDP Act (and GDPR where it applies) you can:
- Access a summary of your personal data and how it is processed — use Download my data on your Profile page.
- Correct or update inaccurate data — ask your organisation admin or write to us.
- Erase your data and withdraw consent — use Request account deletion on your Profile page, or write to us. Withdrawing consent is as easy as giving it; it does not affect processing done before.
- Nominate another person to exercise these rights if you die or become incapable.
- Raise a grievance with our Grievance Officer (below), and if you are not satisfied, complain to the Data Protection Board of India.
- Under GDPR you can also object to or restrict processing, ask for your data in a portable format, and complain to your local supervisory authority.
We acknowledge requests within 7 days and complete them within 30 days. We may need to confirm your identity first.
7. Cookies
We use only strictly necessary cookies: a session cookie to keep you signed in, a "remember me" cookie (30 days), and a security token that protects forms (CSRF). We use no analytics, advertising or tracking cookies, so no cookie consent is needed. Some preferences (such as a collapsed panel) are stored in your own browser only.
8. Personal data breaches
If a breach affects your personal data, we will inform you and the Data Protection Board of India without delay, and send the Board a detailed report within 72 hours, as the DPDP Rules require, describing what happened, the likely impact, and what we are doing about it.
9. Grievance Officer and contact
Grievance Officer, AiRotor Labs Pvt. Ltd.
Email: tech@airotor.in
10. Changes to this notice
When we change this notice in a way that matters, we update the version above and ask you to accept the new version the next time you sign in.