This notice explains how AutonomicsAI LLP collects and uses personal data through its two websites, its forms, its email, and its business-to-business outreach.
1. Who we are
AutonomicsAI LLP (LLPIN ADA-5258), trading as "Autonomics AI" for its services business.
Registered office: 303, Gitanjali Pride 1, 5th Main, 3rd A Cross, Jeevanbhimanagar, Bengaluru 560075, Karnataka, India.
Email: [email protected]
We are the data fiduciary under India's Digital Personal Data Protection Act, 2023 (the "DPDP Act") and the controller under the UK GDPR and the EU GDPR for the personal data described in this notice.
Grievance Officer (DPDP Act) and privacy contact: Sean Paul, Founder, AutonomicsAI LLP. Email: [email protected]. Phone: +91 88613 65188 (the business number). Post: the registered office above.
UK and EU representative: see section 12.
2. What this notice covers
- autonomicsai.in (our company website);
- services.autonomicsai.in (our services website for businesses);
- the contact, audit and enquiry forms on those sites;
- email and other messages you exchange with us;
- business-to-business emails we send to businesses that have not contacted us first ("outreach"); and
- the business contact details of our clients' staff.
It does not cover personal data that we process on behalf of a client as its processor (for example the details of a client's own customers in a quote form we built). The client is responsible for that data, and our Data Processing Agreement with the client governs how we handle it. If you are a client's customer, please read that client's privacy notice and contact the client first.
3. The short version
- Our websites set no cookies and use no analytics, advertising pixels or trackers.
- We collect personal data only when you contact us, fill in a form, become a client, or when we find a business contact address that a business has published so that people can contact it.
- We use it to reply, to provide our services, to run our business and, for businesses, to tell them about our services. We do not sell personal data and do not share it with advertisers.
- You can ask to see, correct or delete your data, and you can stop our emails at any time with one click or a reply.
4. What we collect and where it comes from
4.1 When you visit either website. Our host, Cloudflare, processes technical data needed to deliver pages and protect the sites from abuse: IP address, browser and device type, the pages requested, and the time. We do not use this data to identify you or build a profile.
4.2 Contact form on autonomicsai.in. Your name, email address and message. The email that delivers your message to us also includes your IP address, approximate country and browser type, which we use only to spot abuse. A counter linked to your IP address is kept for up to one hour to limit spam, and then deleted automatically.
4.3 Audit and contact forms on services.autonomicsai.in. The details you enter, such as your name, business name, email address, phone number (if you give it), website, type of business and message. We store each submission in a database on Cloudflare (Workers KV) and send a copy to our email inbox. For spam protection we keep a counter linked to a one-way coded (hashed) version of your IP address for up to two hours; we do not store the IP address itself in that database. Submissions that fail our automated spam checks are kept for 30 days so that a real enquiry is not lost, and then deleted.
4.4 Email and other messages. What you choose to send us, including your name, contact details, signature details and the content of your messages and attachments.
4.5 Outreach to businesses. We look for businesses that might benefit from our services. For each one we record: the business name, website, category, city and country; a business email address that the business has published on its own website (we prefer general addresses such as info@ or hello@ and generally skip addresses that name a person); the web page where we found it; and the date. Business details may come from OpenStreetMap ("© OpenStreetMap contributors"). We do not buy email lists, and we do not use addresses from pages that ask not to receive unsolicited email. If you reply, we keep your reply. If you unsubscribe, we keep your address (or a coded token linked to it) on a suppression list so that we never email it again.
4.6 Clients. Names, job titles, business email addresses and phone numbers of the people we work with; contracts and statements of work; invoices and payment records (amounts, dates, method, and the details our payment processors and bank give us; we do not see or store full card numbers); and our project communications.
4.7 Job applicants. If you apply to work with us, the information in your application and our notes on it.
We do not ask for, and ask you not to send, sensitive personal data (such as health, financial account or government identity numbers) unless we specifically need it for a contract.
5. Why we use it and our legal basis
| Purpose | Data | UK/EU GDPR basis | DPDP Act basis |
|---|---|---|---|
| Deliver and secure our websites | 4.1, and IP data in 4.2 and 4.3 | Legitimate interests (Art. 6(1)(f)): running secure websites | Legitimate use for the purpose you voluntarily provided it (s. 7(a)); reasonable security measures |
| Reply to enquiries and audit requests, and prepare an audit or proposal | 4.2, 4.3, 4.4 | Steps at your request before a contract (Art. 6(1)(b)); otherwise legitimate interests | Voluntarily provided for a specified purpose (s. 7(a)), or consent |
| Send business-to-business outreach and follow-ups | 4.5 | Legitimate interests (Art. 6(1)(f)): telling businesses about relevant services. You can object at any time (section 8) | See section 5.2 |
| Keep a suppression list | 4.5 | Legal obligation and legitimate interests: honouring opt-outs | Compliance with law (s. 7) and legitimate use |
| Provide our services and manage the client relationship | 4.6 | Contract (Art. 6(1)(b)) with the client; legitimate interests for the client's staff | Voluntarily provided (s. 7(a)); performance of contract |
| Invoicing, accounting, tax, and export and foreign-exchange records | 4.6 | Legal obligation (Art. 6(1)(c)) | Compliance with law (s. 7) |
| Assess job applications | 4.7 | Steps before a contract; legitimate interests | Voluntarily provided (s. 7(a)) |
| Establish, exercise or defend legal claims | Any | Legitimate interests | Exempt where necessary for enforcing a legal right or claim (s. 17(1)(a)) |
5.1 Legitimate interests. Where we rely on legitimate interests, we have weighed our interests against yours. For outreach, we contact only business addresses published for business contact, keep messages relevant to the business, identify ourselves clearly, and make it easy to opt out. You can ask us for a copy of our assessment.
5.2 Outreach and the DPDP Act. Most of our outreach goes to businesses outside India. Where the DPDP Act applies, the Act does not apply to personal data that the person concerned has made publicly available themselves. Where it does apply, we rely on consent or a legitimate use permitted by the Act, give this notice, and stop on request.
5.3 Consent. Where we rely on your consent, you may withdraw it at any time, as easily as you gave it, by emailing [email protected]. Withdrawal does not affect processing before it. If you withdraw consent, we will stop the processing within a reasonable time unless another lawful basis applies.
5.4 Automated decisions and AI. We do not make decisions about you that have legal or similarly significant effects based only on automated processing. We use AI tools to help draft emails, summarise enquiries and prepare audits, and a person reviews them. We use AI tools on business accounts that do not allow our data to be used to train models.
6. Who we share it with
We share personal data only with:
- Our service providers (processors), who act on our instructions under contracts that require them to protect it:
| Provider | What it does for us | Location of processing |
|---|---|---|
| Cloudflare, Inc. | Website hosting and security, forms database (Workers KV), email routing | Global network, including the USA |
| Google LLC (Google Workspace / Gmail) | Business email and documents | USA and other countries |
| AI tools on business accounts that do not allow our data to be used to train models | Drafting and summarising, with a person reviewing the output | The USA and other countries where the tool runs |
| Payment processors we use | Receiving client payments | India and other countries, depending on the processor and the client's payment method |
| Our chartered accountant | Bookkeeping and tax filings | India |
- Professional advisers (lawyers, auditors, accountants) under duties of confidentiality;
- Authorities, where the law requires it, such as tax authorities, courts, the Reserve Bank of India's authorised banks, or the Data Protection Board of India; and
- A buyer or successor of our business, if it is sold or reorganised, under equivalent protections.
We do not sell personal data, rent it, or share it for cross-context behavioural advertising.
7. International transfers
We are based in India, so if you are outside India your personal data will be processed in India. Our providers, including Cloudflare and Google, also process it outside India, in the USA and other countries. Some of your data is therefore processed outside India.
- From the UK and EU. When you send personal data to us directly, we apply the UK GDPR or EU GDPR to it. When we pass UK or EU personal data on to a provider in another country without an adequacy decision, we rely on the safeguards the provider offers: the European Commission's Standard Contractual Clauses, the UK International Data Transfer Agreement or the UK Addendum to those Clauses, or the EU-US Data Privacy Framework (and its UK extension) where the provider is certified. You can ask us for details.
- From India. We transfer personal data outside India only as the DPDP Act permits, and not to any country the Government of India restricts.
8. Your rights
Stopping our emails. Click the unsubscribe link in any email or reply "unsubscribe". We act on it straight away and in any case within 10 business days, and you will not need to log in or pay anything. Your right to object to direct marketing is absolute: we will stop.
Under the UK GDPR and EU GDPR you have the right to: access your data; have it corrected; have it erased; restrict how we use it; receive it in a portable format; object to processing based on legitimate interests; withdraw consent; and complain to a supervisory authority (in the UK, the Information Commissioner's Office, ico.org.uk; in the EU, the authority in your country). We will reply within one month, which we may extend by two months for complex requests, telling you why.
Under the DPDP Act you have the right to: a summary of the personal data we process and the processing activities; the identities of others we have shared it with; correction, completion, updating and erasure; grievance redressal; and nominating another person to exercise your rights if you die or become unable to. Once the relevant DPDP Rules apply, we will resolve grievances within the time they set (currently 90 days at most). If you are not satisfied, you may complain to the Data Protection Board of India after using our grievance process.
Complaints to us. You can complain to us first at [email protected]. We will acknowledge a complaint within 30 days and tell you the outcome without undue delay.
How to ask. Email [email protected]. We may need to confirm your identity, and we will ask only for what we need to do that. Requests are free unless they are manifestly unfounded or excessive.
9. United States
CAN-SPAM. Our commercial emails identify us, use accurate headers and honest subject lines, include our postal address, and contain a working opt-out that we honour within 10 business days.
California (CCPA/CPRA). The California Consumer Privacy Act applies to businesses that exceed thresholds set by the Act, such as annual gross revenue above US$26,625,000 (as adjusted from 1 January 2025). We are currently below those thresholds, so we believe the Act does not yet apply to us. We nevertheless do not sell or share personal information, do not use sensitive personal information, and will respond to requests to know, correct or delete personal information sent to [email protected]. If we become subject to the Act, we will update this notice.
Other US states. Similar state privacy laws apply above thresholds that we do not currently meet. The same commitments apply.
10. How long we keep it
| Data | Retention |
|---|---|
| Website delivery and security logs (Cloudflare) | As set by Cloudflare for security purposes, usually short; we do not export them |
| Main-site form spam counter | Up to 1 hour |
| Services-site form submissions (stored in Cloudflare Workers KV) | Deleted automatically 365 days after submission. Copies in our inbox are deleted in an annual clean-up, unless they become client or contract records |
| Submissions held by spam checks | 30 days |
| Services-site rate-limit counter (hashed IP) | Up to 2 hours |
| Enquiries and correspondence that do not lead to a contract | Up to 24 months after the last exchange |
| Outreach records (business contact, source, messages) | Up to 24 months after the last contact, or sooner on request |
| Suppression list | For as long as we send outreach, so that we never contact you again. We keep the minimum needed (the address, or a coded token) |
| Client records, contracts, invoices and payment and export records | For the period required by Indian tax, accounting, company and foreign-exchange law (generally 8 years after the end of the relevant financial year) |
| Job applications | Up to 12 months, unless you join us or ask us to delete them sooner |
| Data needed for a legal claim | Until the claim is finally resolved |
When a retention period ends, we delete the data or make it anonymous. Where the DPDP Rules require us to keep certain logs or data for a minimum period, we keep them for that period.
11. Security
We protect personal data with reasonable security safeguards, including: encrypted connections (HTTPS) on both websites; access only for people who need it; multi-factor authentication on accounts that hold personal data; secure storage of credentials; hashing of IP addresses used for rate limiting; and short retention. No system is perfectly secure. If a personal data breach occurs, we will notify affected people and the relevant authorities as the law requires, including the Data Protection Board of India and, where it applies, the ICO or an EU authority within 72 hours of becoming aware of a reportable breach.
12. UK and EU representative
Because we are based outside the UK and EU, the UK GDPR and EU GDPR may require us to appoint a representative there. If we appoint one, we will name them in this notice. In the meantime, contact us directly at [email protected].
13. Children
Our websites and services are for businesses and adults. They are not directed at anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has sent us personal data, contact us and we will delete it.
14. Changes to this notice
We will update this notice when our practices change and change the date at the top. If a change is significant, we will highlight it on our websites and, where we have your email address and the change affects you, tell you by email before it applies.
15. Contact
Questions, requests and complaints: [email protected], or by post to AutonomicsAI LLP, 303, Gitanjali Pride 1, 5th Main, 3rd A Cross, Jeevanbhimanagar, Bengaluru 560075, Karnataka, India.