Privacy Policy & Sovereign Data Governance
NOXSOV operates on a core tenet of digital sovereignty. We design our platforms from the silicon level up to safeguard data custody, eliminate telemetry surveillance, and uphold affirmative data principal rights.
EXECUTIVE PRIVACY & DPDPA COMMITMENTS
01.Identification of the Data Fiduciary
Under India's Digital Personal Data Protection Act, 2023 (“DPDPA”) and applicable international data sovereignty regulations, NOXSOV Pvt. Ltd. (Estb. 2026) (“NOXSOV”, “we”, “us”, or “our”) acts as the Data Fiduciary regarding personal data collected through this website, enterprise contact forms, and client engagement channels.
For enterprise deployments of our software (such as Kryptik multi-tenant guard management, NOXSOV Events, or Tax Incubator), the client enterprise operates as the primary Data Fiduciary regarding their own field operators, personnel, and end customers, while NOXSOV acts solely as a technical software provider or Data Processor under strict contractual tenant isolation.
02.Categories of Data Collected & Purpose of Processing
Pursuant to the statutory principle of purpose limitation (Section 4 of the DPDPA), we process only the minimum digital personal data necessary to provide and manage sovereign enterprise systems:
- Enterprise Inquiry Data: When submitting an architecture briefing request or quote inquiry via our contact form, we collect your full name, enterprise work email, organization name, role/department, target product, and operational scope details.
- Verifiable Consent & Preference Records: When managing cookies or submitting inquiries, we record a unique consent identifier (e.g.
DPDPA-2026-XXXX), timestamp, selected categories, and an anonymized IP hash as mandated by DPDPA Section 6(7) and DPIIT frameworks. - Technical & Security Metadata: Ephemeral server request headers, browser user agent strings, and light/dark theme preference (
noxsov-theme) stored in client-side localStorage to ensure seamless rendering without screen flicker. - Kryptik Guard Field Telemetry: In Kryptik production instances, guard biometric presence and uniform compliance are evaluated locally via a dedicated Python/Flask OpenCV microservice. No biometric imagery is ever offloaded to external public LLMs or ad networks.
03.Notice, Affirmative Consent & Zero Pre-Ticked Checkboxes
In strict accordance with Section 6(1) of the DPDPA 2023:
“The consent given by the Data Principal shall be free, specific, informed, unconditional and unambiguous with a clear affirmative action, and shall signify an agreement to the processing of her personal data for the specified purpose...”
To ensure full compliance, NOXSOV guarantees:
- Terms and conditions checkboxes across all inquiry and consent workflows are strictly unchecked by default.
- Non-essential cookie categories (Performance Analytics, Locale Preferences, and Marketing Communications) are disabled by default.
- You may withdraw your consent at any time without punitive degradation of core site access, as provided under Section 6(4) of the DPDPA.
04.Statutory Rights of the Data Principal under DPDPA
As a Data Principal whose digital personal data is processed by NOXSOV, you possess enforceable statutory rights under Chapter III of the DPDPA:
Request a summary of personal data being processed, processing activities, and identities of all entities with whom data has been shared.
Request correction of inaccurate or misleading data, completion of incomplete data, or complete erasure when no longer necessary.
Readily accessible mechanism to register complaints regarding act/omission of the Data Fiduciary, resolved by our Grievance Officer.
Nominate another individual to exercise your data principal rights in the event of death or incapacity.
05.Security Safeguards & Dual-Audit Certification
In compliance with Section 8(5) of the DPDPA, NOXSOV implements reasonable security safeguards to prevent personal data breaches:
- End-to-end TLS 1.3 encryption in transit for all web transmissions and EmailJS notification bridges.
- Hardened Supabase PostgreSQL with strict Row Level Security (RLS) separating tenant datasets.
- Dual-pass security audit hardening removing hardcoded credentials and ungated AI inference endpoints.
- Anonymized SHA-256 IP hashing for consent log integrity verification.
Data Protection Officer & Grievance Redressal
Section 13, Digital Personal Data Protection Act, 2023 & DPIIT Regulatory Coordination
If you have any questions, wish to exercise your rights of access, correction, erasure, or desire to file a formal privacy grievance, please communicate directly with our Data Protection Office:
If your grievance is not resolved satisfactorily, you retain the statutory right to escalate your complaint to the Data Protection Board of India as constituted under Section 18 of the DPDPA.