Privacy Policy – Evidaro
Last updated: 23 October 2026
Evidaro (evidaro.ai and app.evidaro.ai) is operated by SCUTI MARKETPLACE INDIA (OPC) PRIVATE LIMITED CIN U47912UP2025OPC218793, registered office P-1801, Pan Oasis Society, Sector 70, Noida, Gautam Buddha Nagar, Uttar Pradesh 201301, India ("Evidaro", "we", "us").
This policy explains how we handle personal data under the Digital Personal Data Protection Act, 2023 and the rules made under it ("DPDP law"), and the Information Technology Act, 2000.
1. Two roles
- When you use our website or ask about Evidaro, we decide why and how your personal data is used. We are the data fiduciary, and this policy applies in full.
- When a firm or company uses Evidaro for its work (for example a CA firm uploading a client's Board's report), that customer decides what data goes in and why. The customer is the data fiduciary; we act only on its instructions as its data processor, under our Data Processing Agreement. Questions about that data should go to the customer first.
2. What we collect
| Where | Data | Why | Legal basis |
|---|---|---|---|
| Pilot / contact forms | Name, work email, organisation, role, firm size, client count, your message | To reply and discuss a pilot | Your consent, given by submitting the form |
| Website analytics | Page and button events (e.g. "demo started"), with no cookies, no device identifiers and no third-party trackers | To understand which pages help visitors | Legitimate use for running the website |
| Product accounts | Name, email, password (stored only as a hash), role, firm, sign-in times | To provide the service and keep it secure | Contract with your organisation |
| Product use | Records you create, audit-log entries of actions you take, questions you ask the assistant | To provide the service and an accountable audit trail | Contract with your organisation |
| Security logs | IP address, request path, time, browser type | Security, fraud prevention and legal log-retention duties | Legal obligation (CERT-In directions) |
| Intro-call bookings | Whatever you enter on our Cal.com booking page | To hold the meeting | Your consent |
The public demo uses only fictional companies and sample files; please do not enter real personal data there.
3. Where data is stored and processed
- Product and website data: Amazon Web Services, Asia Pacific (Mumbai) region – application, database, document storage, logs and backups.
- AI assistant: when the assistant composes an answer, the relevant record extracts are sent to a language model on Amazon Bedrock in the Mumbai region. The application is configured to refuse any model that would process data outside India. Amazon Bedrock does not use your data to train models.
- Our own email: if you email us, your message is held in our Google Workspace mailbox, which Google may store outside India. Website enquiries are kept in Evidaro in Mumbai; our notification emails do not contain your details.
- Bookings: Cal.com, outside India.
- The public website (evidaro.ai) is delivered through Amazon CloudFront, whose edge locations may be outside India for visitors abroad. The product (app.evidaro.ai) is served directly from Mumbai.
4. Sharing
We do not sell personal data or use it for advertising. We share it only with the service providers above, acting for us, and where the law requires (for example a lawful request from a government agency or CERT-In).
5. Retention
- Enquiries: up to 24 months after our last contact, unless you become a customer.
- Account data: for the life of the account, then deleted within 30 days of termination, unless the law requires longer.
- Security logs: at least 180 days (CERT-In) and up to 400 days.
- Demo workspaces: deleted automatically, within hours.
6. Your rights
Under DPDP law you may ask to access a summary of your personal data, correct or update it, erase it, withdraw consent (this does not affect earlier processing), nominate someone to act for you, and raise a grievance. Write to contact@evidaro.ai. We reply within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India.
Grievance Officer: Deo Shankar, contact@evidaro.ai, P-1801, Pan Oasis Society, Sector 70, Noida, Gautam Buddha Nagar, Uttar Pradesh 201301, India.
7. Security
Encryption in transit (TLS) and at rest (AWS-managed keys); each customer's data isolated by database row-level security; role-based access; a tamper-evident (hash-chained) audit log; access logs kept in India. No system is perfectly secure. We will notify you and the authorities of a personal data breach as DPDP law requires.
8. Children
Evidaro is a business service and is not intended for anyone under 18.
9. Changes
We will post changes here and, for material changes, notify account holders by email.
10. Contact
SCUTI MARKETPLACE INDIA (OPC) PRIVATE LIMITED, P-1801, Pan Oasis Society, Sector 70, Noida, Gautam Buddha Nagar, Uttar Pradesh 201301, India · contact@evidaro.ai