Privacy Policy

Alberoz Group Private Limited (“we”, “us”, or “our”) is an Indian company that builds custom software, subscription SaaS products, AI and automation solutions, and technology training programs. We act as the data fiduciary / data controller for the personal data described in this Policy.

This Policy is designed to comply with the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology Act, 2000 in India, and reflects the requirements of the EU and UK General Data Protection Regulation (GDPR) and the California Consumer Privacy Act as amended (CCPA/CPRA) where they apply to you — see the regional supplements in sections 19 and 20.

• Entity: Alberoz Group Private Limited (CIN: U72900UP2021PTC152033)
• Privacy contact / Grievance Officer: Business@alberotechnologies.com
• Registered office: H No. 1582, Naubasta, Rajendra Nagar Road, Kanpur, Uttar Pradesh 208021, India

This Policy covers our public website, our client portal, our SaaS products, and the services we deliver under a proposal, quotation, statement of work, or order form (“Service Agreement”).

Our products are Albero CRM, Albero LMS, Albero HRM, Albero PMS, Albero BI, Albero Support and Albero Labs. This Policy also covers the mobile applications for these products that we publish on the Apple App Store and Google Play (the “Apps”), including test and beta versions distributed through TestFlight or Google Play testing tracks. Sections 3 and 9 explain what is specific to the products and the Apps.

Where we build or operate a system for a client and process personal data on that client’s instructions, the client is the data fiduciary / controller and we act as a data processor. In those cases our client’s privacy notice governs the processing, and our obligations are set out in the Service Agreement or an accompanying data-processing agreement (DPA), which we make available to clients on request.

When an organisation subscribes to one of our products, it decides whose data goes into its workspace and why. For that data (“Customer Data”) the organisation is the data fiduciary / controller and we are its processor: we host, secure, back up and support the workspace, and we process Customer Data only to provide the product, on the organisation’s documented instructions. If you are an employee, learner, customer or contact of one of our customers, please direct requests about your data to that organisation first; we will help it respond.

• We do not sell Customer Data, use it for advertising, or combine it with data from other customers;
• Albero staff access a workspace only to provide support the customer has asked for, to investigate a security or abuse report, or where law requires, and that access is logged;
• Integrations (for example WhatsApp Business, Zoom, Google Workspace, Razorpay or Slack) are switched on by the customer; data sent to them is governed by the customer’s own agreement with that provider;
• When a subscription ends, the customer can export Customer Data until the end of the paid period. We then delete it within 90 days, and from rolling backups within a further 90 days, unless the law requires us to keep part of it;
• A data-processing agreement (DPA) covering Customer Data is available to customers on request.

To be explicit about the boundaries, we do not:

• Sell, rent, or trade your personal data to anyone;
• Store full payment card or bank account numbers — payments are handled entirely by our payment gateway;
• Collect precise GPS location, biometric data, or government identity documents through this website;
• Access your contacts, address book, or device files;
• Use your personal data or client project data to train artificial-intelligence models (see section 7);
• Set analytics or advertising cookies before you opt in through our cookie banner (see section 8).

Information you provide. Depending on how you interact with us, we may collect:

• Identity and contact details — name, email address, phone number, company/organisation name, and role;
• Enquiry and project details — the content of forms, messages, proposals, and correspondence you send us;
• Account credentials — username and password for our client portal or SaaS products (passwords are stored in hashed form, never in plain text);
• Billing information — billing name, address, GST details, and transaction records (full card/bank details are handled by our payment gateway, not stored by us);
• Complaint details and any optional attachments you submit through our Complaint Forum.

Information collected automatically. When you visit our website or use our products, we may collect:

• Device and browser information — IP address, device type, operating system, and browser type;
• Usage data — pages visited, referring URLs, actions taken, timestamps, and session activity;
• Log and diagnostic data used to maintain security, prevent fraud, and diagnose faults;
• Your cookie-consent choices, stored locally in your browser as described in section 8.

Information from third parties. We may receive limited data from our analytics, advertising-measurement, and payment providers — for example, aggregate campaign performance, or the success or failure of a transaction. We do not receive your card details from the payment gateway.

We use personal data for the following purposes, on the legal bases indicated:

We build AI and automation systems for clients, and we use AI-assisted tooling internally. Our commitments about your data are:

• We do not use your personal data, enquiry content, or client project data to train, fine-tune, or improve any artificial-intelligence model, whether our own or a third party’s;
• Where an engagement requires a third-party AI service (for example, a hosted model API), the specific providers, data flows, and safeguards are identified in the Service Agreement before any data is shared, and are covered by the applicable data-processing terms;
• AI output is probabilistic. Systems we deliver may produce results that are inaccurate or incomplete, and we design them so that a human remains responsible for decisions that affect people;
• We do not use your personal data to make solely automated decisions that produce legal effects concerning you or similarly significantly affect you.

No analytics or advertising cookie is set on your device until you opt in. Until you make a choice in our cookie banner, only strictly necessary browser storage is used and no third-party tag is loaded. You can change or withdraw your choice at any time from the Cookie settings link in the footer of every page, or by clearing site data in your browser.

We use three categories of cookie: strictly necessary storage that records your cookie choice and interface preferences; analytics cookies (Google Analytics 4 and Tag Manager) that show us how the site is used in aggregate; and marketing cookies (Meta Pixel and Google AdSense) that measure whether our advertising works. We also use the Meta Conversions API, which sends conversion events from our server with identifiers hashed before transmission, and which runs only where you have accepted marketing cookies.

Our Cookie Policy lists every cookie by name, with its purpose, duration, and specific opt-out instructions, along with how to manage cookies in your browser and our position on “Do Not Track” signals.

The Apps give you access to the same workspace as the web version of each product, so the Customer Data described in section 3 is the same whether you use a browser or a phone. This section covers what is specific to a phone or tablet.

Device permissions. An App asks for a permission only when you first use a feature that needs it, never at install. You can refuse, and you can change your choice later in your device settings; the rest of the App keeps working.

The Apps do not read your contacts, call log, SMS messages, calendar, or other apps’ data.

Device and usage data. To run the Apps and fix faults we collect: device model and operating-system version, App version, language and time zone, a push-notification token, sign-in and sync events, and crash reports (the App’s state and a stack trace at the moment of a crash). Crash reports are not linked to your identity beyond your workspace account ID.

No advertising tracking. The Apps contain no advertising, collect no advertising identifiers (Apple IDFA or Google Advertising ID), and do not track you across other companies’ apps or websites. The cookie choices on our website do not apply inside the Apps, because the Apps set no cookies.

Push notifications. Notifications are delivered through Apple Push Notification service on iOS and Firebase Cloud Messaging on Android. We send the minimum content needed (for example “New ticket assigned to you”); you can hide previews or turn notifications off per App in your device settings or in the App.

Data stored on your device. Sign-in tokens are kept in the platform’s secure storage (Keychain on iOS, Keystore on Android). To work with a weak signal, an App may keep a recent copy of records you opened and changes you made offline; these are synced when you reconnect and removed when you sign out. If your organisation signs you out remotely or removes your account, the local copy is cleared the next time the App connects.

App stores. Apple and Google process your data when you download, update or review an App, under their own privacy policies; we do not receive your store account details. The privacy information shown on each App’s store listing (Apple’s App Privacy details and Google Play’s Data safety section) summarises this section and is kept consistent with it.

Deleting your account. If you created your own account, you can delete it from inside the App (Settings, then Delete account) or by writing to us; we confirm and complete deletion within 30 days. If your account was created by your employer, school or another organisation, deleting the App does not delete the account: ask that organisation, or write to us and we will pass the request on. Uninstalling an App removes its local data from your device but does not cancel a subscription; see our Refund & Cancellation Policy.

Beta versions. Test versions of the Apps may collect more detailed diagnostics (for example, screen flow before a crash) to help us fix problems before release. Testers are told this when they join the test, and the extra diagnostics stop in the public release.

We share personal data with a small number of vetted providers who process it on our behalf, under contractual confidentiality and data-protection obligations:

We will update this table before adding a new processor that handles personal data, and customers with a DPA are told in advance of a change to the processors that handle their Customer Data.

Beyond these processors, we disclose personal data only where required by law, court order, or a lawful request from a competent authority; where necessary to establish, exercise, or defend legal claims, or to protect the rights and safety of our users and the public; or in connection with a merger, acquisition, or restructuring, in which case this Policy continues to apply. We do not sell personal data.

With your consent, or where otherwise permitted by law, we may send you marketing communications about our products, offers, and content. You can opt out at any time using the unsubscribe link in our emails or by contacting us. Opting out of marketing does not affect service-related or transactional communications, which we must send to operate your account or engagement.

Your personal data is stored on secure servers managed by the hosting providers named above. We apply technical and organisational measures appropriate to the risk, including encryption in transit (HTTPS/TLS), hashed credentials, encrypted storage of sensitive configuration values, role-based access restricted to staff who need it, and monitoring of access and errors.

In our products, each customer’s workspace is isolated from every other customer’s, sensitive fields (such as bank details in Albero HRM and source credentials in Albero BI) are encrypted at rest, and administrative actions are written to an audit log. The Apps talk to our servers only over encrypted connections and keep sign-in tokens in the device’s secure storage, as described in section 9. We hold no third-party security certification today and do not claim one.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. In the event of a personal data breach that is likely to affect you, we will notify you and the relevant authority as required by law — including the 72-hour notification requirement under GDPR, and notification to the Data Protection Board and affected users under the DPDP Act.

We keep personal data only for as long as necessary for the purpose it was collected for, or as required by law. Our standard periods are:

When data is no longer required, we securely delete or irreversibly anonymise it. Backups are purged on a rolling cycle.

Subject to applicable law, you have the right to:

• Access the personal data we hold about you and request a copy;
• Request correction of inaccurate, misleading, or incomplete data;
• Request erasure of your data where it is no longer required or where you withdraw consent;
• Withdraw consent at any time, without affecting processing carried out before the withdrawal;
• Nominate another individual to exercise your rights in the event of death or incapacity, as provided under the DPDP Act;
• Object to or restrict processing, and request portability of your data, as described in the regional supplements below.

To exercise any right, email us at Business@alberotechnologies.com. We acknowledge requests within 2 business days and respond within 30 days. We may need to verify your identity first, and we will tell you if a request is one we are legally required to decline. Exercising these rights is free; we may charge a reasonable fee only for manifestly unfounded or excessive repeat requests.

If you are not satisfied with our response, you may escalate through our Escalation Policy or complain to the Data Protection Board of India or your local supervisory authority.

We are based in India and our primary infrastructure serves users worldwide. Some of our processors — notably Google and Meta — operate globally, so personal data may be processed outside your country.

Where personal data is transferred out of the EEA or the UK, we rely on the European Commission’s Standard Contractual Clauses (and the UK International Data Transfer Addendum where applicable), together with the transfer terms in each provider’s data processing agreement. Transfers out of India are made in accordance with the DPDP Act and are not made to any country restricted by the Central Government. Data also transits third-party networks in the ordinary course of internet routing.

Our website and commercial services are intended for businesses and for individuals aged 18 and above, and are not directed at children. We do not knowingly collect personal data directly from a child through this website.

Where we deliver education programs involving minors (such as Albero Labs in schools, or an institute’s academy on Albero LMS), personal data of children is processed only through the school or institution acting as our client, on the basis of verifiable parental or guardian consent obtained by that institution as required under the DPDP Act. We do not use children’s data for tracking, behavioural monitoring, or targeted advertising. If you believe a child has provided us personal data directly, contact us and we will delete it.

Learner and student accounts in the Apps are created by the institution, show no advertising, and offer no way for a child to contact anyone outside their institution’s workspace. Features that could expose a child to strangers, such as public profiles, are not available on learner accounts, and webcam proctoring is not offered.

We may update this Privacy Policy to reflect changes in our practices, technology, or legal requirements. The updated version will be posted on this page with a revised “Last updated” date. Where a change is material, we will give additional notice — by email or an on-site notice — and, where the change affects cookies, we will ask for your consent choices again.

For any privacy question, to exercise your rights, or to reach the Grievance Officer appointed under the DPDP Act and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, contact us:

• Grievance Officer / Data Protection contact: Business@alberotechnologies.com
• Phone: +91 91707 80671
• Registered office: H No. 1582, Naubasta, Rajendra Nagar Road, Kanpur, Uttar Pradesh 208021, India
• Response times: acknowledgement within 2 business days; resolution of a grievance within 30 days

See also our Cookie Policy, Terms & Conditions, Refund & Cancellation Policy, and Complaint Forum.

If you are in the European Economic Area or the United Kingdom, this section applies in addition to the rest of this Policy.Alberoz Group Private Limited is the controller of your personal data.

Legal bases (Article 6). We process personal data on the bases set out in the table in section 6: performance of a contract or steps prior to it, compliance with a legal obligation, our legitimate interests in operating and securing our business, and your consent for marketing and non-essential cookies. Where we rely on legitimate interests, we have assessed that our interests are not overridden by your rights, and you may object as described below.

Your rights (Articles 15–22). You have the right of access, rectification, erasure, restriction of processing, data portability, and objection — including an absolute right to object to processing for direct marketing — and the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. We do not carry out such automated decision-making.

Transfers. Transfers of personal data outside the EEA or the UK are made under the European Commission’s Standard Contractual Clauses, or the UK Addendum, as described in section 15. You may request a copy of the safeguards we rely on.

Complaints. You may lodge a complaint with your local data protection authority — for UK residents, the Information Commissioner’s Office (ico.org.uk) — though we ask that you contact us first so we can try to resolve the matter.

If you are a California resident, the CCPA as amended by the CPRA gives you the rights below. In the preceding twelve months we collected the following categories of personal information, as defined by the CCPA:

Do Not Sell or Share My Personal Information. We do not sell personal information, and we do not share it for cross-context behavioural advertising within the meaning of the CPRA except through the advertising cookies described in section 8 — which are set only if you opt in. Declining marketing cookies in our banner is an effective opt-out, and we honour Global Privacy Control signals where our advertising partners support them. We do not knowingly sell or share the personal information of consumers under 16.

Your rights. You have the right to know what personal information we collect and how we use and disclose it, to request deletion or correction, to opt out of sale or sharing, to limit the use of sensitive personal information (we collect none), and not to receive discriminatory treatment for exercising any of these rights. You may use an authorised agent, with written permission and identity verification. Submit requests to Business@alberotechnologies.com — we respond within 45 days, extendable once by a further 45 days where necessary.