Privacy Policy - PrivSpot

Effective Date: 1 October, 2026

I. Who are we?

We are PrivSpot (hereinafter “PrivSpot”, "we" or "us"), a Privacy Notice Health Check system operated by us. PrivSpot is the controller (Sole Proprietor) of your personal data as described in this Privacy Statement, unless otherwise specified. PrivSpot is committed to protecting your personal data and respecting your privacy and rights, and this statement is intended to provide you with information on how your personal data is processed.

II. Scope of this Privacy Statement

This Privacy Statement applies to any personal data we may process about you that we might get directly from you when you interact with us through www.privspot.com and the PrivSpot Privacy Notice Health Check service and when you visit our other online services, including social media pages.

Please visit our Cookie Policy to know in detail about the cookies we use on our websites bearing the PrivSpot name.

III. Personal Data We Collect

PrivSpot collects the following information when you use the Health Check:

Name
Company or application name
Contact email address
Privacy Policy / Privacy Notice URL / Website URL submitted for assessment.

The submitted URL may lead to publicly accessible Privacy Policy content, which PrivSpot retrieves and processes to perform the requested assessment.

PrivSpot does not intentionally ask for IP address, browser/device information, operating-system information or approximate location through the Health Check form. Technical information may nevertheless be generated by hosting, security, payment or other infrastructure where technically necessary.

IV. Why We Collect and Process Personal Data

Legal basis as applicable per the Privacy & Data Protection Laws	Why we process your data
Legitimate interest	We process personal data for the following specific purposes: to receive and process a Privacy Notice Health Check request; to identify the person and company/application associated with the request; to communicate about the requested service; to retrieve and analyse the submitted Privacy Policy / Privacy Notice; to generate the assessment, score, and detailed report; to process and confirm payment; to send service-related communications; to operate, secure, and maintain PrivSpot and comply with applicable legal obligations; to provide, develop, and improve our websites and services and assess and improve user experience; to prevent fraud or criminal activity and to safeguard the security of our interests, including our websites and services; to identify and assess customer interest and opportunities; to the extent permitted by applicable laws and regulations, conducting marketing activities, including sending or displaying services-related materials, managing user and event registrations, training, quality assurance, and administrative purposes.
For taking steps at your request prior to entering into a contract and/or for performance of a contract	To provide and deliver our services. To provide you with requested materials and information when you interact with us and answer your queries Managing billing and payments Managing the relationship established with you
Compliance with Legal Obligations	To fulfil our responsibilities per the applicable laws and regulations.
Consent	Subject to local data protection regulations, where consent is required to: Send you marketing communications (unless you have objected to or opted out of such communications); Send you communications to discuss our services or provide you with offers and trials; To customise individuals’ online experience and improve the performance, usability and effectiveness of PrivSpot online presence; The processing of personal data that you voluntarily provide for specific purposes.

V. Notice, Consent and Consequences of Not Providing Data

Where consent is required, PrivSpot will provide this Notice before or along with the request for consent and will obtain consent in the manner required by applicable law. You have the right to access this Notice in English or any of the 22 languages specified in the Eighth Schedule to the Constitution of India (Assamese, Bengali, Bodo, Dogri, Gujarati, Hindi, Kannada, Kashmiri, Konkani, Maithili, Malayalam, Manipuri, Marathi, Nepali, Odia, Punjabi, Sanskrit, Santali, Sindhi, Tamil, Telugu, and Urdu). The relevant collection interface will provide the applicable communication link or means for consent withdrawal, rights requests and grievances.

Providing the requested information is necessary to use the Health Check. If you do not provide information required to run the service, PrivSpot may be unable to provide the requested assessment or report.

Where processing is permitted on another lawful basis, PrivSpot may process the relevant personal data on that basis.

VI. Processing of a Submitted Privacy Policy URL

When you submit a Privacy Policy / Privacy Notice URL/ Website URL, PrivSpot may retrieve the publicly accessible webpage content associated with that URL and process it to perform the requested assessment.

The URL and retrieved content may be temporarily processed or stored as technically necessary for retrieval, analysis and report generation. You should submit only URLs and content that you are authorised to submit.

VII. Personal Data Contained in a Submitted Privacy Policy

A submitted Privacy Policy may contain personal data such as names, email addresses, addresses or other contact information. Any such information may be processed as part of the assessment to the extent necessary to provide the service.

VIII. Advanced Assessment Processing

PrivSpot uses Google Gemini / Gemini API services to assist with analysis of submitted Privacy Notice content and generation of assessment results. Information necessary for this processing, including submitted Privacy Notice content and instructions required to generate the assessment, may be transmitted to the relevant Google service.

PrivSpot does not intentionally send complete payment-card or banking credentials to the analysis engine.

The processing, retention, location and model-use terms applicable to the Google service are governed by the configuration and contractual terms applicable to the PrivSpot account.

IX. Third-Party Service Providers

PrivSpot may use service providers necessary to operate the website and Health Check, including hosting/infrastructure providers, Google Gemini, Razorpay, email providers and security or technical service providers.

Such providers may receive or process personal data only as necessary for the services they provide to PrivSpot. PrivSpot remains responsible for processing carried out on its behalf to the extent required by applicable law.

X. Payment Processing

Payments for PrivSpot services may be processed through Razorpay. Razorpay handles payment information under its applicable privacy practices and payment-processing terms.

PrivSpot does not intentionally receive or store complete payment-card or banking credentials. PrivSpot may receive transaction information necessary to confirm payment and provide the service, such as payment status and transaction/reference information. Before agreeing to Razorpay, the user must check the privacy policy notice of Razorpay before agreeing. PrivSpot is not held responsible for the use of Razorpay services and information collected and used by Razorpay from the user.

XI. Service Communications

PrivSpot may use the email address you provide to send payment confirmations, service-related communications, report-delivery information, and responses to support or privacy requests. PrivSpot does not use the Health Check email address for marketing communications unless a separate lawful basis and required consent/opt-out mechanism applies.

XII. Report Generation and Download

After the Health Check is completed, PrivSpot generates the requested report and makes it available for download.

PrivSpot is designed not to maintain a permanent user-accessible report library. Temporary storage or processing may occur where technically necessary to generate and deliver the report.

XIV. Retention

PrivSpot retains personal data only for as long as necessary for the purpose for which it was collected, subject to legal and operational requirements.

For the Health Check, the intended retention approach is:

Name, company/application name, and email: retained only as necessary to provide the service, maintain necessary business records, and handle legal or support requirements.
Submitted Privacy Policy URL and retrieved policy content: retained only as necessary for retrieval, assessment and report generation, subject to technical processing requirements.
Gemini prompts/responses: retained only according to the applicable Google service configuration and contractual terms.
Generated report: not maintained as a permanent user-accessible report library; temporary processing/storage may occur for delivery.
Payment transaction information: retained as necessary for payment confirmation, accounting, dispute handling and legal obligations.
Email/service records: retained as necessary for service delivery, support and legal/business records.

Exact technical retention periods must be aligned with PrivSpot’s actual production configuration and vendor settings.

XV. Deletion

When personal data is no longer required, or where deletion is required under applicable law, PrivSpot will take reasonable steps to delete it or cause its deletion, subject to lawful retention requirements and the technical lifecycle of backups and third-party systems.

A Data Principal may request deletion through info.privspot@gmail.com, subject to applicable law and any lawful retention requirement.

XVI. Security Safeguards

PrivSpot takes reasonable technical and organisational measures appropriate to the processing to protect personal data against unauthorised access, disclosure, alteration, loss, misuse or destruction.

Measures may include secure transmission, access controls, authentication, protection of API credentials and other safeguards appropriate to the service architecture. Still, no system can be guaranteed to be 100% secure. If you have questions about the security of your personal information, or if you have reason to believe that the personal information that we hold about you is no longer secure, please contact us immediately as described in this Privacy Statement.

XVII. Cross-Border Processing

Google and other service providers used by PrivSpot may process or store personal data outside India. Where personal data is transferred or made available outside India, PrivSpot will comply with applicable requirements and restrictions governing such transfers.

The specific countries/regions and safeguards depend on the services and configurations actually used by PrivSpot.

XVIII. Cookies and Similar Technologies

PrivSpot may use cookies or similar technologies that are necessary for website operation, security and session management. If optional analytics, advertising or other tracking technologies are introduced, PrivSpot will update its applicable notice and consent mechanisms as required.

XIX. Data Principal Rights

Subject to applicable law, a Data Principal may exercise the following rights:

obtain information about personal data and its processing;
correction, completion and updating of personal data;
erasure of personal data where applicable;
grievance redressal;
nomination of another individual to exercise the Data Principal’s rights in the event of death or incapacity, in accordance with applicable law; and
submit a request or grievance in English or any of the 22 regional languages specified in the Eighth Schedule to the Constitution of India (Assamese, Bengali, Bodo, Dogri, Gujarati, Hindi, Kannada, Kashmiri, Konkani, Maithili, Malayalam, Manipuri, Marathi, Nepali, Odia, Punjabi, Sanskrit, Santali, Sindhi, Tamil, Telugu, and Urdu).

Requests may be made by emailing info.privspot@gmail.com. PrivSpot may take reasonable steps to verify the requester’s identity before acting on a request. Where a nomination is made, PrivSpot will process the request and required particulars in accordance with applicable law and its then-current request procedure.

XX. Withdrawal of Consent

Where processing is based on consent, you may withdraw consent at any time by using the withdrawal mechanism made available by PrivSpot or by contacting info.privspot@gmail.com.

PrivSpot will provide a means for withdrawal with ease comparable to the manner in which consent was given. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. Where withdrawal requires processing to cease, PrivSpot will take the steps required by applicable law unless another lawful basis permits continued processing.

XXI. Grievance Redressal

For a question, request or grievance concerning personal-data processing, contact:

Grievance Officer: Siddharth Bhatt
Privacy and Grievance Contact: info.privspot@gmail.com

PrivSpot will maintain a readily available mechanism for receiving and responding to privacy-related grievances in accordance with applicable law. Grievances will be handled within the period prescribed by applicable law. You may submit your question, request, or grievance to the Grievance Officer in English or any of the 22 languages specified in the Eighth Schedule to the Constitution of India (Assamese, Bengali, Bodo, Dogri, Gujarati, Hindi, Kannada, Kashmiri, Konkani, Maithili, Malayalam, Manipuri, Marathi, Nepali, Odia, Punjabi, Sanskrit, Santali, Sindhi, Tamil, Telugu, and Urdu).

XXII. Nomination

A Data Principal has the right, subject to applicable law, to nominate another individual who may exercise the Data Principal’s rights in the event of the Data Principal’s death or incapacity.

A nomination request may be made through info.privspot@gmail.com. PrivSpot may require the particulars reasonably necessary to record, update, or act upon the nomination in accordance with applicable law.

XXIII. Children’s Data

PrivSpot is not directed specifically at children and does not knowingly seek to collect personal data from children through the Health Check except where permitted and handled in accordance with applicable law.

XXIV. Changes to this Privacy Notice

PrivSpot may update this Privacy Notice when its processing activities, technology, service providers, legal requirements or business practices change. The updated Notice will be published on the PrivSpot website with an updated effective date or last-updated date. Where applicable law requires additional notice or consent for a material change, PrivSpot will take the required steps.

XXV. Contact

If you have any questions or concerns about this Privacy Statement or how your Personal Data is processed, you can contact us at info.privspot@gmail.com.

XXVI. Applicable Law

This Privacy Notice is intended to describe PrivSpot’s processing of personal data with reference to the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025, to the extent applicable to the processing activities described here.

XXVII. Review Against Actual Processing

This Notice must be kept consistent with PrivSpot’s actual technical architecture, service providers, data flows, retention settings, and operational processes. If those facts change, PrivSpot will review and update this Notice as required.