Privacy Policy

Who we are and what this policy covers

GONATURELLE PRIVATE LIMITED (CIN U47912TN2026PTC190616) is a private limited company incorporated in India with its headquarters at No. 14/11, Sunkurama Street, Mannady, Tondiarpet Fort St George, Chennai, Tamil Nadu 600001, India. We operate the website at gonaturelle.si, the GONATURELLE web application, the GONATURELLE Python and TypeScript SDKs, and the GONATURELLE CI integrations (together, the Services).

This policy explains how we handle personal data about people who visit our website, contact us, attend our events, apply for jobs, sign up for a trial, or use the Services as named account users. For this data, GONATURELLE decides why and how it is processed, which makes us the controller under the GDPR and the Data Fiduciary under India's Digital Personal Data Protection Act, 2023 (DPDP Act). The Digital Personal Data Protection Rules, 2025 phase in the Act's obligations through about May 2027; we already apply the rights and grievance process described below.

When you upload test cases, prompts, agent traces or other content to the Services (Customer Data), we process it only on your instructions. In that role we are a processor under the GDPR and a Data Processor under the DPDP Act, and the terms that govern it are your subscription agreement, our Data Processing Addendum and, where PHI is involved, our Business Associate Agreement. This policy does not expand what we may do with Customer Data.

Personal data we collect

We collect the minimum we need to run the website, respond to you and provide the Services. We do not buy personal data from data brokers and we do not use third-party advertising trackers.

• Contact and lead data you give us: name, work email, company, role, team size, vertical and the message you write in a form or email.
• Account data: name, work email, organisation, role assignments, SSO identifiers from your identity provider (for example Okta or Microsoft Entra ID), and authentication logs.
• Usage data from the application: which features you use, suite and run identifiers, timestamps, IP address and browser type, kept to operate, secure and bill the Services. Usage telemetry never includes prompt text, agent outputs, test case content or PHI.
• Billing data: billing contact, invoicing address and tax identifiers. Card numbers are collected and stored by our payment processor, not by us.
• Recruiting data: CV, links you share, interview notes and right-to-work information if you apply for a role.
• Website data: server logs (IP address, user agent, requested URL, referrer) kept for security, and aggregate first-party event counts such as form submissions, collected without cookies.

Why we use it and on what legal basis

Under the DPDP Act we process your personal data on the basis of your consent, given by submitting a form or creating an account, or for the legitimate uses the Act permits, such as complying with law. Under the GDPR we rely on the bases listed below. You can withdraw consent at any time; withdrawal does not affect processing that happened before it.

• To provide and secure the Services and your account (performance of a contract; legitimate interests in preventing abuse).
• To answer enquiries, schedule technical demos and follow up on trials (consent or legitimate interests in responding to business requests).
• To send product updates and the monthly newsletter if you subscribed (consent; every email has a one-click unsubscribe).
• To bill, keep accounts and meet tax and audit obligations (legal obligation).
• To assess job applications (consent and steps taken before entering a contract).
• To improve the website and product using aggregate, de-identified usage statistics (legitimate interests). We never use Customer Data to train machine learning models, ours or anyone else's.

Sharing and subprocessors

We share personal data only with service providers that help us run the business, under written contracts that limit them to our instructions and require appropriate security. The current list of subprocessors that may touch Customer Data, with their role and location, is published on our Subprocessors page. Website and sales tooling providers are bound by equivalent terms.

We do not sell personal data and we do not share it for cross-context behavioural advertising, as those terms are defined in the California Consumer Privacy Act as amended by the CPRA. We disclose personal data to authorities only when legally required, and where the law allows we tell the affected customer first so they can object.

If GONATURELLE is involved in a merger, acquisition or sale of assets, personal data may transfer to the successor, which will remain bound by this policy until it gives you notice of any change.

International transfers and data residency

GONATURELLE is headquartered in India and offers multi-tenant hosting in the United States and India. Customer Data stays in the region the customer selects. Enterprise customers can run the Services in a dedicated VPC in their own cloud account or in an air-gapped Kubernetes cluster, in which case Customer Data does not reach our infrastructure at all.

Account, billing and sales data may be processed in India and the United States. Where we transfer personal data from the European Economic Area, the United Kingdom or Switzerland, we rely on the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914) and the UK International Data Transfer Addendum, together with supplementary measures such as encryption in transit and at rest. Transfers out of India follow the DPDP Act and any restrictions the Central Government notifies under section 16.

Retention

We keep personal data only as long as we need it for the purpose it was collected for. Lead and enquiry data is deleted 24 months after our last interaction unless you become a customer. Account data is kept for the life of the account and deleted within 90 days of termination, apart from records we must keep for tax, accounting or legal claims, typically up to eight years. Security logs are kept for 12 months. Recruiting data for unsuccessful applicants is deleted after 12 months unless you ask us to keep it longer.

Customer Data retention is set by the customer in the application and governed by the DPA.

Your rights

Depending on where you live, you have rights over your personal data. We honour the following for everyone, wherever they are, and respond within 30 days.

• Access: a summary of the personal data we hold about you and how we use it (DPDP Act section 11; GDPR Article 15; CCPA right to know).
• Correction, completion and updating of inaccurate data (DPDP Act section 12; GDPR Article 16; CCPA right to correct).
• Erasure, unless we must keep the data by law (DPDP Act section 12; GDPR Article 17; CCPA right to delete).
• Withdrawal of consent and objection to processing based on legitimate interests, including direct marketing.
• Data portability for data you gave us under a contract or consent (GDPR Article 20).
• Nomination: under DPDP Act section 14 you may nominate another person to exercise your rights in the event of death or incapacity.
• Grievance redressal, and the right to complain to a supervisory authority: the Data Protection Board of India, your EU or UK data protection authority, or the California Privacy Protection Agency. We will not discriminate against you for exercising any right.

Grievance Officer and contact

Our Grievance Officer for the purposes of the DPDP Act and the Information Technology Act, 2000 is Ishita Banerjee, Head of Security & Compliance. You can reach her at privacy@gonaturelle.si or by post at GONATURELLE PRIVATE LIMITED, Attn: Grievance Officer, No. 14/11, Sunkurama Street, Mannady, Tondiarpet Fort St George, Chennai, Tamil Nadu 600001, India. We acknowledge grievances within 3 business days and resolve them within 30 days.

To exercise a right, email privacy@gonaturelle.si from the address associated with your data, or use the privacy option on our contact page. We may ask for information to verify your identity. Authorized agents may act for California residents with signed written permission.

Security, children and changes

We protect personal data with AES-256 encryption at rest, TLS 1.2 or higher in transit, SAML SSO and role-based access control for staff, and the controls audited in our SOC 2 Type II report. No system is perfectly secure; if a personal data breach affects you we will notify you and the relevant authorities as the law requires, including the Data Protection Board of India under the DPDP Act.

The Services are for businesses and are not directed at children. We do not knowingly collect personal data from anyone under 18, and we delete it if we learn we have.

We will post any change to this policy on this page with a new date, and email account owners about material changes at least 30 days before they take effect.