Privacy Policy

EarthSync Technologies Private Limited (“EarthSync”, “we”, “us”) is a company incorporated in India, Corporate Identity Number U71200RJ2023PTC091556, with its registered office at A 7, Flat No 501, Royal Abord, Tilak Nagar, Jaipur, Rajasthan 302004, India. Our team works in Bengaluru. We build an AI-powered analytics platform for the renewable energy sector.

This policy explains what personal information we handle, why, who we share it with, and your rights. It covers:

• Visitors to our website
• People who contact us or ask for a demo
• People who sign in to the EarthSync platform
• People who apply for a job with us
• Business contacts whose details reach us from other sources, such as colleagues, business-contact databases, or email and meetings with our team

For most of this processing EarthSync is the controller (the “Data Fiduciary” under India’s Digital Personal Data Protection Act 2023). The exception is the content an organisation puts into its platform workspace: projects, uploads and any personal information inside them. We process that on the organisation’s behalf and under its agreement with us, and the organisation decides how it is used. This policy does not cover EarthSync’s own employees and contractors.

Website visitors.

If you accept analytics on our cookie banner: device and browser type, approximate location derived from your IP address, pages viewed, referring page, and how you interact with the page, including session recordings. If you decline, none of this is collected. Our servers and security systems also log IP addresses and request details to keep the site running and safe (see “Error monitoring and security logs”).

People who contact us.

Through our contact form: your name, work email, company, role, the purpose of your enquiry and your message. If you email or meet us, we hold that correspondence.

Platform users.

• Account details: name, email, company, job title, phone number, profile image and profile link, organisation membership and role
• Sign-in and security data: password hash, multi-factor and passkey credentials, sessions (IP address, browser and device name), and sign-in attempts
• Assistant conversations: the questions you ask the AI assistant and its answers (see “AI features”)
• Usage data: which features you use and, where enabled, session recordings (see “Analytics in the platform”)
• Email activity: whether our emails to you were delivered, opened or clicked

Job applicants.

Your name, email, the role and type of engagement you apply for, profile links (for example LinkedIn or GitHub), a note to us, your CV if you upload one, notes from interviews, and an AI-assisted ranking score (see “Job applicants”).

Information from other sources.

We also hold details of people we work with or may work with, such as contacts at customers, prospects, partners and investors, that do not come directly from them:

• Business contact details (name, work email, company, role) from business-contact databases such as Apollo.io, and from introductions
• Emails between our team and people outside EarthSync: sender, recipients, subject, date and a preview of up to 300 characters and, for organisations we work with, the messages themselves
• Metadata of meetings with our team: title, time and attendees
• If you sign in with Google or Microsoft, the basic profile details they share with us

We use these to manage business relationships and understand our sales pipeline. You can object at any time by writing to privacy@earthsync.io.

We do not sell or rent personal information. We use it only for the purposes below. The legal basis applies under the GDPR and UK GDPR; under India’s DPDP Act we rely on your consent or on the legitimate uses the Act permits.

Where we rely on legitimate interests, you can object, and we will stop unless we have a compelling reason to continue. Where we rely on consent, you can withdraw it at any time.

The EarthSync platform includes an AI assistant. When you use it, your question, and the workspace data needed to answer it, are sent to a large language model provided by Google and run on Google Cloud. This means AI processing can happen outside India, even though your workspace data is stored in India.

• We store your conversations with the assistant in your organisation’s workspace, so you can return to them
• We record each conversation, including the full question and answer and your user and organisation identifiers, in Langfuse, an AI-monitoring service in the United States. We use this to check answer quality and fix problems
• The assistant may use its provider’s built-in web search to answer a question; the search query is sent to that provider
• We do not use customer data to train AI models

Some of our speech features (speech-to-text and text-to-speech) also run on Google Cloud in the United States. We will update this section before we add or change an AI provider.

When you apply through our careers page, your application is stored in our systems in India, including our internal applicant-tracking system. A CV you upload is checked for malware before anyone opens it. We use your application only to consider you for work with us.

AI-assisted ranking.

To help us review applications, a large language model provided by Google and run on Google Cloud reads the job description, the links you gave us and the text of your CV, and produces a score with its reasoning. We use the score only to order applications within a role.

• A person makes every decision. The score cannot move you to another stage or reject you
• You can ask for a person to review your application without the score, or object to the scoring, by writing to privacy@earthsync.io
• The score and its reasoning are erased with the rest of your application

We keep applications for 12 months (see “How long we keep information”). If you would like us to keep your details for future roles, or to delete them sooner, tell us.

Consent comes first. Our website loads no analytics until you choose “Accept” on the cookie banner. If you choose “Decline”, none are loaded and the site works the same. You can change your choice at any time with “Cookie settings” in the site footer; withdrawing consent reloads the page without the analytics.

After you accept, the Microsoft Clarity script also contacts c.bing.com, a Microsoft domain. We record whether visitors accept or decline as a simple count, with no identifiers. Google Analytics is configured to anonymise IP addresses.

Inside the signed-in platform we use Mixpanel and Microsoft Clarity to understand how features are used and where people get stuck. This is separate from the website cookie banner. We run two versions of the platform, and they send different information.

The platform most customers use today.

• Mixpanel receives your user ID and the actions you take, and records every session using Mixpanel’s default masking settings
• Microsoft Clarity records sessions with Clarity’s default settings and no additional masking of workspace content

The newer version of the platform.

Where Mixpanel and Clarity are switched on:

• Mixpanel receives your user ID, email, name, your organisation’s ID, name and country, whether you are an admin, and the actions you take
• Microsoft Clarity records sessions with the main workspace area and the panel showing your name, email and organisation masked in your browser. It receives a hashed user ID and your organisation’s name

Mixpanel data is copied into our analytics warehouse in India and combined with account records for internal reporting. To object to this processing, write to privacy@earthsync.io.

We send email through Customer.io, in its EU region. Platform users receive service emails (sign-in codes, invitations, password resets, notifications and invoices), and in the newer version of the platform, onboarding and product emails triggered by events such as signing up, joining an organisation or signing in. Customer.io records whether each email is delivered, opened or clicked, and we copy that activity into our analytics warehouse. You can opt out of onboarding and product emails at any time by writing to privacy@earthsync.io; service emails continue while you have an account.

We share personal information with service providers (processors) that act on our instructions under written data-protection terms. The main ones are:

We also use these providers, whose processing locations we will give you on request:

• Google Workspace: email, calendar and documents for our team
• Google and Microsoft sign-in: signing in with your existing account; Google Maps for choosing site locations
• Temporal Technologies (Temporal Cloud): running long platform jobs such as simulations
• Slack: internal notifications to our team, including new enquiries
• Apollo.io: business-contact information for sales and relationship management
• LiveKit and ElevenLabs: voice features of our internal assistant

We may also disclose information to professional advisers; where the law requires it or to respond to lawful requests; to protect our rights, users or the public; or to a buyer or successor if EarthSync is involved in a merger, acquisition or sale of assets, who must then protect it as this policy describes.

We log errors and requests to keep our services working and secure, on the basis of our legitimate interests. This does not depend on the cookie banner.

• Website errors go to Google Cloud Error Reporting with the error message, technical trace and page path. No identifiers are included and query strings are removed
• Our hosting, firewall and rate-limiting systems record IP addresses and request details to block abuse
• In the newer version of the platform, browser errors sent to Google Cloud include your user ID
• In the platform most customers use today, server errors go to Rollbar and browser errors go to Sentry. Sentry session replays mask all text
• Contact-form submissions are not sent to error tracking, and names, email addresses and messages are removed from error reports

We store personal information in India, on Google Cloud (Mumbai). Some processing happens elsewhere:

• United States and other Google Cloud regions: AI processing, AI conversation monitoring (Langfuse), analytics (Mixpanel, Google Analytics, Microsoft Clarity) and error tracking (Rollbar, Sentry)
• European Union: email (Customer.io)

India does not have an adequacy decision from the European Commission or the UK. Where personal information from the European Economic Area or the UK is transferred outside it, we rely on the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Agreement or Addendum, together with our providers’ data processing agreements. You can ask for a copy of the relevant safeguards at privacy@earthsync.io; we may redact commercial terms.

We keep information only as long as we need it for the purpose we collected it for, or as the law requires. Where we cannot yet give a fixed period, we state how we decide.

We protect personal information with technical and organisational measures, including:

• Encryption in transit and encryption at rest by our cloud providers
• On Google Cloud, databases reachable only over private networking. File storage on both clouds is private, and files are served through links that expire after one hour
• Role-based, least-privilege access, and a separate identity for each service instead of stored cloud credentials
• Malware scanning of uploaded CVs before anyone opens them
• Multi-factor authentication and passkeys in the newer version of the platform

We are working towards ISO 27001:2022 certification, a SOC 2 Type 2 report and GDPR compliance; neither certificate nor report has been issued yet. More detail is on our Trust Center. No system is completely secure, so we cannot guarantee absolute security.

Depending on where you live, you have the right to:

• Access the personal information we hold about you and get a copy
• Correct or complete it
• Have it erased
• Restrict or object to how we use it, including for direct marketing and for purposes based on legitimate interests
• Receive the information you gave us in a portable, commonly used format, or have it sent to another organisation
• Withdraw consent at any time, without affecting processing that happened before
• Not be subject to a decision based solely on automated processing that significantly affects you. We do not make such decisions; our AI-assisted ranking of applicants always goes to a person
• Complain to a supervisory authority, such as the data protection authority where you live or work

To exercise a right, write to privacy@earthsync.io. We may ask you to confirm your identity. We aim to respond within 30 days and will respond within one month, as the GDPR requires. For complex or numerous requests we may extend this by up to two further months, and we will tell you why within the first month.

If your request is about content in an organisation’s workspace, we pass it to that organisation, which decides on it, and we help it respond.

Our website and services are for businesses and professionals and are not directed at anyone under 18. We do not knowingly collect personal information from children. If you believe a child has given us personal information, contact us and we will delete it.

EarthSync Technologies Private Limited, at the address above, is the controller of your personal information, except for workspace content we process for a customer. We have no establishment in the European Economic Area, and we have not appointed a representative in the EEA or the UK under Article 27 of the GDPR or UK GDPR; if we do, we will name it here. Mehul Kumar, Founder, is responsible for data protection at EarthSync and can be reached at privacy@earthsync.io. You can also complain to your local data protection authority, or in the UK to the Information Commissioner’s Office.

Under the Digital Personal Data Protection Act 2023 and its Rules, EarthSync is a Data Fiduciary and you are a Data Principal. As those provisions come into force, you can:

• Get a summary of your personal data and how we process it, and the identities of those we share it with
• Correct, complete, update or erase it
• Withdraw consent as easily as you gave it
• Nominate another person to exercise your rights if you die or become unable to
• Have your grievances redressed by us, and then complain to the Data Protection Board of India

Our grievance officer is Mehul Kumar, Founder (contact details below). We aim to resolve grievances within 30 days and will always respond within the period the law allows: currently one month under the Information Technology (SPDI) Rules 2011, and no more than 90 days under the DPDP Rules.

We update this policy when our practices, providers or legal obligations change. We change the “Last updated” date at the top of this page each time, and for material changes we give additional notice, for example by email to platform users.

For questions, requests or complaints about this policy or your personal information: