Key Privacy Principles at a Glance
- We never sell your data: We do not broker, rent, or trade your personal details to data brokers or third parties.
- AI Automation Confidentiality: Client workflow information processed via automation pipelines (such as n8n or LLMs) is never used to train public generative AI foundation models.
- Global Standards: We observe the provisions of GDPR (EU & UK), Indian DPDPA 2023, CCPA/CPRA, and UAE/GCC data privacy frameworks.
1. Introduction & Overview
Sarvopaya (“Sarvopaya”, “we”, “us”, or “our”) operates the website https://www.sarvopaya.com and delivers growth marketing, creative media, performance advertising, SEO, website development, and AI workflow automation solutions.
This Privacy Policy describes our practices regarding the collection, use, disclosure, and protection of information that identifies or relates to an individual (“Personal Data”) when you interact with our website, engage our agency services, submit inquiries, or schedule strategy consultations.
Data Controller: Sarvopaya is the data controller responsible for personal information collected via this website. When providing AI automation or marketing execution on behalf of our enterprise clients, Sarvopaya typically acts as a Data Processor under contract, with the client acting as the Data Controller.
2. Information We Collect
We collect information across several interaction touchpoints:
A. Information You Voluntarily Provide
- • Inquiry and Contact Forms: Your name, business email address, phone number, company name, service requirements, and project notes.
- • Meeting Scheduling: Contact information, time zone, and briefing details submitted when scheduling a call via Cal.com or similar appointment tools.
- • Client Onboarding: Billing information, company registration details, VAT/GST numbers, and designated team member contact details.
B. Automatically Collected Technical Data
- • Device & Browser Data: IP address (anonymized where required), browser type and version, language settings, operating system, and screen resolution.
- • Usage Metrics: Pages visited, time spent per page, click paths, referring URLs, and interaction patterns tracked via Google Analytics 4 (GA4).
C. Client Operational & Systems Data
When implementing AI automation (e.g. n8n workflows, CRM synchronization, webhook integrations), clients may provide restricted API access credentials, CRM field mappings, or workflow parameters. All such data is governed by non-disclosure agreements (NDAs) and strict least-privilege access rules.
3. How We Use Your Information
We process personal information for the following specific and legitimate purposes:
- • Responding to Inquiries: Reviewing project requests, preparing proposals, and conducting strategy discovery calls.
- • Delivering Agency Engagements: Planning ad campaigns, configuring web platforms, setting up n8n automations, running SEO audits, and issuing performance reports.
- • Client Communications: Sending service updates, project milestone notifications, billing invoices, and critical administrative notices.
- • Site Performance & Security: Monitoring website health, optimizing Core Web Vitals, preventing malicious traffic, and preventing spam submissions.
- • Regulatory Compliance: Complying with applicable tax, financial accounting, and legal requirements.
4. Legal Grounds for Processing (GDPR & Global Frameworks)
Under the European Union & UK General Data Protection Regulation (GDPR) and similar frameworks, we rely on the following lawful bases:
Consent
When you submit our contact form, accept analytical cookies via our cookie consent banner, or opt into direct marketing communications.
Contractual Necessity
To take steps at your request prior to entering into a contract, or to execute and deliver our agreed services under client contracts.
Legitimate Interests
To run and protect our business, conduct business-to-business communications, and improve our services without overriding your fundamental rights.
Legal Obligation
Where compliance with statutory mandates, tax filings, or court orders requires retention of specific transactional records.
5. AI Automation & Workflow Data Processing
Because Sarvopaya builds advanced AI workflow automation (leveraging n8n, Make, and commercial LLM APIs including OpenAI, Anthropic, and Google Gemini), we uphold explicit AI privacy guarantees:
Zero Training on Client Data
When using commercial foundation model APIs (e.g. OpenAI Enterprise API, Claude API, or Gemini API), data submitted via API is not used to train or fine-tune public models, in strict alignment with provider enterprise terms.
Private, Isolated Environments
Workflows deployed in self-hosted n8n instances run within dedicated, containerized environments. API keys and credentials are encrypted using AES-256 standard encryption at rest.
Data Minimization
We design automated pipelines to pass only the minimum parameters necessary to accomplish the target task (e.g. lead routing or report synthesis), avoiding unnecessary transmission of sensitive personal details.
6. Sub-processors & Third-Party Service Providers
We utilize carefully vetted third-party vendors to support our business operations. Each provider operates under strict confidentiality obligations:
| Provider | Purpose | Jurisdiction |
|---|---|---|
| Brevo (Sendinblue) | Contact form data processing & email communications | EU (France / GDPR-compliant) |
| Google Analytics / GTM | Aggregated site performance and interaction analytics | USA / EU (Google Cloud) |
| Meta Platforms (Pixel) | Campaign measurement and conversion verification | USA / Global |
| Cal.com | Strategy consultation scheduling | USA / EU |
| Cloud Hosting Infrastructure | Secure web serving and application hosting | Global Cloud Providers |
8. International Data Transfers
Sarvopaya is headquartered in Ahmedabad, India, and serves clients across the United States, United Kingdom, United Arab Emirates, Saudi Arabia, Australia, Canada, and Singapore.
When transferring Personal Data outside of your country of residence (such as transferring EEA or UK personal data to India or cloud facilities in the US), we ensure appropriate safeguards are implemented, including:
- • Standard Contractual Clauses (SCCs) approved by the European Commission and UK International Data Transfer Agreements (IDTAs).
- • Encryption of data in transit (TLS 1.3) and at rest (AES-256).
- • Strict confidentiality agreements binding all internal team members and technical contractors.
9. Data Retention & Security Safeguards
We retain personal data only for as long as necessary to fulfill the purposes for which it was gathered, including satisfying legal, accounting, tax, or reporting requirements. General sales inquiry records are typically retained for 24 months from the last contact before scheduled deletion or anonymization.
Our security safeguards include firewalls, role-based access restrictions (RBAC), multi-factor authentication (MFA) across all administrative accounts, periodic security reviews, and strict tokenized API management.
10. Your Privacy Rights
Depending on your jurisdiction (such as the EU, UK, California, India, or Canada), you enjoy specific statutory data rights:
Right of Access
Request confirmation of whether we hold your personal data and obtain a copy.
Right to Rectification
Request correction of inaccurate or incomplete personal records.
Right to Erasure (“Right to be Forgotten”)
Request deletion of your data when retention is no longer justified by law.
Right to Object & Restrict
Object to direct marketing or request temporary restriction of processing.
Data Portability
Receive your data in a structured, commonly used, machine-readable format.
Withdraw Consent
Withdraw previously granted consent at any time without impacting prior lawful processing.
To exercise any of these rights, please email us at jay.sarvopaya@gmail.com. We will respond within 30 days (or within timelines mandated by your local law).
11. Children’s Privacy
Our services and website are intended exclusively for commercial entities and individuals aged 18 and older. We do not knowingly collect personal information from minors. If you believe a child has provided us with personal information, please contact us immediately so we can remove it.
12. Updates to This Policy
We may periodically revise this Privacy Policy to reflect changes in our service offerings, technical architecture, or evolving international legal frameworks. We will update the “Last updated” date at the top of this page upon making any revisions. Continued use of our site following updates indicates acknowledgment of the revised terms.
13. Contact & Grievance Officer
In compliance with the Information Technology Act, 2000, and the Digital Personal Data Protection Act (DPDPA), 2023, the details of our Grievance Officer and Data Protection Contact are provided below:
Grievance & Privacy Officer
Jay Solanki
Founder, Sarvopaya
Telephone
+91-92655-03415Corporate Address
SarvopayaC-1102, PNTC,
Times Of India Press Road, Vejalpur,
Ahmedabad, Gujarat 380015,
India