Privacy Policy

This Privacy Policy explains how SURONEX CLOUDSAFE PRIVATE LIMITED and its subsidiaries and affiliates ("Suronex", "we", "us") collect, use, share, store and protect personal data when you visit suronex.ai (including our ad landing pages under suronex.ai/lp), send us an enquiry, book a meeting, or use our cloud security platform.

We are the data fiduciary (controller) for the personal data described here. We do not sell personal data.

A. What you give us through a form or a booking:

• Your name, work email address, company and, if you choose to give it, your phone number.
• Anything you write in a message field, and the answers to optional questions (for example your role or company size).
• Your consent choices: that you agreed to us processing your request, whether you ticked the optional box allowing us to share a hashed email with LinkedIn, and the version of the wording you saw.
• If you book a meeting, the time you pick and the details you enter in HubSpot's scheduler.

B. Platform usage information (customers of the Suronex platform):

• Login and logout timestamps and session duration.
• Features and pages accessed within the platform.
• Cloud accounts connected (AWS, Azure, Google Cloud, etc.), the number and types of resources discovered, security configurations and scan results.
• IP addresses and device information.

C. What the website collects automatically:

• With every submission: the page you sent it from, your browser's user-agent string, and a keyed one-way hash of your IP address (used to stop automated spam; we do not store the IP address itself with your enquiry).
• How you reached us: the campaign tags in the link you followed (utm_source, utm_medium, utm_campaign, utm_content, utm_term), an ad click ID if the link carried one (for example LinkedIn's li_fat_id), the website that referred you and the first page you landed on. We keep the first and the most recent of these.
• Analytics: pages viewed, clicks on links and buttons, approximate location (country and city, estimated from your IP address by our analytics provider), device and browser type, and page performance measurements.
• If you accept cookies: session recordings (see section 4) and an analytics visitor ID stored in a cookie.

• To answer your enquiry, arrange a demo or assessment, and follow up with you about it.
• To run and improve the platform for customers, and to keep it secure.
• To understand which pages, campaigns and ads bring people to us and which work, so we spend our advertising budget sensibly.
• To find and fix layout and usability problems, especially on mobile.
• To protect the site and our forms from spam, fraud and abuse.
• To comply with law.

We do not make decisions about you based solely on automated processing.

When you first visit, a banner lets you Accept or Reject analytics and advertising cookies. You can change your choice at any time with Cookie settings at the foot of every page. Every cookie is listed in our Cookie Policy.

• Before you choose, after you Reject, or if your browser sends a Global Privacy Control signal (even if you accepted earlier, unless you chose Accept in Cookie settings while the signal was on): our analytics provider PostHog may still count page views and clicks, with nothing stored on your device (a random ID held in the page's memory, discarded when you leave or reload). No advertising tag loads and no session is recorded.
• After you Accept: PostHog stores a visitor ID in a cookie and may record sessions (how a page was scrolled and clicked) with every form input masked, so what you type is not captured. We store which campaign brought you here in our own cookie for 90 days. The LinkedIn Insight Tag loads, so LinkedIn can measure our ads and let us show ads to past visitors.
• Optional hashed-email matching: our landing-page form has a separate, unticked box. Only if you tick it, we may send LinkedIn a SHA-256 hash of your email address, with the ad click ID and a submission reference, so LinkedIn can count the enquiry as a result of our ad. LinkedIn matches the hash against its members; it does not receive your email in readable form from us. Not ticking it has no effect on how we handle your enquiry. If you then book a meeting with us within 90 days of that enquiry, we may send LinkedIn the same kind of hashed signal for the booking, relying on the consent you gave when you submitted the form.

Suronex staff visits are flagged and excluded from advertising measurement.

• Your consent: for processing your enquiry when you tick the required box, for analytics and advertising cookies when you Accept, and for hashed-email matching when you tick the optional box. You can withdraw any of these at any time, as easily as you gave it.
• Legitimate uses and interests: cookie-free visit counting and spam prevention, so the site works and stays secure.
• Contract: providing the platform to customers.
• Legal obligation: where the law requires us to keep or disclose data.

We share personal data only with the service providers below, each under a contract that limits them to processing it for us (except LinkedIn, see below), and with authorities where the law requires.

• HubSpot, Inc. (United States): our CRM. Receives your enquiry and campaign details, and runs the meeting scheduler.
• PostHog, Inc. (United States): website analytics and, with your consent, session recordings.
• LinkedIn (LinkedIn Ireland Unlimited Company and LinkedIn Corporation): with your consent, receives Insight Tag data from your browser and, only if you ticked the optional box, a hashed email. LinkedIn also uses this data as an independent controller under its own privacy policy.
• Amazon Web Services: hosting of this website and our enquiry database.
• Slack Technologies: an internal alert to our team when an enquiry arrives, containing your enquiry details.
• Our email provider, when we correspond with you.

We do not sell, rent or trade personal data, and we do not share it with data brokers.

Some of these providers process data outside India, mainly in the United States and Ireland. We transfer data only to countries not restricted by the Government of India under the Digital Personal Data Protection Act, 2023, and under contracts that require the provider to protect it.

• Enquiries (our database and HubSpot): up to 3 years after our last contact with you, unless you become a customer or ask us to delete them sooner.
• Analytics events: up to 12 months. Session recordings: up to 30 days.
• Campaign cookie (sx_attr): 90 days. Cookie choice (sx_consent): 180 days.
• Data LinkedIn holds is kept under LinkedIn's own retention policy.
• Platform customer data: for the term of the contract and as the contract specifies afterwards.

When data is no longer needed it is deleted or anonymised.

We implement comprehensive security measures, including:

• Encryption of data in transit and at rest.
• Access controls and multi-factor authentication.
• Regular security assessments and employee training.
• Incident response procedures, including notifying the Data Protection Board of India and affected people of a personal data breach as the law requires.

You can ask us to:

• tell you what personal data we hold about you and who we have shared it with;
• correct, complete or update it;
• erase it;
• withdraw a consent you gave (cookies: use Cookie settings; everything else: email us);
• nominate someone to exercise these rights for you if you die or become unable to.

Email contact@suronex.ai from the address you gave us, saying what you want. We reply within 30 days. To erase an enquiry we delete it from our database and from HubSpot, delete your PostHog person and recordings where we can link them to you, and ask LinkedIn to delete what we sent it; cookies on your device you can clear yourself or by choosing Reject.

Suronex is a data fiduciary under the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. In addition to the rights above, you have the right to grievance redressal.

Grievance Officer: please write to contact@suronex.ai with the subject "Grievance". We acknowledge within 7 days and resolve within 30 days.

If you are not satisfied with our response, you may complain to the Data Protection Board of India.

If you are outside India, you can exercise the same rights by writing to us; we will honour them in line with the law that applies to you.

Our website and services are for businesses and are not directed at anyone under 18. We do not knowingly collect personal data from children; if you believe we have, contact us and we will delete it.

We update this policy when what we collect or who we share it with changes, and change the date above. Significant changes are announced on this site before they take effect.

SURONEX CLOUDSAFE PRIVATE LIMITED, SF, Second Floor, Wadhwa Plaza, Sector-6 Dwarka, New Delhi 110075, India.

• Email: contact@suronex.ai