Privacy Policy

1. Introduction

Welcome to the Exovon Ecosystem ("Exovon", "we", "our", "us"). We respect your privacy and are committed to protecting your personal data. This privacy policy will inform you as to how we look after your personal data when you visit our platforms (including MobCode, Astrolabe, ExamArch, and Exovon Cloud) and tell you about your privacy rights.

2. The Data We Collect About You

We may collect, use, store and transfer different kinds of personal data about you which we have grouped together as follows:

• Identity Data: includes first name, last name, username or similar identifier, and GitHub/Google OAuth profiles.
• Contact Data: includes email address.
• Technical Data: includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform.
• Infrastructure Data: includes code deployments, logs, repository metadata, and server performance metrics generated through Exovon Cloud.

3. How We Use Your Personal Data

We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

• Where we need to perform the contract we are about to enter into or have entered into with you (e.g., providing cloud hosting and IDE services).
• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
• To manage your infrastructure, compile analytics, and optimize the global edge network.

4. AI and Code Processing

As an Agentic Infrastructure Ecosystem, Exovon utilizes Artificial Intelligence to parse, analyze, and assist in writing code. By using our services, you acknowledge that portions of your codebase may be processed by AI agents to provide automated deployment, intelligent code completion, and manifest generation. We do not use your proprietary private code to train foundational public models.

5. Third-Party Data Sharing

We do not sell your personal data. We only share data with trusted third parties necessary to provide our Services:

• Payment Processors: We use Razorpay for secure payment processing. Billing information you provide is sent directly to them over encrypted channels. We do not store full credit card numbers or banking credentials on Exovon servers.
• Infrastructure Providers: Exovon Cloud relies on global data centers (e.g., Google Cloud Platform) to host your deployed applications and edge network traffic.
• Analytics: We use privacy-first analytics to monitor system health and optimize build pipelines.

6. Data Retention & Statutory Archives

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, or to satisfy statutory obligations. Upon account deletion via your Exovon Console settings, all user source code, proprietary datasets, running cloud containers, and environment variables are permanently expunged. However, in compliance with Direction 2(v) issued by CERT-In under Section 70B of the Information Technology Act and Section 8(7) of the Digital Personal Data Protection Act (DPDP Act 2023), basic subscriber onboarding records (subscriber name, verified email, registration IP address, and allocated cloud subdomains) are securely retained in an encrypted, read-only compliance vault for 5 (five) years. Billing records are securely preserved for 7 years per Indian accounting and GST regulations.

7. Cookie Policy

Our platform uses cookies primarily for authentication (Firebase Auth tokens) and maintaining secure sessions across the IDE and dashboard. We do not use third-party tracking cookies for targeted advertising. You can set your browser to refuse all or some browser cookies, but this may cause parts of the Exovon Ecosystem to become inaccessible or function improperly.

8. Your Data Protection Rights — India (DPDP Act, 2023), GDPR & CCPA

Depending on your jurisdiction, you possess statutory rights concerning your personal data. In compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act) of India and global privacy standards:

• Right to Access Information (Section 11, DPDP): You have the right to request a summary of the personal data held by Exovon and details of processing activities.
• Right to Correction and Erasure (Section 12, DPDP): You have the right to correct inaccurate data or request complete erasure of your personal data through the automated account deletion tool or via written request.
• Right of Grievance Redressal (Section 13, DPDP): You have the right to accessible grievance redressal mechanisms with our Resident Grievance Officer, who must acknowledge within 24 hours and resolve inquiries within 15 days.
• Right to Nominate (Section 14, DPDP): You have the right to nominate another individual who shall exercise your rights in the event of death or incapacity.
• Right to Appeal to DPBI: If you are dissatisfied with the resolution of your grievance by our team, you have the statutory right to register a formal complaint with the Data Protection Board of India (DPBI).
• GDPR & CCPA Rights: European and Californian users additionally retain rights to data portability, restriction of processing, and objection to automated decision-making.

9. Data Security & Infrastructure Jurisdiction

We maintain stringent technical, organizational, and physical security safeguards. All client-to-edge communication is protected via TLS 1.3 encryption. Cloud compute containers, build pipelines, and application secrets are hosted within the Google Cloud Mumbai region (asia-south1, India), and edge caching nodes terminate across Indian points of presence. Managed relational databases are powered by Neon and hosted in Singapore (aws-ap-southeast-1) with low-latency Asia-Pacific routing, encrypted at rest via AES-256 and in transit via TLS 1.3 — operating in alignment with the cross-border data transfer provisions of the DPDP Act 2023.

10. Resident Grievance Officer & Redressal Mechanism

In compliance with Section 13 of the Digital Personal Data Protection Act, 2023 and Rule 3(2) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, the designated Resident Grievance Officer details are published below: