Privacy notice

This notice explains how Zpoa Inc., a Delaware corporation ("ZPOA", "we", "us"), processes personal data in connection with the ciyora.com website and the Ciyora Fabric service, including Ciyora Console, Ciyora Client, the Ciyora mobile app and the Ciyora modules. It applies to people in India and in the United States: it is written to meet our obligations under India's Digital Personal Data Protection Act, 2023 (the "DPDP Act") and the rules made under it, and under United States state privacy laws such as the California Consumer Privacy Act as amended ("CCPA").

Our two roles

As a data fiduciary (in US terms, a business). We decide why and how personal data is processed when you visit this website, write to us, ask for a demo, or hold an account with us as a customer contact or billing contact. In India, Ciyora is sold, billed and supported by our India Authorized Partner, Qiaben Healthcare Solutions Pvt Ltd, which handles the contact, account and billing details of Indian customers for those purposes under its agreement with ZPOA.

As a data processor (in US terms, a service provider). When an organization uses Ciyora Fabric, it decides what data about its employees, contractors, devices and systems is processed, and it is the data fiduciary for that data. We process it only on that customer's documented instructions and under our agreement with them. If you are an employee of one of our customers and have a question about data held about you, please contact your employer first; we will help them respond.

What we collect as a data fiduciary

• Contact details you send us, such as your name, work email address, organization and role.
• The content of your messages, demo requests and support requests.
• Account and billing details for customer administrators and billing contacts.
• Technical data needed to serve this website securely, such as IP address, browser type and request time, kept in server logs for a limited period.

This website does not use advertising or analytics cookies. It stores your colour theme in your browser, and a cookie that remembers whether you chose the India or the United States version of the site. We use the country of your IP address, as supplied by our hosting provider, only to show you the right version; we do not store it.

Why we use it

• To answer your enquiry, arrange demos and provide the service you have asked for.
• To manage customer accounts, billing and contractual communications.
• To keep this website and the service secure, and to investigate misuse.
• To meet legal obligations, including tax, accounting and lawful requests from authorities.

We process this data on the basis of your consent, which you give when you contact us, or for the legitimate uses permitted by the DPDP Act, such as providing a service you asked for or complying with law. We do not sell personal data, and we do not use it to train general-purpose AI models.

Where data is stored

Hosted in India · data stays in India. Customer data in the hosted Ciyora Fabric service, for customers in India and in the United States, is stored and processed in India. Data processing follows DPDP Act 2023 obligations. A US data region is planned; until it is available, customers in the United States should note that their customer data is hosted in India. Customers on a self-hosted deployment keep the platform and its data in their own environment. Any demo environment we operate contains only sample data. Some service providers, such as email delivery, may process limited data elsewhere under contracts that require appropriate safeguards.

How long we keep it

We keep enquiry data for as long as needed to respond and follow up, and customer account data for the term of the contract plus the period required by law. Customer data processed in Ciyora Fabric is retained according to the retention settings the customer chooses and is deleted or returned at the end of the contract as agreed with them.

How we protect it

We apply the safeguards described on our security page, including encryption in transit, tenant isolation, role-based access and a tamper-evident audit trail. If a personal data breach occurs, we will notify the Data Protection Board of India and affected people as the DPDP Act requires, and, where we act as a processor, we will inform the customer without undue delay.

Your rights in India (DPDP Act)

Under the DPDP Act you may:

• ask for a summary of the personal data we process about you and how we process it;
• ask us to correct, complete, update or erase your personal data;
• withdraw consent you have given, as easily as you gave it;
• nominate another person to exercise your rights in the event of death or incapacity; and
• have your grievances addressed by us.

If you are not satisfied with our response to a grievance, you may complain to the Data Protection Board of India.

Your rights in the United States

Notice at collection. We collect the categories listed above: identifiers and contact details, commercial information (account and billing records), internet activity (server logs) and the content of your messages, for the purposes listed above and for the retention periods described below. We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not use or disclose sensitive personal information for purposes other than those the law permits.

Depending on the state you live in, including California, you may have the right to:

• know the categories and specific pieces of personal information we hold about you, where it came from, why we use it and whom we disclose it to;
• ask us to delete it, or to correct it if it is inaccurate;
• opt out of the sale or sharing of personal information (we do neither);
• limit the use of sensitive personal information (we use it only as the law permits);
• use an authorised agent to make a request for you; and
• not be treated differently for using these rights.

To make a request, write to [email protected]. We will verify your identity using information we already hold and reply within 45 days, or tell you if we need longer as the law allows. Where we hold your data as a service provider to a customer, we will pass your request to that customer and help them respond.

Grievance officer and contact

For any request or grievance about personal data, write to our grievance officer at [email protected]. Please tell us which right you want to exercise and how we can verify your identity. We aim to acknowledge requests promptly and to resolve them within the period set by the DPDP Act and its rules.

Children

This website and Ciyora Fabric are intended for organizations and their staff. We do not knowingly collect personal data from children.

Changes to this notice

We will update this notice when our practices or the law change, and we will change the date at the top. Where a change materially affects how we use personal data you gave us with consent, we will tell you before it takes effect.