Website privacy policy

1. What we collect, and why

Nothing on this site is compulsory. If you do not fill in a form, we collect nothing about you. We use what you give us only for the purpose beside it.

Sent with each form, automatically. The web address of the page, the time, any campaign tags in the link you clicked (utm_source, utm_medium, utm_campaign), and the address of the site that sent you here, if any. We use them only to know which of our own channels a conversation came from.

What we do not collect here. We do not ask for passwords, bank or card details, health information, biometric data, Aadhaar or PAN numbers on this website. Please do not send them to us through a form or email.

Your consent to be contacted. Both enquiry forms have a box you must tick before you can send. It is never ticked for you. It covers only contacting you about your enquiry or request. When you send a form we record that you ticked it, the exact wording you saw, which version of this policy was current, and the time, so that we can show what you agreed to.

Marketing messages: separate and optional. Under that box each form has a second box, also never ticked for you: “Yes, send me product news, offers and updates from Stemzo by email, phone or WhatsApp. I can withdraw this any time.” You can send the form without ticking it and nothing about your enquiry changes. If you tick it, we may send you product news, offers and updates by email, phone call or WhatsApp, using only the details you gave on that form. The same optional box appears when you create a workspace on the sign-up screen, and a workspace’s Founder and administrators can switch it on or off later in My settings, Privacy. We record the answer (yes or no), the exact wording, the time and the version of this policy. We never use for marketing the data a company keeps in the Stemzo app about its employees, or any KYC, payroll or attendance data, we do not buy lists, and we do not give your details to advertisers.

Withdrawing marketing: one click. Send the ready-made email customer@stemzo.ai with the subject “Unsubscribe” (it opens with the subject filled in, so you only press send). Every marketing email and WhatsApp message also says how to stop. We stop within 7 days of getting your message, and sooner when we can. After that we keep only a short note that you opted out (your email or phone and the date), because otherwise we could not keep our promise. Withdrawing marketing does not affect your enquiry, your account or the service you use. Hindi: “Unsubscribe” विषय के साथ ईमेल भेजें; हम 7 दिन में रोक देंगे।

2. Cookies, analytics and similar tools

This website uses Google Analytics 4 to count visits and see which pages help, but only if you press “Accept analytics” on the banner that appears on your first visit. Until then nothing is loaded from Google and no analytics cookie is set. “Accept analytics” and “Decline” are equally easy to press, the banner does not block the page, and the site works the same either way. We run no advertising, social-media or chat tools. This is everything the pages store or load:

Your choice, any time. Use “Cookie settings” in the footer of any page to accept or decline again. Declining, or withdrawing later, stops Google Analytics at once and removes its cookies from this site. What Google already has stays until its 2-month limit ends; if you want it deleted sooner, write to customer@stemzo.ai. We do not combine analytics with your enquiry details: the analytics identifier is never put in a form. The sign-in page at login.stemzo.ai is a separate web app; what it keeps in your browser is listed in the App and workspace privacy policy.

3. Our basis for using your data

For the enquiry forms we rely on your consent, given by ticking the box, for the purpose stated beside the form. For product news and offers we rely on a second, separate consent (the optional box), and for Google Analytics on your consent given by pressing “Accept analytics”. None of these consents depends on another: you can give one and refuse the others. For account sign-in and billing we use your details because you gave them to us to get the service you asked for. Where tax or accounting law requires us to keep a record (for example an invoice), we keep it for that reason. You can withdraw consent at any time (see “Your rights”). Withdrawing does not undo what we did before, and we may decline a service that needs the data. We claim no basis for processing data about children (see section 9).

4. Who receives your data, and where it goes

• Google (Firebase and Google Cloud), Mumbai. Each enquiry is stored in Stemzo’s own database, which Google Cloud hosts for us in Mumbai, India. Google processes this for us as our service provider. Only Stemzo’s founders can open it. They are told by a short alert on their phones that shows only your business name and city; that alert passes through Expo and Google’s push service, which may be outside India. Enquiries made on stemzo.in, which is run by a different business, Gorkha Corporation (trading as Stemzo), are not stored with yours. We do not give access to anyone else.
• Google LLC (Google Analytics), only if you press “Accept analytics”: it receives the analytics data described in section 2 and processes it for us. Nothing is sent to Google Analytics before that.
• Google (Firebase) and Gmail for sign-in: your account details and the sign-in codes we send. Razorpay for payments.
• The full list of companies that process data for Stemzo, with what each one does, is on the sub-processors page.

We do not sell your data and we do not pass it to advertisers. We disclose it to a government agency or a court only when the law or a lawful order requires it, and we do not publish it.

Outside India. Your enquiry itself is stored in India (Mumbai). Some of the other services named here run on servers outside India, including in the United States, and for Google Analytics, Gmail and Expo’s push service we cannot choose the country. We send your data abroad only to the providers named above, for the purposes above, and by ticking the consent box (or, for analytics, pressing “Accept analytics”) you agree to this. As we read the law, Indian law currently permits it, and at the time of writing the Government has restricted no country. We will follow any restriction it notifies. See the sub-processors page for what we know about each service.

5. How long we keep it

• Enquiries: while we are in touch, and up to 24 months after our last contact, then deleted. Each enquiry carries a deletion date 24 months after it arrives and the database deletes it automatically on that date; if we are still in touch with you we may move that date, but never beyond 24 months after our last contact; an enquiry of a paying customer is kept as long as the law requires for the invoices and accounts that include it. If you withdraw consent or ask us to delete, we delete sooner unless the law requires us to keep something.
• Consent record (the wording, version and time): as long as the enquiry.
• Marketing messages: if you ticked the optional box, until you withdraw or up to 24 months after our last contact with you, whichever comes first. After you withdraw we keep only a short opt-out note (your email or phone and the date) so that we never message you again. The clean-up is the same monthly one.
• Google Analytics data (only if you accepted): 2 months, then deleted by Google; only totals remain. Your accept or decline choice stays in your own browser.
• Account and billing details: while the workspace exists, and afterwards as long as the law requires. If you become a customer, the invoices and accounts that include your details are kept for the period the law sets: at least 8 financial years for books of account (Companies Act, 2013), 7 tax years for income-tax books, and the period other tax laws set (up to 72 months from the due date of the annual return) for indirect-tax records.
• Emails and letters to us: as long as needed to answer you and for up to 24 months after we last speak, unless a legal duty requires longer.
• Server and security logs, where Google keeps them for us: at least one year, as the Rules require, then deleted.

6. Your rights, and how to use them

You can ask us to: give you a summary of your personal data, how we use it, and the companies it has been shared with; correct, complete or update it; erase it; withdraw your consent, including to marketing and analytics (one email is enough, as easy as ticking the box: send “Unsubscribe”; for analytics, use “Cookie settings” in the footer); deal with a grievance; and nominate another person to exercise these rights for you if you die or become unable to act (email the nominee’s name and contact details; we record them with your data and act on them when needed).

How to ask. Write to customer@stemzo.ai from the email address you used on the form, or give us the phone number you gave, together with your name. That is the identifier we need; we may ask one question to confirm it is you, so that we do not give your data to someone else. Asking costs nothing. More detail is on the rights page.

How fast. We confirm your request within 2 working days and aim to answer within 15 days. We will answer every request within 90 days, which is the longest the Rules allow. We will resolve a complaint about how we handled your personal data within one month of receiving it. Every reply includes the contact details below.

7. Grievance Officer and Privacy and Grievance Desk

This is the person to ask any question about how we process your data. If you are not satisfied. Please first use the Privacy and Grievance Desk, so that we can try to put things right. If you are still not satisfied, you may complain to the Data Protection Board of India, once it is operating, as the Digital Personal Data Protection Act, 2023 provides; the Board is a digital office and we will not guess its address, so please use the channel the Board publishes, and we will add it to the rights page when it is announced. Nothing in our terms or this policy stops you complaining to the Board or going to a court.

8. Security

What we do for this website, and no more: pages and forms use an encrypted connection (HTTPS) and the site tells browsers to use it every time (HSTS); a content security policy limits what a page may load or send, and only the Google addresses named in section 2 can receive anything; enquiries are kept in a database that no web browser can read and that only Stemzo’s own server code and Stemzo’s founders can open; and Google encrypts data stored on its services by default (we claim nothing beyond what Google provides). We keep written records of what we hold and why, we review the security of the website and these records at least once a year, and we do not keep an enquiry longer than section 5 says. If a data breach affects your personal data, we will tell you without delay, by email or phone, what happened, what it could mean for you, what we have done and what you can do, and we will tell the Data Protection Board of India as the law requires.

9. Children

This website is for businesses. It is not meant for anyone under 18, who is a child in law. We do not knowingly collect personal data of children and we do not claim any lawful ground to process it. If you think a child has sent us their details, write to us and we will delete them within 15 days.

10. Changes to this policy

This is version 3.4, effective 11 October 2026, last reviewed on 11 October 2026. It replaces version 3.3 of 6 October 2026. Version 3.4 changes where an enquiry from the demo form is kept: in Stemzo’s own database in Mumbai, India (hosted on Google Cloud), instead of a Google Sheet written by a Google Apps Script, and it is deleted automatically 24 months after it arrives instead of by a monthly clean-up of that sheet. It also says the founders’ phone alert shows only the business name and city. Nothing else changes. Version 3.3, effective 6 October 2026, replaced version 3.2 of 6 October 2026. Version 3.3 changes only how enquiries are deleted: by an automatic monthly clean-up of the enquiry sheet (version 3.2 described a manual clean-up at least every three months). Version 3.2 replaced version 3.1 of 5 October 2026; its changes were: a separate, optional marketing consent box on the enquiry forms and at sign-up, with a one-click way to withdraw it; Google Analytics, which runs only after you accept on a banner (version 3.1 said the website used no analytics); and the cookie and storage table, retention and sub-processor entries that go with them. Version 3.1 replaced version 3.0 of 5 October 2026 and only added the Corporate Identity Number. Version 3.0 replaced version 2.0 of 4 October 2026 (which replaced version 1 of 12 September 2026) and added the cookie and storage table, how long each kind of data is kept, the Grievance Officer’s details with the one-month response, the rules on children and on transfers abroad, and Stemzo’s company details. If we change this policy we change the version and date here, and if we start collecting anything materially different we will say so on this page and ask for your consent before we do. Earlier versions are available on request. The version you consent to on a form is the one recorded with your enquiry.

11. Company details

Stemzo India Private Limited, Siliguri, West Bengal. Telephone +91-7797100055. Email customer@stemzo.ai. Website stemzo.ai.