Privacy Policy
We take your privacy seriously. This policy explains exactly how RDSoftechSolution collects, uses, and protects your personal information across our AI services and mobile application development offerings.
Introduction
RDSoftechSolution ("Company", "we", "us", or "our") is a technology firm providing enterprise Artificial Intelligence (AI) services, Generative AI solutions, Autonomous Agent systems, and Mobile Application Development services to clients globally. We are committed to protecting your personal information and your right to privacy.
This Privacy Policy applies to all information collected through our website (rdsoftechsolution.com), our AI-powered platforms, mobile applications we develop, and any related services, sales, marketing, or events. By using our services, you agree to the collection and use of information in accordance with this policy.
We operate in compliance with the European Union General Data Protection Regulation (GDPR), India's Digital Personal Data Protection Act (DPDP), California Consumer Privacy Act (CCPA), and applicable regional data protection laws.
Information We Collect
Information You Provide Directly
- Contact details: full name, email address, phone number, and company name when you fill out inquiry forms or request a consultation.
- Account credentials when registering for client portals or project management dashboards.
- Business requirements, project briefs, and technical specifications shared during service engagements.
- Payment and billing information processed through PCI-DSS compliant third-party payment processors.
- Communications including emails, chat messages, and meeting notes exchanged during service delivery.
Information Collected Automatically
- Log data including IP address, browser type, operating system, referring URLs, and pages visited.
- Device identifiers, session tokens, and usage analytics collected via cookies and similar tracking technologies.
- Performance and error telemetry from AI systems and mobile applications deployed on your behalf.
- Geolocation data (country/region level) for compliance routing and service localisation purposes.
Information From Third Parties
- Business profile data from LinkedIn and professional directories when you engage with our outreach.
- Data from analytics platforms (e.g., Google Analytics) to understand website usage patterns.
- Background verification data for enterprise clients as required by contractual obligations.
AI Services — Data Handling & Model Governance
RDSoftechSolution develops and deploys AI systems including Large Language Models (LLMs), Autonomous Agents, and Generative AI pipelines. The following rules govern how data is handled within our AI service delivery:
Training Data & Model Lineage
- We maintain complete data lineage records for all AI models we train or fine-tune. Data sources are audited for copyright compliance and Terms of Service compatibility before use.
- Raw Personally Identifiable Information (PII) or Restricted client data is never passed directly into model training pipelines. All data is routed through automated masking and anonymization layers.
- Synthetic tokens and cryptographic hashes replace names, addresses, IP addresses, and financial values before any data enters training workflows.
Generative AI Tools & Data Confidentiality
- We use enterprise-managed instances of Generative AI tools where data retention for model training by the tool provider is explicitly deactivated by API contract.
- Client source code, internal strategy documents, and confidential data are never submitted to consumer-facing AI models.
- All AI-generated code undergoes automated Static Application Security Testing (SAST) before integration into any production codebase.
AI Transparency & Bias Mitigation
- High-risk AI models undergo pre-deployment bias testing using statistical divergence analysis to ensure fair output distribution across demographic groups.
- Where required by regulation (including the EU AI Act), models use interpretability layers (SHAP/LIME) to provide human-readable explanations of automated decisions.
- Users interacting with AI-powered interfaces are explicitly notified that they are communicating with an automated AI system, in compliance with EU AI Act Article 50.
- AI-generated content (text, images, audio, video) may carry cryptographic watermarks to ensure origin traceability.
Mobile Application Development — Privacy Standards
When we develop mobile applications for clients or internal use, we enforce strict privacy-by-design standards across the entire software development lifecycle:
On-Device Data Security
- Sensitive data is never stored in plain text on user devices. Applications use hardware-backed secure storage: Apple Secure Enclave via Keychain Services (iOS) and Android Keystore with hardware-isolated cryptographic operations (Android).
- Production builds implement code obfuscation (ProGuard/DexGuard for Android; LLVM-based obfuscation for iOS) to prevent binary reverse engineering.
- Applications detect compromised device environments (jailbroken/rooted devices) and flush cached session data immediately upon detection.
App Store Compliance & Runtime Permissions
- All mobile applications comply with Apple App Privacy Details and Google Play Data Safety section requirements.
- Applications implement runtime permission requests with clear justification for each device capability accessed (camera, location, contacts, etc.).
- Applications remain fully functional for core features even when users deny non-essential permissions.
- APIs serving mobile clients enforce SSL/TLS Certificate Pinning to prevent Man-In-The-Middle (MITM) interception on untrusted networks.
How We Use Your Information
- To provide, operate, and maintain our AI services, mobile applications, and software development engagements.
- To communicate project updates, service notifications, invoices, and support responses.
- To personalise your experience and improve our service offerings based on usage patterns.
- To process transactions and send related billing information.
- To send marketing communications (only with your explicit consent, which may be withdrawn at any time).
- To detect, investigate, and prevent fraudulent transactions, security incidents, and policy violations.
- To comply with legal obligations, regulatory requirements, and respond to lawful government requests.
- To train and improve internal AI models (using only anonymised, non-PII data unless explicit written consent is obtained).
How We Share Your Information
We do not sell, trade, or rent your personal information to third parties. We may share data in the following limited circumstances:
Service Providers & Vendors
- Cloud infrastructure providers (AWS, Google Cloud, Azure) under strict Data Processing Agreements (DPAs) requiring SOC 2 Type II and ISO/IEC 27001:2022 certification.
- Payment processors, analytics providers, and communication platforms — only the minimum data necessary for the specific service function.
- All third-party vendors are risk-tiered. High-risk vendors (with access to confidential data) require independent penetration testing reports and semi-annual security reviews.
Legal & Regulatory Disclosure
- We may disclose personal data when required by applicable law, court order, or government authority.
- In the event of a data breach, affected individuals and relevant data protection authorities will be notified within 72 hours of incident validation, as required by GDPR and applicable regional laws.
Business Transfers
- In the event of a merger, acquisition, or asset sale, personal data may be transferred. You will be notified prior to any transfer and given the option to withdraw consent.
Data Security & Technical Safeguards
We implement enterprise-grade security controls to protect your information against unauthorised access, alteration, disclosure, or destruction:
- AES-256 encryption for all Restricted and Confidential data at rest; TLS 1.3 with Perfect Forward Secrecy (PFS) for all data in transit.
- Zero-Trust Network Architecture with Role-Based Access Control (RBAC) and Just-In-Time (JIT) privilege elevation.
- Hardware-based FIDO2 Multi-Factor Authentication (MFA) for all systems handling sensitive data. SMS-based MFA is not used.
- Automated Security Information and Event Management (SIEM) with 15-minute incident triage SLAs.
- All source code deployments pass through automated SAST, DAST, and Software Composition Analysis (SCA) gates before production release.
- Cryptographic commit signing and container image attestation for all production deployments.
- Immutable Write-Once-Read-Many (WORM) backup storage with a minimum 90-day retention lock, protected against ransomware.
- Annual disaster recovery drills with Recovery Time Objectives (RTO) of under 15 minutes for mission-critical systems.
Your Data Rights
Depending on your location, you may have the following rights regarding your personal data:
Rights Under GDPR (EU/EEA Residents)
- Right of Access — Request a copy of the personal data we hold about you.
- Right to Rectification — Request correction of inaccurate or incomplete personal data.
- Right to Erasure ('Right to be Forgotten') — Request deletion of your personal data. Erasure requests trigger cascading deletions across all production databases, search indexes, and third-party processors within 30 days.
- Right to Data Portability — Receive your data in a structured, machine-readable format.
- Right to Restrict Processing — Request that we limit how we use your data.
- Right to Object — Object to processing based on legitimate interests or for direct marketing.
- Right to withdraw consent at any time, without affecting the lawfulness of prior processing.
Rights Under India DPDP Act
- Right to access a summary of personal data processed and the processing activities undertaken.
- Right to correction and erasure of personal data that is no longer necessary for its original purpose.
- Right to nominate a representative to exercise data rights on your behalf.
- Right to grieve — lodge a complaint with the Data Protection Board of India (DPBI).
- All consent notices are provided in plain language (SARAL format) in English or any of the 22 scheduled Indian languages upon request.
Rights Under CCPA (California Residents)
- Right to know what personal information is collected, used, disclosed, or sold.
- Right to delete personal information held by us.
- Right to opt-out of the sale of personal information (we do not sell personal information).
- Right to non-discrimination for exercising your privacy rights.
Data Retention & Deletion
We retain personal data only as long as necessary for the purposes stated in this policy or as required by applicable law:
- Client project data is retained for the duration of the contractual engagement plus a maximum of 7 years for legal and audit compliance, after which it is cryptographically shredded.
- Website analytics data is retained for 26 months and then automatically purged.
- Marketing contact data is retained until you withdraw consent, after which it is deleted within 30 days.
- AI model training data is anonymised before use and cannot be traced back to individual users.
- Cryptographic Shredding: Restricted and Confidential data is encrypted with unique Data Encryption Keys (DEKs). Upon deletion, the Key Management Service (KMS) destroys the encryption key, permanently rendering stored data unrecoverable — even from block storage.
- WORM-protected financial and transactional records are retained for the minimum statutory period and cannot be deleted until the immutable clock expires.
International Data Transfers
RDSoftechSolution operates globally. Your data may be processed in countries outside your own. We ensure all cross-border data transfers comply with applicable law:
- EU/EEA personal data transfers are governed by Standard Contractual Clauses (SCCs) approved by the European Commission.
- India DPDP transfers follow government-approved whitelisted corridors and contractual safeguards.
- Where data localisation is legally mandated, we deploy geographically isolated cloud infrastructure to ensure data remains within the required jurisdiction.
- Personal identifiers are cryptographically pseudonymised before any data crosses international boundaries for AI processing workloads.
- We maintain a register of all international transfer mechanisms, available upon request.
Intellectual Property & Client Data Ownership
- All custom business logic, tailored interfaces, and client-specific integrations developed under a signed Statement of Work (SOW) are transferred to the client upon full payment.
- Pre-existing frameworks, reusable AI components, and background IP developed independently of any client contract remain the property of RDSoftechSolution.
- When fine-tuning AI models using client-provided Restricted datasets, the resulting model weights are structurally isolated and never reused for other clients or external workloads.
- Client-provided data used for model training remains the property of the client at all times.
Contact Us & Exercising Your Rights
To exercise any of your data rights, report a privacy concern, or request information about how your data is used, please contact our Data Protection Officer:
// Data Protection Officer
Company
RDSoftechSolution
DPO Contact
Data Protection Officer, RDSoftechSolution
Office
India
We will respond to all verified requests within 30 days.
// Policy Governance
This Privacy Policy is reviewed quarterly by the RDSoftechSolution Legal, Security, and Engineering Compliance Committee to maintain alignment with evolving international standards. Material changes will be communicated via email or a prominent notice on our website at least 30 days prior to taking effect.