Privacy Policy

1. Introduction

Innovera Limited (“we,” “our,” or “us”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website and use our services. By accessing or using our service, you agree to the collection and use of information in accordance with this policy.

This policy covers our website (inncloud.ai), our assessment portal, our diagnostic tools, and all related services. For details about how we process client data on behalf of clients, see our Data Processing Agreement.

2. Information We Collect

We may collect and process the following types of information:

• Personal Information: Name, email address, phone number, company name, job title, and other contact details you provide when registering, submitting forms, or contacting us.
• Business Data: Microsoft 365 tenant data (user lists, license inventories, security scores, MFA status), on-premises infrastructure data (server inventories, SQL editions, patch compliance), and related technical data you submit for assessment.
• Payment Information: Billing details and transaction information when you purchase paid services. We do not store full credit card numbers on our servers.
• Usage Data: Information about how you interact with our website and services, including IP address, browser type, pages visited, and session duration.
• Cookies and Tracking Technologies: We use cookies and similar technologies to track activity on our website. See our Cookie Policy for details.

3. How We Use Your Information

We use the collected data for various purposes:

• To provide, maintain, and deliver our assessment and consulting services
• To generate AI-powered diagnostic reports and recommendations
• To communicate with you about your assessment, results, and scheduling
• To process payments and manage billing
• To notify you about changes to our service
• To provide customer support and respond to inquiries
• To gather analysis or valuable information to improve our service
• To monitor the usage of our service and detect fraud
• To comply with legal obligations

4. Artificial Intelligence

We use artificial intelligence (AI) to analyze your data and generate reports, recommendations, and content. When you submit data for assessment, it may be processed by AI models from Anthropic (Claude) and AWS Bedrock. We do not use your data to train AI models. For full details about our AI usage, see our AI Usage Policy.

5. Legal Basis for Processing (GDPR)

For users in the European Economic Area (EEA), we process your personal data under the following legal bases:

• Consent: When you provide consent, such as when you submit forms or accept cookies
• Contract: When processing is necessary to provide services you have requested
• Legitimate Interest: When we have a legitimate business interest that is not overridden by your rights
• Legal Obligation: When processing is required to comply with applicable laws

6. Data Sharing and Disclosure

We may share your information with:

• Service providers: AWS (cloud infrastructure), Anthropic (AI processing), Resend (email delivery), Google (analytics), LinkedIn (marketing) — see our DPA for the full sub-processor list
• Legal authorities: When required by law, court order, or government regulation
• Business transfers: In connection with a merger, acquisition, or asset sale

We do not sell your personal data to third parties. We do not share your personal information for advertising purposes without your consent.

7. Your Privacy Rights

7.1 General Rights

Depending on your location, you may have the following rights:

• Right to access: Request a copy of your personal data
• Right to rectification: Request correction of inaccurate data
• Right to erasure: Request deletion of your personal data
• Right to restrict processing: Request that we limit how we use your data
• Right to data portability: Receive your data in a structured, machine-readable format
• Right to object: Object to certain types of processing
• Right to withdraw consent: Withdraw consent at any time where processing is based on consent

7.2 California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to know: Request disclosure of the categories and specific pieces of personal information we collect
• Right to delete: Request deletion of your personal information
• Right to correct: Request correction of inaccurate personal information
• Right to opt out of sale or sharing: We do not sell your personal information. You may opt out of “sharing” (cross-context behavioral advertising) by disabling marketing cookies in our cookie consent banner.
• Right to non-discrimination: We will not discriminate against you for exercising your privacy rights
• Sensitive personal information: We do not collect or process sensitive personal information as defined by CPRA, except as necessary to provide our services

To exercise your California privacy rights, contact us at privacy@innovera.ai with the subject line “California Privacy Rights Request.” We will verify your identity before processing your request and respond within 45 days.

8. Data Retention

We retain your personal data only as long as necessary to fulfill the purposes outlined in this policy, unless a longer retention period is required by law. Specific retention periods are detailed in our Data Processing Agreement.

9. Data Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized or unlawful processing, accidental loss, destruction, or damage. These measures include:

• Encryption at rest (AES-256) and in transit (TLS 1.2+)
• AWS IAM with least-privilege access controls
• API key authentication and OAuth 2.0 for third-party integrations
• Regular security reviews and access logging

While we strive to protect your personal information, no method of transmission over the internet or electronic storage is 100% secure.

10. International Data Transfers

Your information, including personal data, may be transferred to and maintained on computers located outside of your state, province, country, or other governmental jurisdiction where the data protection laws may differ from those in your jurisdiction. Our infrastructure is hosted in the United States (AWS US East region).

For transfers from the EU/EEA, we rely on Standard Contractual Clauses (SCCs) as adopted by the European Commission. For more information, see our Data Processing Agreement.

11. Children's Privacy

Our services are not directed to individuals under the age of 16. We do not knowingly collect personal information from children under 16. If you believe we have collected information from a child under 16, please contact us and we will promptly delete it.

12. Cookies

We use cookies and similar tracking technologies. For detailed information about the cookies we use and how to manage them, see our Cookie Policy.

13. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the “Last updated” date. You are advised to review this Privacy Policy periodically for any changes.