HomeServicesIndustriesCase StudiesInsightsAbout
Take AI Readiness ScorecardBook Strategy Call →
Draft for Legal Review

This document outlines the privacy-by-design framework and data governance policies of Giri.World. It is subject to periodic review by qualified legal counsel in accordance with applicable laws, including India's Digital Personal Data Protection Act, 2023 (DPDP Act) and international data privacy regulations.

Privacy Notice & Data Governance

Privacy Policy

Version: 2026.1•Effective Date: September 2, 2026•Last Updated: September 2, 2026

1. Who Operates Giri.World & Data Controller

Giri.World is an executive strategic advisory and technology consulting platform operated by Vedhagiri Damodaran (Trading as Giri World / Giri.World). In terms of applicable data protection legislation—including India's Digital Personal Data Protection Act, 2023 (DPDP Act), the European Union General Data Protection Regulation (GDPR), and the UK GDPR—we act as the Data Fiduciary / Data Controller for the personal data collected through this website.

Grievance & Privacy Officer Contact: privacy@giri.world

2. Categories of Personal Data Collected

We collect information only when necessary to deliver requested advisory insights, respond to inquiries, or evaluate business fit:

  • Consultation & Inquiries: Full name, work email address, company name, executive role/designation, company revenue scale, optional phone number, and qualitative business objectives.
  • AI Opportunity Reports & Diagnostic Assessments: Industry classification, annual revenue ranges, employee headcount brackets, operational friction points, current AI adoption tier, 12-month goals, and contact details required to dispatch the custom report.
  • Newsletter & Strategy Memo: Work email address, subscription timestamp, and subscription source.
  • Anonymized Technical Telemetry: Ephemeral session identifier, anonymized IP (used ephemerally for rate-limiting), browser type, referring URL, and pages viewed. We do not correlate anonymous telemetry with personal identity records.

3. Purpose of Processing & Legal Grounds

We do not bundle consent or use vague generalities. Every piece of information is mapped to a specific business purpose:

/contact (Consultation Form)Basis: Legitimate Interest / Pre-contractual steps requested by data principal.
Data: Full Name, Work Email, Company, Role, Revenue Scale, Phone (Optional), Operational Brief
Purpose: Review and respond to executive advisory inquiries, evaluate operational fit, and schedule strategy sessions.
Retention: 12 months for prospective inquiries; deleted or anonymized upon request or engagement conclusion.
/ai-opportunity-report & /ai-readiness-assessmentBasis: Consent for automated diagnostic generation and report delivery.
Data: Industry, Revenue Band, Employee Count, Operational Challenge, AI Maturity, 12-Mo Goal, Name, Work Email, Company, Role
Purpose: Generate personalized diagnostic assessment report, calculate illustrative OpEx savings ranges, and provide 90-day execution roadmap.
Retention: 24 months to support longitudinal operational benchmarking; earlier deletion upon verified request.
Footer & Insights memo formsBasis: Explicit consent (Unchecked by default, revocable anytime).
Data: Email Address, Subscription Timestamp, IP (Ephemeral for Rate-Limiting)
Purpose: Deliver bi-weekly AI Strategy Memo and executive briefings.
Retention: Until explicit unsubscribe, plus minimal suppression record to honor opt-out.
/api/track & Site NavigationBasis: Legitimate Interest (Strictly anonymized, no PII collected).
Data: Anonymous Session ID, Page Path, Country/Region, Referrer, Viewport Dimensions, Time on Page
Purpose: Monitor website performance, optimize route rendering, and understand aggregate content engagement.
Retention: 90 days raw logs; rolling aggregated metrics thereafter.

4. Use of Automated Assessments & Lead Prioritization

When you complete our AI Opportunity Report or diagnostic calculators, our systems automatically evaluate your industry and operational inputs against generalized business benchmarks to generate illustrative OpEx savings and phased roadmap recommendations.

We also utilize objective, non-sensitive lead scoring to prioritize executive response times (e.g. flagging high-intent founder inquiries for same-day calendar routing). We never use sensitive or protected personal attributes (such as age, gender, religion, caste, health, or political beliefs) for scoring or routing decisions.

5. Third-Party Service Providers & Subprocessors

We work only with vetted technology infrastructure providers who maintain enterprise security standards:

  • Resend Inc. (USA / Global): Secure email dispatch for reports, consultation briefs, and autoresponders.
  • Google Cloud Platform (Google Workspace / Sheets): Encrypted spreadsheet synchronization for executive inquiries.
  • Cloudflare Inc. (Global): Edge CDN, DDoS mitigation, and Cloudflare Turnstile for bot-mitigation.
  • Supabase Inc. (AWS Cloud): First-party anonymized analytics event storage.

6. Your Rights Under DPDP Act 2023 & Global Laws

Under India's DPDP Act 2023 and applicable privacy frameworks, you have specific, enforceable rights regarding your personal data:

  • Right to Summary & Access: You can request a copy of all personal data we hold about you.
  • Right to Correction & Updating: You can request correction of outdated, inaccurate, or incomplete information.
  • Right to Erasure / Deletion: You can request that your personal information be permanently deleted from our active databases and CRM systems.
  • Right to Withdraw Consent: You can withdraw consent for marketing or report delivery at any time without affecting prior lawful processing.
  • Right to Nominate: You have the right to nominate another individual to exercise your rights in the event of incapacity.
Submit a Data Rights Request

7. Grievance Redressal Mechanism

If you have questions, concerns, or grievances regarding how your personal information is handled, please contact our designated Grievance Officer:

Designation: Data Privacy & Grievance Officer
Response Standard: Acknowledged within 48 business hours; resolved within statutory DPDP timelines.

8. Children's Privacy

Giri.World is an executive business platform intended solely for business professionals, founders, and organizational leaders. We do not knowingly market to or collect personal information from individuals under the age of 18.

9. Governing Law & Jurisdiction

[GOVERNING LAW TO BE CONFIRMED BY LEGAL COUNSEL - PROPOSED: JURISDICTION OF BENGALURU, INDIA]