Scope & Definitions
This policy explains how Convocust AI (“Convocust AI”, “we”, “us”) handles personal data when you visit drootanex.com, contact us, or engage us for consulting and digital engineering services (web, mobile, cloud, data, AI, and security work). We act in two roles:
- Data controller for website visitor data, enquiries, and business-contact data we collect ourselves.
- Data processor for personal data in a Client's systems that we access or handle while delivering a project. We process it on the Client's behalf and under the Client's instructions and our written agreement with them.
Each Client remains responsible for its own privacy notice to its customers and staff, and for having a lawful basis to share that data with Convocust AI. Product conversations processed through Convocust AI are also governed by the applicable customer agreement and product privacy terms.
Swipe sideways to read the full table.
| Term | Meaning |
|---|---|
| Visitor | A person who browses drootanex.com or its product pages. |
| Client | A business or organization that engages Convocust AI for services and is billed for them. |
| Client Data | Any data, including personal data, that a Client provides or gives us access to in order to perform services. |
| Personal Data | Any information that identifies or could identify a Visitor, a Client contact, or an individual whose data is in Client Data. |
| Subprocessor | A third-party service Convocust AI uses to help operate its website or business (listed under How We Share Information). |
Information We Collect
Swipe sideways to read the full table.
| Category | Examples | Collected from |
|---|---|---|
| Enquiry data | Name, email address, phone number, organization name, area of interest (Customer support, bookings, sales and product questions, employee assistant, integrations, or another selected interest), and your message | You, via the contact form on drootanex.com |
| Business relationship data | Client contact details, contracts, invoices, and project correspondence | Clients and prospects |
| Client Data | Datasets, source code, logs, or test data we access while building or supporting a Client's systems | Client systems, under contract |
| Communications data | Emails and messages exchanged with our team | You and our team |
| Technical data | IP address, browser/device type, and request details recorded in the web server's access logs | Automatically, from browser and network requests |
The website does not use analytics, advertising, or tracking tools. We do not intentionally collect sensitive personal data through the website; please do not include it in the contact form.
How We Use Information
- Respond to enquiries — reply to consultation requests, typically within 24 hours, and scope potential engagements.
- Deliver services — perform discovery, strategy, implementation, support, and optimization work, using Client Data only as needed for the engagement.
- Billing & administration — contracts, invoicing, and legal and tax obligations.
- Security & abuse prevention — keep the website working, protect it from spam and misuse, and investigate suspected misuse.
- Product improvement — aggregate, de-identified usage metrics to improve Convocust AI's offerings.
Convocust AI does not use Client Data or enquiry data to train shared or foundation AI models.
How We Share Information
Convocust AI does not sell personal data. Information is shared only with the subprocessors below, each engaged to deliver a specific part of our operations, and, where a Client directs it, with that Client's own systems and providers.
Swipe sideways to read the full table.
| Subprocessor | What it touches |
|---|---|
| MilesWeb (cPanel hosting server) | Hosts drootanex.com; processes IP addresses and web server access logs. |
| EmailJS | Transmits contact-form submissions (name, email, phone, organization, area of interest, message) to Convocust AI's administrator email address. |
Convocust AI does not use any other third-party cloud, backend, analytics, or advertising services for its own operations. Where a project runs in a Client's own cloud environment, that environment is controlled by the Client. We may also disclose information when required by law, to enforce our terms, or to protect the rights, safety, or property of Convocust AI, a Client, or an individual.
Data Retention & Deletion
- Enquiry data and communications are retained for 60 days by default, unless the enquiry becomes a client engagement.
- Client Data is retained only for the duration of the engagement. On completion or termination it is deleted within 60 days, except where retention is required by law or for active billing disputes.
- Contracts and invoices are retained for the period required by applicable tax and accounting law.
- A Client, or an individual, can request deletion of their data at any time; deletion is applied within 60 days, subject to the exceptions above.
- The access audit log (who accessed which Client's data, and when) is append-only and kept for 3 years for security and compliance purposes. It is not deleted on request, since it is Convocust AI's own record of access, not the Client's data.
Security
- Encryption — data is encrypted in transit (TLS) and at rest.
- Access control — every request to Client Data is checked against the requester's authorized identity, and Client Data is accessible only to team members assigned to that Client's project.
- Role-based access — access is scoped by role; passwords are never stored in plaintext.
- Access is logged before it happens — any authorized access by Convocust AI staff to a Client's data writes an audit-log entry (who, which Client, what action) before that access is granted, not after.
- Confidentiality — Convocust AI works under NDA where requested and prefers to work inside Client-controlled environments.
No method of transmission or storage is completely secure, so we cannot guarantee absolute security.
International Data Transfers
Convocust AI is based in Richmond, Virginia, USA, and its engineering team includes members in Kolkata, India. Website data is processed on the MilesWeb server that hosts drootanex.com, and contact-form submissions pass through EmailJS to Convocust AI's administrator mailbox. If you or a Client are located outside the location where data is processed (for example, in the European Economic Area, the UK, or another jurisdiction with cross-border transfer rules), your data may be transferred to and processed there. Where required, Convocust AI relies on appropriate safeguards, such as Standard Contractual Clauses, for such transfers.
Your Privacy Rights
Depending on where they live, Visitors, Client contacts, and individuals whose data is in Client Data may have the right to:
- Access the personal data held about them.
- Correct inaccurate data.
- Delete their data, subject to legal and contractual exceptions (see Data Retention & Deletion).
- Export their data in a portable format.
- Object to or opt out of certain processing.
Visitors and Client contacts can exercise these rights directly by emailing contactus@drootanex.com. Individuals whose data is in Client Data should generally direct their requests to the Client business they dealt with, since Convocust AI processes that data on the Client's behalf and instructions; Convocust AI will support the Client in responding.
Children's Privacy
Convocust AI is a business-to-business service provider. Its website and services are not directed to children, and Convocust AI does not knowingly collect personal data from children (for example, anyone under 13 in the United States, or the relevant age of consent in an individual's jurisdiction) without a lawful basis and appropriate consent. A Client building a product that children may use is responsible for its own compliance with applicable children's privacy law.
Data Breach Notification
If Convocust AI becomes aware of a security incident that compromises the confidentiality, integrity, or availability of Client or Visitor data, it will notify affected Clients without undue delay, and in any case within the timeframe required by applicable law, with what is known about the incident's nature, scope, and the steps being taken.
Changes to This Policy & Contact Information
We may update this policy as Convocust AI's services or legal requirements change. Material changes will be announced to Clients (for example, by email) and on drootanex.com at least 60 days before they take effect. See also our Privacy Policy.
For privacy questions, or to exercise a privacy right described above, contact:
Convocust AI
Richmond, Virginia, USA
contactus@drootanex.com