Privacy Policy

Innov8Alpha ('we', 'us', 'our') is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and protect personal information when you visit innov8alpha.com, use our SaaS products (RestroOS, HealthDesk, EduCore), or engage us for services (Web Development, Brand Innovation, Growth Audit, Alpha Automate).

This policy applies to all users, visitors, clients, and subscribers across all Innov8alpha platforms and services.

We collect information across three categories:

• Information you provide directly: name, email address, phone number, business details, billing information, and any data shared during service engagements.
• Information collected automatically: IP address, browser type and version, device information, operating system, pages visited, time spent on pages, referring URLs, and click patterns — collected via cookies and analytics tools.
• Payment information: processed securely through Razorpay (India) or Wise (International). Innov8alpha does not store raw credit card numbers, CVVs, or bank account details on its servers.

We use your information for the following purposes:

• Delivering and managing requested services and SaaS subscriptions
• Processing payments, issuing invoices, and managing billing cycles
• Communicating about your engagement, project updates, and account status
• Providing customer support and responding to inquiries
• Improving our website, products, and service delivery based on usage patterns
• Sending transactional emails (order confirmations, receipts, password resets)
• Sending marketing communications (newsletters, product updates) — only with your opt-in consent
• Complying with legal obligations, tax regulations, and audit requirements

We use cookies and similar technologies to understand how visitors interact with our website. Specific tools include:

• Google Analytics 4 (GA4) — anonymized traffic analytics, user flow analysis, and conversion tracking
• Hotjar — session recordings, heatmaps, and user behavior analysis (anonymized)
• Web3Forms — contact form submission processing
• Razorpay — payment processing and transaction security

You can manage cookie preferences through your browser settings. Disabling cookies may affect certain website functionality. See our Cookie Policy for detailed opt-out instructions.

Innov8alpha does not sell, rent, or trade your personal information to third parties for marketing purposes.

We share information only in the following circumstances:

• With service providers necessary to operate our business (Razorpay, Wise, AWS, Google Analytics, Hotjar, Web3Forms, WhatsApp Business API) — under strict confidentiality agreements
• When required by law, court order, or government regulation
• To protect the rights, property, or safety of Innov8alpha, our clients, or the public
• With your explicit, documented consent
• In anonymized, aggregated form for benchmarking, research, or case studies — with no personally identifiable information

Data processed through our SaaS products (RestroOS, HealthDesk, EduCore) is governed by the respective product Terms of Service and Data Processing Agreements. Key principles:

• The client is the data controller; Innov8alpha is the data processor
• Product data is stored on AWS India servers (Mumbai region)
• Innov8alpha does not access product data except for technical support (when authorized) and system maintenance
• Product data is never used for marketing, advertising, or shared with other clients
• HealthDesk patient data receives enhanced protections including encryption, RBAC, and audit logging

We implement robust technical and organizational measures to protect your data:

• HTTPS (TLS 1.3) encryption for all data in transit
• AES-256 encryption for data at rest
• Role-based access controls (RBAC) limiting internal data access
• Regular security audits and vulnerability assessments
• Automated daily backups with geo-redundant storage
• Secure cloud infrastructure on enterprise-grade AWS servers

No system is 100% secure. In the event of a confirmed data breach, we will notify affected users within 72 hours as required by applicable law and take immediate remediation steps.

We retain personal information only as long as necessary for the purposes described in this policy:

• Active client data: retained for the duration of the engagement or subscription
• Post-engagement data: retained for up to 3 years for legal and tax compliance, then deleted
• Website analytics: anonymized data retained for up to 26 months (GA4 default)
• Marketing subscriber data: retained until you unsubscribe
• SaaS product data: exported and deleted within 30–60 days of subscription termination

You have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate or incomplete data
• Request deletion of your data (subject to legal retention requirements)
• Opt out of marketing communications at any time
• Request data portability in a standard machine-readable format
• Withdraw consent for data processing where consent is the legal basis

To exercise any of these rights, email hello@innov8alpha.com. We respond to all privacy requests within 30 days.

Innov8alpha primarily stores data on servers located in India (AWS Mumbai region). When we engage international service providers (e.g., Wise for international payments), data may be processed in other jurisdictions with equivalent or higher data protection standards.

Our website and services are not directed at individuals under 18 years of age. We do not knowingly collect personal information from minors. EduCore processes student data on behalf of the subscribing Institute, which is responsible for obtaining parental consent.

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. The "Last updated" date reflects the latest version. Material changes will be communicated via email to active clients. Continued use after notice constitutes acceptance.

For privacy inquiries, data requests, or concerns: Email hello@innov8alpha.com. We respond to all privacy-related communications within 30 days.