Privacy Policy

1. Who we are

Claude Automation is an AI automation consultancy operated by Mindarora LLP, a limited liability partnership registered in India and headquartered in Bangalore, Karnataka, India (“Mindarora”, “we”, “us” or “our”).

For personal data we collect through this website and in running our business, we are the data fiduciary under India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the controller under the EU and UK General Data Protection Regulation (“GDPR”). When we process personal data inside a client’s systems while delivering a project, we act as a data processor on that client’s instructions — see section 6.

2. Scope of this policy

This policy applies to personal data we process when you:

• visit www.claude-automation.com or any page that links to this policy;
• email us, book a call or request a free automation audit;
• become a client, a contact at a client, a supplier or a business partner; or
• apply to work with us.

It does not cover third-party websites or services we link to, which have their own privacy policies.

3. Personal data we collect

Information you give us

• Contact details — name, work email, phone number, company, job title and country.
• Enquiry and engagement details — what you tell us about your business, processes, tools and goals in emails, calls, audits, workshops and project documents.
• Commercial and billing details — billing contacts, addresses, GST or tax identifiers and payment records. We do not store full card numbers.
• Recruitment details — CVs, portfolios and interview notes if you apply to work with us.

Information collected automatically

• Technical data — IP address, browser and device type, pages requested, referring URL and timestamps, recorded in standard server and security logs by our hosting provider.
• Analytics and cookies — we use Google Analytics, provided by Google (for visitors in the European Union, only with consent), to understand how visitors use this website (for example, pages viewed, time on page, approximate location derived from IP address, device and browser type, and how you arrived at the site). Google Analytics sets first-party cookies (such as _ga and _ga_*) that typically last up to 2 years. We use this information in aggregate to improve the website; we do not use it to identify you personally or for advertising.
• Your choices — if you visit from the European Union, Google Analytics loads only after you select “Accept analytics” in our cookie banner; if you decline, no analytics cookies are set. For visitors elsewhere, Google Analytics is enabled by default. Wherever you are, you can accept or decline analytics at any time using the “Cookie settings” link in the website footer, which also removes existing analytics cookies if you decline. To decide whether to show the banner, we use the country provided by our hosting network or, if that is unavailable, your browser’s time zone. We keep only whether you are in the EU, in a cookie that expires after one day, and do not store your location. You can also block or delete cookies in your browser settings, or opt out of Google Analytics across websites with the Google Analytics opt-out browser add-on. Google’s use of this data is described in How Google uses information from sites that use its services. This website does not use advertising or cross-site tracking cookies.

Information from other sources

We may receive business contact details from referrals, events, public professional profiles and company websites, and from your colleagues when they introduce you to us.

We do not intentionally collect sensitive or special-category data (such as health, biometric, religious or financial account data) through this website. Please do not send it to us unless we have agreed a secure way to receive it as part of a project.

4. How we use personal data

• to respond to enquiries, schedule calls and deliver free automation audits;
• to prepare proposals, enter into and perform contracts with clients and suppliers;
• to design, build, test, deploy, monitor and support AI workflows for clients;
• to invoice, collect payments, keep accounts and meet tax obligations;
• to keep this website and our systems secure, and to detect and prevent fraud or abuse;
• to send occasional updates about our services to business contacts, which you can opt out of at any time;
• to assess job applications; and
• to comply with law, respond to lawful requests and establish or defend legal claims.

We do not sell personal data, and we do not use it for automated decisions that produce legal or similarly significant effects on you.

5. Legal bases for processing

Under the DPDP Act, we process personal data on the basis of your consent, which you may withdraw at any time, or for legitimate uses the Act permits — such as where you voluntarily provide data for a specified purpose and have not objected, or where processing is needed to comply with law.

Under the GDPR, we rely on: performance of a contract or steps before entering one; our legitimate interests in running and growing a business-to-business consultancy, balanced against your rights; compliance with legal obligations; and consent, where required (for example, for non-essential cookies or certain marketing).

6. Client data and AI processing

Our work involves connecting AI models — principally Claude, provided by Anthropic — to client systems such as email, CRM, ERP and document stores. When we do this:

• the client remains the data fiduciary or controller of its data, and we process it only on the client’s documented instructions under our engagement agreement and, where required, a data processing agreement;
• we apply least-privilege access, use client-approved environments and credentials, and log the actions our workflows take;
• we select AI and infrastructure providers whose commercial terms restrict the use of client data for training their models, and we configure deployments accordingly;
• we design workflows so that people review and approve consequential actions, and we do not use one client’s data to build work for another; and
• at the end of an engagement we return or delete client data in line with the agreement, unless the law requires us to keep it.

If you are an individual whose data is held by one of our clients, please contact that client first; we will assist them in responding to your request.

7. Who we share personal data with

We share personal data only as needed for the purposes above, with:

• Service providers who act on our behalf — website hosting, web analytics (Google Analytics), email and productivity tools, cloud infrastructure, AI model providers, accounting and payment services — under contracts that require them to protect it;
• Systems you direct us to use — for example, your CRM or messaging tools when we build an integration for you;
• Professional advisers such as lawyers, auditors and insurers, under confidentiality;
• Authorities where we are required by law, court order or a lawful request, or need to protect our rights, our clients or others; and
• A successor business if Mindarora is involved in a merger, acquisition or restructuring, subject to this policy.

8. International transfers

We are based in India, and some of our service providers — including AI model and cloud providers — process data in other countries, such as the United States and the European Union. We transfer personal data only to countries not restricted by the Government of India under the DPDP Act and, for data subject to the GDPR, we rely on adequacy decisions or appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

9. How long we keep personal data

We keep personal data only for as long as we need it for the purpose it was collected, for example:

• enquiries that do not lead to an engagement — up to 24 months after our last contact;
• client contracts, invoices and accounting records — for the period required by Indian tax and company law, typically 8 years;
• client project data — for the term of the engagement, then returned or deleted as agreed;
• server and security logs — generally no longer than 12 months;
• Google Analytics event data — for the retention period set in our Google Analytics account, no longer than 14 months, after which Google deletes it automatically; and
• unsuccessful job applications — up to 12 months, unless you ask us to delete them sooner.

When data is no longer needed, we delete or anonymise it securely.

10. How we protect personal data

We use reasonable security safeguards appropriate to the nature of the data, including encryption in transit, access controls based on least privilege, multi-factor authentication on business systems, segregated client environments, logging of automated actions, and confidentiality obligations for our team and contractors. No system is perfectly secure; if a personal data breach occurs, we will notify affected people and the relevant authorities, including the Data Protection Board of India, as the law requires.

11. Your rights

Depending on where you live, you may have the right to:

• obtain a summary of the personal data we hold about you and how we process it;
• have inaccurate or incomplete data corrected and kept up to date;
• have your data erased when it is no longer needed or you withdraw consent;
• withdraw consent at any time, without affecting processing done before you withdrew it;
• object to or restrict certain processing, including direct marketing;
• receive your data in a portable format (under the GDPR);
• nominate another person to exercise your rights in the event of your death or incapacity (under the DPDP Act); and
• have your grievances addressed, and complain to a data protection authority.

To exercise any of these rights, email support@mindarora.com. We may need to verify your identity before acting on a request, and we will respond within the time limits set by applicable law. If you are not satisfied with our response, you may complain to the Data Protection Board of India or, if you are in the EU or UK, your local supervisory authority.

12. Children

Our website and services are intended for businesses and are not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, please contact us and we will delete it.

13. Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top shows when it was last changed. If we make material changes, we will take reasonable steps to let you know, for example by a notice on this website or by email to clients.

14. Contact and Grievance Officer

For questions about this policy, to exercise your rights, or to raise a grievance about how we handle personal data, contact our Grievance Officer:

Please also read our Terms and Conditions.