Privacy policy

Draft for legal review. Items in [BRACKETS] must be completed or confirmed before publication. This draft was prepared from how the sdlcagents.ai website actually collects data; it is not legal advice.

This policy explains how [LEGAL ENTITY NAME] (“SDLCAgents.ai”, “we”, “us”) collects and uses personal data when you visit sdlcagents.ai, contact us, take the team AI scan, or take our AI Engineering Maturity Assessment.

It does not cover data processed inside the Sage platform on behalf of our clients (for example source code, tickets or prompts). That data is governed by the agreement and Data Processing Agreement signed with each client.

1. Who we are

Data controller / Data Fiduciary: [LEGAL ENTITY NAME], [REGISTERED ADDRESS], India
Contact for privacy questions: [PRIVACY CONTACT EMAIL]
Grievance Officer (India, DPDP Act): [NAME OR ROLE], [EMAIL]

2. What we collect, and why

When	What we collect	Why we use it
You request a call (Contact page or pilot form)	Name, work email, company, team size, the area you want help with, and anything you write in the note	To reply, arrange the call and prepare for it
You take the team AI scan and ask for the report	Your 8 answers and your work email	To send you the report
You take the Maturity Assessment	Your answers (team size, tools, ranges for AI spend and usage, engineering practices)	To calculate your maturity level and generate your report
You unlock the full assessment report	Name, work email, company, role	To show and send your report, and to offer a review call
You email us	Your email address and the content of your message	To respond to you
You browse the site	Pages visited, the referring site, and approximate country, device and browser type, without cookies	To understand how the site is used and improve it

With every form we also record where your visit started (the referring site and any campaign tags in the link) and, where you tick the consent box, the time you consented and which version of this policy applied.

We do not ask for sensitive personal data, and we do not need personal data about anyone other than you. Assessment answers are about your organisation’s engineering practices; please do not include confidential client or personal information in free-text fields.

Consent: when you submit a form and tick the consent box. You can withdraw consent at any time.
Legitimate interests: to run, secure and improve the website and to respond to business enquiries.

For visitors in India, we process personal data on the basis of your consent under the Digital Personal Data Protection Act, 2023, given when you submit a form.

4. How we use assessment data

Until you unlock the report, your answers stay in your browser (local storage) so you can leave and come back. They are sent to us only when you submit the report form.
Your answers are scored using a fixed set of rules to produce your maturity level and report.
If you unlock the report, we link your answers to your contact details so we can discuss the report with you.
We may use assessment answers in aggregated and anonymised form to publish benchmarks. Aggregated data never identifies you or your company.

5. Marketing

We will only send you follow-up emails about your request or report. We will not add you to a newsletter unless you ask to join one, and every marketing email will include an unsubscribe link.

We do not sell personal data. We share it only with service providers that help us run the website and respond to you, under contracts that require them to protect it:

Purpose	Provider
Website hosting and spam protection	Cloudflare (hosting, Turnstile)
Form handling and CRM	[CRM PROVIDER]
Email	[EMAIL PROVIDER]
Website analytics	Plausible Analytics (cookieless)
Scheduling calls	[SCHEDULING PROVIDER]

We may also disclose data if required by law or to protect our legal rights.

7. International transfers

Some of these providers may store data outside India or outside your country. Where this happens, we rely on the provider’s contractual safeguards (such as Standard Contractual Clauses for EU data) and only transfer data to countries permitted under applicable law.

8. How long we keep it

Data	Kept for
Contact requests and related emails	[24 MONTHS] after our last interaction, unless you become a client
Assessment answers linked to contact details	[24 MONTHS], then deleted or anonymised
Anonymous assessment answers (no contact details)	Kept in aggregated form for benchmarks
Analytics data	[ANALYTICS RETENTION]

9. Cookies and analytics

Our analytics are cookieless: they do not set cookies or track you across sites. [CONFIRM: whether Cloudflare Turnstile sets any cookie, and the exact wording for this section.]

10. Your rights

Depending on where you live, you can:

Access the personal data we hold about you
Correct inaccurate or incomplete data
Ask us to delete your data
Withdraw your consent at any time (this doesn’t affect processing already done)
Object to or restrict certain processing (EU/UK)
Receive your data in a portable format (EU/UK)
Nominate another person to exercise your rights in case of death or incapacity (India)
Raise a grievance with our Grievance Officer, and if unresolved, with the Data Protection Board of India or your local data protection authority

To exercise any right, email [PRIVACY CONTACT EMAIL]. We will respond within [30 DAYS].

11. Security

We protect personal data with access controls, encryption in transit, and by limiting access to people who need it. No system is perfectly secure; if a breach affects your personal data, we will notify you and the relevant authorities as required by law.

12. Children

This website is intended for business users. We do not knowingly collect data from anyone under 18.

13. Changes to this policy

We may update this policy. The “Last updated” date shows when it last changed; significant changes will be highlighted on this page.

14. Contact

Questions or requests: [PRIVACY CONTACT EMAIL], [LEGAL ENTITY NAME], [REGISTERED ADDRESS].