Privacy Notice | Everiko

The short version

This is a pre-launch website. It has no payments and no analytics, and it holds no accounts of its own. We collect personal data in exactly three situations:

You write to us. The contact form takes your name, email address and message, and sends them to us as an email so we can reply.
You ask for testing access. The request form on /gateway takes your name, email address and your reason for wanting access, and sends them to us as an email so we can consider it and reply.
Your browser requests a page. Our web server records the request — including your IP address — in its access log, the way every web server does, so that the site can be kept running and protected from abuse.

Signing in at /gateway is a fourth case, and it is the one worth being precise about: that form posts your username and password directly to the Everiko application at its own address. Those credentials never pass through this website, and this website’s server never receives, logs or stores them. See signing in and requesting access.

There are no cookies on this site. There is no analytics, advertising, fingerprinting or session-recording code of any kind. We do not sell or share personal data, and we do not build profiles of visitors. The one thing stored on your device is your light-or-dark theme choice, which never leaves your browser.

The rest of this notice is the detail behind those two paragraphs. If you only want one thing from this page: to have anything we hold about you corrected or deleted, email [email protected] and we will do it.

Who we are

Everiko is a product of RUVEQ Solutions, based in Mangalore, Karnataka, India. For the purposes of this notice RUVEQ Solutions is the Data Fiduciary under India’s Digital Personal Data Protection Act, 2023 (the “DPDP Act”), and the data controller under the EU and UK General Data Protection Regulation (“GDPR”). In plain terms: we are the ones who decide what is collected here and what happens to it, and we are the ones answerable for it.

Questions about personal data — including requests to access, correct or erase it — reach a person, not a ticket queue, at [email protected]. We are not large enough to be required to appoint a Data Protection Officer under GDPR Article 37, and we have not been notified as a Significant Data Fiduciary under the DPDP Act. That address is the contact point either regime would route you to.

What this notice covers

This notice covers this website only — the pages served from this domain, and the contact form on it.

It does not cover the Everiko product. The Everiko application reads facial expressions and voice in order to work. This website does none of that. Nothing on this site asks for, receives or has access to your camera or microphone — including the 3D avatar, which is a model file rendered inside your browser and has no input of any kind. When Everiko becomes available, it will carry its own privacy notice describing how it handles expression, voice and conversation data, and you will be asked to read that before you can use it.

It also stops at /gateway. That page is the door to the Everiko application, which runs at a different address and is a separate system with its own privacy notice. Once you are signed in there, that notice governs, not this one.

The demonstration film on this page is served from our own server. It is not a YouTube, Vimeo or other third-party embed, so watching it does not report anything to a video platform.

The typefaces used here (Inter and Space Grotesk) are bundled into the site at build time and served from this domain. Your browser makes no request to Google Fonts, and Google receives nothing about your visit.

What we collect

Information you choose to give us

If you use the contact form, we receive the name, email address and message you type into it. All three are required for us to be able to reply; none of them is pre-filled or inferred. If you send us anything else inside the message — a phone number, a company name, a link — we receive that too, because you put it there.

The form contains one hidden field that is invisible to people and exists only to catch automated submissions. If it arrives filled in, the submission is discarded without being sent to anyone.

Information collected automatically

Server access logs. The web server in front of this site records, for each request: your IP address, the date and time, the URL requested, the HTTP method and response status, the number of bytes sent, your browser’s user-agent string, and the page you arrived from, if your browser sent one.
A short-lived rate-limit record. When a contact form submission arrives, the server briefly remembers the IP address it came from so that it can refuse more than five submissions from the same address in any sixty seconds. This record is held in memory only, is never written to disk, and disappears once the sixty seconds pass or the server restarts.

An IP address can indicate the city or region a request came from. It is treated here as personal data, because in combination with a timestamp it can in principle identify a person.

What we do not collect

No passwords. This website holds no accounts and stores no credentials. The sign-in form posts to the Everiko application directly — see below.
No payment card or bank details. Nothing on this site is for sale.
No analytics, advertising, conversion-tracking, heatmap, session-replay or device-fingerprinting code. Not configured off, not present.
No facial, voice, biometric or health data, and no precise location.
No personal data bought from, or supplied by, a third party. Everything we hold about you came either from your browser requesting a page or from you typing it into the form.

Signing in and requesting access

Everiko is in private testing. The /gateway page does two separate things, and they are worth separating here because the data goes to different places.

Signing in

If you already have a testing account, the sign-in form takes your username and password and posts them straight to the Everiko application, which runs at its own address. The submission does not go through this website: our server does not receive those credentials, does not log them and has no way to read them. We could not hand them over if we were asked to.

What the application does with them — the session it sets, how long it lasts, what it records — is covered by its own privacy notice, not this one. If sign-in fails, the application sends you back here with a short code in the address bar (for example ?error=invalid) so that we can show you a readable message. That code says only what kind of failure it was. It never contains your username or password.

One thing happens automatically when the page loads: your browser makes a single request to the Everiko application to check that it is answering, so the page can tell you up front if sign-in is unavailable rather than letting you type a password into a form that cannot work. Like any request to any server, it discloses your IP address to that application’s host. It carries nothing else.

Requesting access

If you do not have an account, the request form takes your name, email address and your reason for wanting access so a person can review the request and reply.

Your request goes to two places, both of them ours:

To us as an email, recording the date and time it was made. It travels the same way as a contact form message, through the same provider, under the same rules.
Into the Everiko application’s own admin list, where access requests are queued for review. This is a direct server-to-server hand-off from this website to the application; your browser is not involved and nothing extra about you is added to it. Once there, the request is held by the application and covered by its privacy notice, which lists the providers behind it.

Either delivery is enough for us to have received your request, which is why the form can honestly confirm it even if one of the two is down.

Requests are read by us and used to decide whether to create an account for you. We do not add you to a marketing list, and we do not pass your request to anyone outside RUVEQ Solutions and the Everiko application.

The request form carries the same hidden anti-bot field as the contact form, and is limited to three requests from the same address in any ten minutes. That limit is enforced from an IP address held in memory for those ten minutes and never written to disk.

How we work out which country you are in

Prices on this site follow your country — rupees in India, US dollars elsewhere — so the site has to establish, roughly, where you are. It is worked out from your IP address, which every website you visit necessarily receives, and never from anything you are asked to enter.

We do it in whichever of these ways answers first:

From the request itself. When this site is served through Cloudflare, Cloudflare attaches a two-letter country code to the request before it reaches our server. Nothing leaves your browser for this, and no third party learns anything it did not already know by routing the request.
From the Everiko application. If the country did not arrive with the request, your browser asks the application (the same /api/v1/region described above). It consults DB-IP’s IP-to-country database, which is why the credit appears under the price cards when the answer came from there.
From Cloudflare’s public lookup. Failing that, your browser requests www.cloudflare.com/cdn-cgi/trace, which reports the country for the address the request came from. This does disclose your IP address to Cloudflare, as any request to any server does. It sends no cookies, carries nothing about you beyond the request itself, and we receive only the two-letter country code — not the address, and not anything else the response contains.
From your browser’s time zone. Last, and read on your own device without being sent anywhere.

If none of them answers, the site shows India. Your country is not something you can change on this site — there is no switch and no menu — because the prices you are shown have to be the prices you would be charged. We do not store the result, and it is not used for anything except choosing a currency, the English the page is written in, and the date format.

What we store on your device

This site sets no cookies. Not essential ones, not analytics ones, not any. That is why you are not being asked to dismiss a cookie banner.

One item is written to your browser’s local storage: a key named theme, holding the value dark or light. It exists so the site opens in the appearance you last chose instead of resetting on every visit. It contains no identifier, it is never transmitted to us or anyone else, and clearing your browser’s site data removes it. You can refuse it by blocking storage for this site; the only consequence is that the site will open in dark mode each time.

Why we use it, and our legal basis

We only use what is listed above for the purposes listed below. We do not repurpose it later for something else.

Purpose	Data used	Basis under GDPR	Basis under the DPDP Act
Reading your enquiry and replying to it	Name, email address, message	Consent — Art. 6(1)(a)	Consent — s.6
Serving the pages you request, and keeping the site available, correct and free of abuse	IP address, user-agent, request logs	Legitimate interests — Art. 6(1)(f)	Voluntary provision for the purpose requested — s.7(a)
Considering your request for testing access and replying to it	Name, email address, reason, time of request	Consent — Art. 6(1)(a)	Consent — s.6
Telling you whether sign-in is available before you try it	Your IP address, disclosed to the application’s host by the request itself	Legitimate interests — Art. 6(1)(f)	Voluntary provision for the purpose requested — s.7(a)
Refusing floods of automated form submissions	IP address, held for 60 seconds in memory	Legitimate interests — Art. 6(1)(f)	Voluntary provision for the purpose requested — s.7(a)
Remembering your light or dark appearance choice	A theme value stored on your device; we never receive it	Not personal data in our hands	Not personal data in our hands

Where we rely on legitimate interests, the interest is keeping a public website up and not letting it be abused. We have weighed that against your privacy and concluded it is proportionate because the data is minimal, is not combined with anything else, is not used to profile or target anyone, and is deleted on a short schedule. If you disagree in your particular case, you can object — see your rights.

Where we rely on consent, you give it by choosing to send the form, and you can withdraw it at any time by emailing us. We do not use a third-party Consent Manager as defined under the DPDP Act.

Your enquiry reaches us and the two service providers that make it possible to reach us. Nobody else.

Resend (Resend, Inc., United States) delivers both the contact form and the testing-access request as email. It therefore processes your name, email address and the content of what you wrote. Resend acts as a processor on our instructions and may not use your data for its own purposes. See Resend’s privacy policy.
Our hosting provider operates the server this site runs on and therefore holds the server access logs described above.
Our email provider holds the message once it has been delivered to our mailbox, in the same way any email provider holds mail sent to an address it hosts.
The Everiko application receives two things. Your username and password if you sign in at /gateway — but those come from your browser, not from us. And your testing-access request, which this website forwards to it server-to-server so it can be queued for review. It is our own system, not a third party, but it is a separate one with its own storage and its own privacy notice.

We do not sell personal data, and we do not share it for advertising or any other cross-context behavioural purpose. There are no ad networks, data brokers, affiliate trackers or marketing platforms involved in this site. We have never sold or shared personal data, and we are not in a position to, since none of the above collects enough to be worth anything to anyone.

We would disclose personal data to an authority only where we are legally obliged to — a valid order from a court or a body with the power to compel it — or where it is genuinely necessary to establish or defend a legal claim. If that ever happens and we are permitted to tell you, we will.

Where it goes

Resend is based in the United States, so sending the contact form or a testing-access request involves a transfer of your name, email address and what you wrote outside India and outside the European Economic Area.

Under the DPDP Act, transfers abroad are permitted except to a country the Central Government has restricted by notification. No such restriction applies to the United States at the date of this notice.
Under GDPR, this transfer relies on the Standard Contractual Clauses adopted by the European Commission, which form part of Resend’s data processing terms.

Everything else — the pages, the demonstration film, the 3D model, the fonts, the server logs — is served and held on our own infrastructure.

How long we keep it

Your enquiry: for as long as we are dealing with it, and then for up to 24 months after our last exchange, so that we have the context if you write again. After that it is deleted. If you ask us to delete it sooner, we will, unless we are legally required to keep it.
Your testing-access request: while it is open, and then for up to 24 months after we decide, so that we have a record of who asked and what we told them. That covers the emailed copy; the copy queued in the application is kept under its own notice. Ask us and we delete both.
Server access logs: no longer than 90 days, after which they are rotated out and deleted.
The rate-limit records: 60 seconds for the contact form, 10 minutes for the access request. In memory, both.
Your theme preference: on your device until you clear it. We never hold a copy.

There is no database of visitors behind this site. An enquiry is an email in a mailbox, which is why deleting one is something we can actually do rather than something we have to promise to schedule.

How we protect it

Every request is served over HTTPS, so what you type into the form is encrypted in transit.
There is no visitor database to breach — a point worth more than most security claims, because data you never store cannot leak.
Form input is length-limited and escaped before it is placed into an email body, so a submission cannot inject markup or script into our inbox.
Submissions are rate-limited, and automated submissions are discarded.
Access to the mailbox and the server is restricted to the people who need it.

Two honest limits. First, no system is perfectly secure, and we will not claim otherwise. Second, email is not end-to-end encrypted: once your enquiry leaves our server it travels as ordinary mail. Please do not send health information, financial details, government identifiers, passwords or anything else sensitive through this form. If you need to discuss something of that kind, write and ask for a secure channel first.

Your rights

These rights apply to the data described in this notice. Where a right depends on where you are, that is noted.

If you are in India — DPDP Act, 2023

Right to information (s.11): A summary of the personal data we hold about you and what we are doing with it, and the identities of anyone we have shared it with.
Right to correction and erasure (s.12): To have inaccurate or incomplete data corrected, completed or updated, and to have it erased where we no longer need it for the purpose it was collected for.
Right to grievance redressal (s.13): To raise a complaint with us directly and have it dealt with — see grievances and complaints.
Right to nominate (s.14): To nominate another person to exercise these rights on your behalf in the event of your death or incapacity.
Right to withdraw consent (s.6(4)): To withdraw consent as easily as it was given. Withdrawal does not undo processing that already lawfully happened.

The Act also places duties on you as a Data Principal, including not impersonating another person and not filing a false or frivolous grievance. We mention it because the Act does; it is not a condition we have added.

If you are in the EEA, the UK or Switzerland — GDPR

Access (Art. 15): A copy of your personal data and the information in this notice.
Rectification (Art. 16): Correction of anything inaccurate or incomplete.
Erasure (Art. 17): Deletion where we no longer need the data, where you withdraw consent, or where you successfully object.
Restriction (Art. 18): To have us pause using the data while a dispute about it is resolved.
Portability (Art. 20): Your enquiry in a machine-readable form. In practice this is a text file.
Objection (Art. 21): To object to processing we base on legitimate interests. We do no direct marketing, so there is nothing to opt out of there.
Withdrawal of consent (Art. 7(3)): At any time, by email.
Complaint (Art. 77): To lodge a complaint with your national supervisory authority — see below.

If you are in California — CCPA/CPRA

In the last twelve months the only categories of personal information we have collected are identifiers (name, email address, IP address) and internet activity (the server log of pages requested), collected directly from you for the purposes in the table above. We have not collected sensitive personal information, and we have not used personal information to infer characteristics about anyone.

We have not sold or shared personal information, and we do not. There is therefore no “Do Not Sell or Share” action to take. You may still exercise your rights to know, delete and correct, and we will not discriminate against you for doing so. We offer no financial incentives for personal information.

How to exercise them

Email [email protected] and say what you want. There is no form to fill in and no fee.

What to include: usually just send the request from the email address you originally wrote from — that is how we find your data. If you write from a different address we may ask for something that lets us match the request to the record, so that we are not handing your enquiry to someone else. We will not ask for an identity document.
How quickly: within 30 days. If a request is genuinely complex we will tell you inside those 30 days and explain the delay, which is the one-month-plus-two position under GDPR Art. 12(3).
If we refuse: we will say so, say why, and tell you how to complain.

Grievances and complaints

Please raise it with us first — we can usually fix things faster than any regulator can. Write to [email protected] with “Grievance” in the subject line and it will be routed to the person responsible for data protection. We acknowledge grievances within 7 days and aim to resolve them within 30 days.

If you are not satisfied with our answer:

India: you may complain to the Data Protection Board of India, constituted under the DPDP Act, once you have exhausted the grievance process above — which the Act requires you to do first.
EEA: you may complain to the supervisory authority of the country where you live, work, or where the issue arose. The European Data Protection Board lists them all.
UK: you may complain to the Information Commissioner’s Office.

Complaining to a regulator does not require our permission and does not affect any other remedy you have.

Children

Under the DPDP Act a child is anyone under 18. This website is aimed at businesses, partners, investors and professionals; it is not directed at children, and we do not knowingly collect personal data from one. We have no way to verify age at the point of a contact form submission, which is precisely why we ask that people under 18 do not use the form without a parent or guardian.

Section 9(3) of the Act prohibits tracking, behavioural monitoring and targeted advertising directed at children. We do none of those things to anyone, so there is nothing to carve out here.

If you believe a child has sent us personal data, email [email protected] and we will delete it.

Automated decisions

We do not make automated decisions about you, and we do not profile you. Nothing on this website scores, ranks, segments or categorises visitors. The only automated judgement anywhere in it is the rate limiter refusing a sixth form submission in a minute, and the hidden field discarding obvious bot traffic — neither of which produces a legal or similarly significant effect on anyone, and both of which you can get around by emailing us directly.

The artificial intelligence this site describes is the Everiko product. It is not applied to visitors of this website.

Links to other sites

This site links out to ruveqsolutions.com, to the Ministry of Electronics and Information Technology, the MeitY Startup Hub, Sahyadri College of Engineering & Management, and to LinkedIn and GitHub profiles, and to the Everiko application itself from /gateway and /app. Following any of those links takes you to a site we do not control, with its own privacy practices and its own cookies. This notice stops at the edge of this domain. Outbound links open with rel="noopener noreferrer", which means the destination is not told which page you came from.

Changes to this notice

When this notice changes we update the “last updated” date at the top. If a change is material — a new purpose, a new recipient, a new category of data — we will say so prominently on this page for at least 30 days before or after it takes effect, whichever protects you better.

We will not start using personal data we already hold for a materially different purpose without asking you first.

Contact us

RUVEQ Solutions
Mangalore, Karnataka, India
[email protected]

See also our Terms & Conditions, which govern your use of this website.

This notice is provided in English. If we publish a translation and the two disagree, the English version is the one that applies.