Privacy Notice
This notice explains how Netras by Assurex (“Netras”, “we”, “us”) processes your personal data when you use Netras.GRC at grc.netras.ai, as required by the Digital Personal Data Protection Act, 2023 (DPDP Act) and the DPDP Rules, 2025. Netras is the Data Fiduciary for this processing.
1. Using the site without giving us any personal data
You can run assessments, use checklists and read the framework guides without an account and without telling us who you are. Your assessment answers and checklist ticks are processed only in your browser and are never sent to us.
2. Personal data we collect, and why
We collect the following personal data only when you choose to give it:
| Personal data | When | Purpose |
|---|---|---|
| Full name, official email address and company name | When you download a template or report, or run a website scan | To send a one-time code that verifies your email address, and to provide the download or scan you asked for |
| Your name, email address and company name (the same details) | Only if you tick the optional follow-up box | To contact you about your results and our services, and to send occasional compliance updates. This is a separate, optional choice: you can download and scan without it |
| Name, email address, company name, phone number (optional) and your message | When you submit “Request implementation help” | To respond to your request for implementation support |
| The website address you ask us to scan, your confirmation that you own it or are authorised to scan it, and the scan result | When you run a website scan | To perform the scan and show you the report, and to keep a record of who asked for each scan |
| The IP address and browser (user agent) of the device that requests a website scan | When you run a website scan | To prevent and investigate misuse of the scanner (for example, automated or abusive scanning) |
| Which documents you download | When you download | To understand which resources are useful and tailor our follow-up |
| Campaign tags in the link you arrived from (for example utm_source) | With any of the above | To understand how people find us |
| IP address and browser (user agent) information | Whenever you use the site | Processed by our hosting providers to deliver the site securely and to block attacks. Apart from website-scan requests (above), we do not record it, and we never use it to profile you |
We do not use tracking cookies, analytics, advertising pixels or session recording, and we do not sell or rent personal data.
3. Consent, and how to withdraw it
We process the personal data in section 2 on the basis of your consent, which you give by ticking the consent box on the form before you submit it. Being contacted about your results, our services and compliance updates is a separate, optional choice with its own box; we contact you for these purposes only if you tick it.
You can withdraw your consent at any time by emailing assurex@netras.ai with the subject “Withdraw consent”. Withdrawing is as easy as giving consent. We will then stop processing your personal data and erase it, unless the law requires us to keep it. Withdrawal does not affect processing done before it. You can also clear your details from your own browser at any time with “Forget me on this device” under Privacy choices.
4. Browser storage and cookies
The site does not set cookies. With your permission, given through the banner shown on your first visit, it saves your assessment progress, checklist ticks and scan reports in your browser’s local storage so you can return to them. If you choose “Essential only”, this data is kept only until you close the tab. We always store your privacy choice and, once you verify your email, a signed token that lets you download again without another code. You can change your choice at any time under Privacy choices.
5. Who we share personal data with
We share personal data only with the service providers (Data Processors) listed below, and never with anyone for their own purposes. Each processes personal data only to provide its service to us, under its terms of service and data processing terms:
| Processor | What they do for us | Location |
|---|---|---|
| Google (Apps Script, Google Sheets, Gmail) | Receives form submissions, stores leads, scan and help-request records, and relays our emails | United States and other countries where Google operates data centres |
| Google Public DNS | Checks that the domain of the email address you enter can receive email (only the domain part is sent) | Global |
| Hostinger | Hosts the assurex@netras.ai mailbox that sends verification codes and receives our alerts | Global data centres |
| Amazon Web Services (Amazon S3, CloudFront, Lambda, WAF) | Hosts and protects the website, and runs the website scanner | India (Mumbai) and the European Union (Ireland), with worldwide delivery |
Personal data may be processed outside India through these providers. We transfer data only to countries that the Government of India has not restricted under Section 16 of the DPDP Act. We may disclose personal data where the law requires us to, for example to a court or regulator.
5A. Website scans and website owners
Anyone who runs a scan must confirm that they own the website or are authorised by its owner, and must accept the Terms of Use. The detailed report, with evidence, is given only when the scanner’s verified work email belongs to the scanned website’s domain; anyone else sees only a summary score. Every report is stamped with the verified email address of the person who ran it. If you own a website and do not want it scanned, email assurex@netras.ai from an address at that domain and we will add it to our do-not-scan list.
6. How long we keep personal data
- Leads, scan records (including the IP address and browser of the request), download records and help requests: 24 months from when you submitted them, then deleted automatically, or sooner if you withdraw consent or ask us to erase your data.
- Verification codes: stored only as a one-way hash, and deleted after 10 minutes.
- Technical logs of the website scanner: 30 days.
- Scan reports and assessment progress: stored only in your browser, never on our systems.
7. Your rights
Under the DPDP Act you have the right to:
- Access: obtain a summary of the personal data we hold about you, the processing we carry out, and the identities of the processors we have shared it with (Section 11).
- Correction and erasure: have your personal data corrected, completed or updated, and have it erased when it is no longer needed or you withdraw consent (Section 12).
- Grievance redressal: raise a complaint with us and receive a response (Section 13).
- Nominate: nominate another person to exercise your rights if you die or become incapable (Section 14).
To exercise any right, email assurex@netras.ai from the address you gave us. We may ask you to confirm your identity. We will respond within 30 days.
8. Grievance Officer and contact
If you have a question or a grievance about how we process your personal data, contact our Grievance Officer at assurex@netras.ai. We will acknowledge your grievance promptly and resolve it within 90 days.
If you are not satisfied with our response, you may complain to the Data Protection Board of India under the DPDP Act.
9. Children
Netras.GRC is a business tool intended for professionals aged 18 and over. It is not directed at children, and we do not knowingly process the personal data of children under 18. If we learn that we have collected a child’s personal data without verifiable parental consent, we will erase it.
10. How we protect personal data
We use reasonable security safeguards, including encryption of data in transit (HTTPS), strict access controls, a web application firewall, rate limiting, verification codes stored only as salted hashes, a Content Security Policy, and least-privilege cloud permissions.
In the event of a personal data breach, we will notify the Data Protection Board of India and each affected person, as required by Section 8(6) of the DPDP Act and the DPDP Rules, 2025.
11. Changes to this notice
We will update this notice when our processing changes, and change the “Last updated” date above. If a change needs your fresh consent, we will ask for it.