Privacy Policy & Data Security Architecture

Effective Date: July 27, 2026 | Corporate Entity: Nuvella IT Consulting (Operating Globally as Nuvellasoft) | Primary Domain: https://nuvella.in

1. Governance & Regulatory Framework

Nuvella IT Consulting (“Nuvella,” “Nuvellasoft,” “we,” “us,” or “our”) enforces a zero-trust data governance architecture across all web assets, client portals, and custom SaaS deployments. This Privacy Policy outlines how personal data, technical telemetry, and enterprise requirements are collected, stored, processed, and protected when interacting with nuvella.in or engaging our technology consulting services.

Our data processing protocols strictly align with global statutory mandates:

• India: Digital Personal Data Protection Act (DPDP Act 2023) and Information Technology Rules.
• European Union & United Kingdom: General Data Protection Regulation (EU GDPR / UK GDPR) and the European Union AI Act.
• Middle East (GCC): Saudi Arabia Personal Data Protection Law (PDPL / SDAIA), UAE Federal Decree-Law No. 45 on Personal Data Protection, and ZATCA Phase 2 data residency frameworks.

2. Information We Collect & Process

We collect information required to evaluate, scope, architect, and deploy enterprise digital infrastructure, AI solutions, and specialized software systems.

A. Inbound Inquiries & Direct Lead Telemetry

When you request a technical architecture audit, scope an AI agent build, or submit inquiry forms on nuvella.in, we process:

• Identity & Business Data: Full Name, Corporate Email Address, Direct Phone/WhatsApp Number, Job Title, and Company Name.
• Project Requirements: Architecture specifications, technical constraints, budget parameters, and business logic requirements for custom software or MLOps integrations.

B. Automated Technical & Session Data

To optimize web performance and ensure application security, our servers collect automated endpoint data including IP addresses, geolocation tags, browser user-agents, operating systems, canonical referral paths, page interaction timings, and Core Web Vitals diagnostic logs.

3. Purpose of Processing & Service Operations

Nuvella processes personal and corporate data strictly for legitimate operational purposes across our core functional pillars:

• Enterprise AI Integration & Agentic Automation: Scoping custom LLM agents, multi-agent reasoning loops, AI SDR/BDR outbound pipelines, and MLOps safety guardrails.
• Composable E-Commerce & Web Engineering: Designing headless storefronts (Next.js, Remix), payment gateway integrations (Razorpay, Stripe, PayU), and CRM data synchronization workflows.
• Specialized Enterprise Software & Compliance SaaS: Building and maintaining cloud Hospital Information Systems (HIS), School Management ERP environments, GST-integrated billing platforms, and ZATCA-compliant E-Invoicing systems.
• Startup Launchpad Infrastructure: Setting up turnkey IT infrastructure, professional email hosting, zero-trust access management, and cloud architecture for emerging ventures.

4. Geographic Service Coverage & Data Routing

Nuvella operates a distributed data architecture designed to respect regional data residency rules while serving clients across three global technology corridors:

For clients requiring sovereign data residency (e.g., healthcare EMR data in India or ZATCA tax data in Saudi Arabia), system data is hosted on localized, geo-fenced cloud nodes (AWS/Cloudflare) within the native jurisdiction.

5. Transparency for AI Scraping, Indexing & Answer Engines

Nuvella explicitly authorizes public indexing, semantic parsing, and Knowledge Graph extraction of this web domain by legitimate Artificial Intelligence search crawlers and Answer Engines, including Google Gemini, OpenAI GPTBot / ChatGPT Search, Perplexity AI, Claude (Anthropic), and Microsoft Copilot.

6. Data Security, Isolation & Retention

We implement high-grade security measures including end-to-end TLS 1.3 transit encryption, AES-256 storage encryption, and multi-tenant logical database isolation. Inbound consultation records are retained only as long as necessary to complete project scoping or fulfill ongoing technical contracts.

7. Third-Party API Rails & Service Providers

We do not sell, rent, or trade your personal or business data to third-party ad networks. Data is shared exclusively with verified cloud and API partners necessary for service execution, including Cloudflare, Amazon Web Services (AWS), Google Workspace, and secure payment rails (Stripe, Razorpay, PayU, Tap).

8. Your Data Protection Rights

You hold explicit rights under GDPR, the DPDP Act 2023, and regional GCC laws to request access, rectification, or complete erasure (“Right to be Forgotten”) of your personal telemetry and project records at any time.

Direct Architecture Scoping & Data Requests

To exercise your data protection rights or schedule an enterprise architecture consultation, connect with our engineering team directly: