Privacy notice

Who this notice is from

Sentinel is a product of Rylematic Technologies Private Limited, a company incorporated in India. In this notice, "we" and "us" mean that company, and "you" means anyone visiting sentinel.vettam.ai.

For the purposes of the Digital Personal Data Protection Act, 2023, we are the Data Fiduciary for the personal data described below, and you are the Data Principal.

Registered office: To be confirmed: registered office address of Rylematic Technologies Private Limited.

This notice covers this website only. Personal data processed for clients under a Sentinel engagement is governed by the agreement with that client, under which we generally act as a Data Processor rather than a Data Fiduciary.

What personal data we collect

Visiting this site. Reading these pages does not require you to give us any personal data. This site sets no cookies, stores nothing in your browser, and runs no analytics or tracking. It loads no resources from third parties on an ordinary page view: the fonts are served from our own domain rather than from a font provider, so no third party receives your IP address simply because you opened a page.

Server logs. Our hosting provider records standard technical information when a page is served, which can include your IP address, the page requested, the time of the request, and your browser's user-agent string. We use this only to operate and secure the site.

Hosting provider and log retention: To be confirmed: name of hosting provider, where logs are stored, and for how long they are kept.

Booking a call. The booking links on this site take you to a scheduling page operated by HubSpot. If you book, you provide details there such as your name, work email address, organisation and any message you write. That information reaches us as an enquiry.

Requesting a scan. On the Cookie Scanner page you may submit one website URL. We send that URL to our scan service, which loads the page and prepares a report. When the scan finishes, this page shows how many findings fell into each certainty tier. If you then enter an email address, we send the full report to that address as a PDF. We keep the URL from the start of the scan, and the email address only if you ask for the report, as a record of the request.

Emailing us. If you write to us, we receive your email address and whatever you choose to include.

We do not knowingly collect personal data through this website beyond the above, and we do not buy contact data or enrich it from third-party sources.

Why we process it, and on what basis

Section 4 of the Act requires personal data to be processed for a lawful purpose, either with your consent or for a legitimate use under Section 7. Our purposes are:

• Responding to you. If you book a call or email us, we use your details to reply and to have the conversation you asked for. The basis is your consent, given by the clear affirmative action of contacting us, and it is limited to what that purpose needs.
• Running a scan you asked for. If you submit a URL on Cookie Scanner, we use it to run the scan and to show you the summary. If you then give an email address, we use it to send the PDF report. The basis is your consent, given by those two actions.
• Operating and securing the site. Server logs are processed so that the site works and so that we can investigate abuse or outages.

We do not use your details for marketing unless you have separately and specifically agreed to that. We do not sell personal data, and we do not use it to train models.

Who else sees it

We share personal data only with service providers who process it on our instructions, and only as far as the purpose requires:

• HubSpot, for scheduling and for the record of your enquiry.
• Google, which stores the scan-request record — the site URL, and the email address if you ask for the report — in a spreadsheet we control.
• Our scan service, which loads the URL you submit, produces the report, and sends the PDF.
• Our hosting provider, which serves the site and keeps the technical logs described above.
• To be confirmed: any other processor with access to enquiry data, for example an email provider or CRM.

Some of these providers process data outside India. Where that happens we rely on the arrangements permitted under Section 16 of the Act and on contractual terms with the provider.

We may also disclose personal data where we are required to by law, or to establish or defend a legal claim.

How long we keep it

Enquiry, booking, and scan-request records: To be confirmed: retention period for enquiry, CRM, and scan-request records, and the trigger for deletion.

Server logs: To be confirmed: log retention period.

When a purpose is no longer being served and no legal requirement obliges us to keep the data, we erase it or anonymise it.

Your rights under the Act

As a Data Principal you have the following rights in respect of personal data you have given us:

• Access (Section 11). A summary of the personal data we hold about you and how we are processing it, and the identities of others we have shared it with.
• Correction and erasure (Section 12). Correction of inaccurate or misleading data, completion or updating of incomplete data, and erasure of data we no longer need for the purpose you gave it for.
• Grievance redressal (Section 13). A route to raise a complaint with us about how we have handled your data or your request, which we must respond to.
• Nomination (Section 14). The right to nominate another individual to exercise these rights on your behalf in the event of your death or incapacity.

To exercise any of these, write to sentinel@vettam.ai from the address you contacted us with, describing what you want. We will not charge you for it.

The Act also asks Data Principals to give verifiably authentic information and not to raise false or frivolous complaints.

Withdrawing your consent

Where we rely on your consent, you can withdraw it at any time, and doing so is as easy as giving it: write to sentinel@vettam.ai and say so.

Withdrawal does not affect processing that already happened lawfully. After you withdraw, we will stop the processing that relied on that consent within a reasonable time, and ask any provider acting for us to do the same.

Children

This website is aimed at organisations and the people who run their compliance programmes. It is not directed at children, and we do not knowingly collect personal data of anyone under eighteen through it.

If you believe a child has given us personal data through this site, write to sentinel@vettam.ai and we will delete it.

How we protect it

We take reasonable security safeguards to prevent personal data breaches, as Section 8(5) requires. In practice, for this website, the smallest safeguard is the most effective one: we collect very little, so there is very little to lose.

If a personal data breach affecting you occurs, we will notify you and the Data Protection Board of India in the manner and within the timelines the DPDP Rules, 2025 require.

Questions, complaints, and the Board

For any question about this notice, or to raise a grievance about how we have handled your personal data, contact us at sentinel@vettam.ai. This is the contact point for data protection matters, and reaching it does not require you to have an account or a contract with us.

To be confirmed: name and designation of the individual responsible for answering data protection questions, if you want a named contact rather than a shared address.

If you are not satisfied with our response, you may complain to the Data Protection Board of India. Exhausting our grievance process first is the route the Act contemplates.

Languages

This notice is published in English. You may ask for it in any language listed in the Eighth Schedule to the Constitution of India by writing to sentinel@vettam.ai, and we will provide it.

Changes to this notice

If we change what we collect or why, we will update this notice and change the effective date below. Where a change requires your consent, we will ask for it rather than assume it.

Effective from 1 September 2026.