Privacy Notice
This notice explains how Sentient Softwares Private Limited ("we", "us") handles personal data when you visit sustano.io, contact us, or use the Sustano product at app.sustano.io. It is written to meet India's Digital Personal Data Protection Act, 2023 (the "DPDP Act") and the Information Technology Act, 2000 and its rules.
Who we are
Sustano is a product of Sentient Softwares Private Limited.
For personal data we collect through this website and for account administration, we are the Data Fiduciary: we decide why and how the data is used. For personal data that our customers put into the Sustano product (for example, names of employees who enter or approve data), the customer is the Data Fiduciary and we act as its Data Processor, following the customer's instructions and our agreement with it.
What we collect
When you contact us
- your full name, work email and company;
- the reason for your request and, if you choose to give them, your role, company type, number of facilities and message;
- your consent to be contacted, and whether you asked to receive updates.
When you use the Sustano product
- account details: name, work email, role, the company and facilities you have access to;
- security details: sign-in records, active sessions, and two-factor authentication settings;
- activity records: what you entered, reviewed, approved or exported, with dates and times, which form the audit trail your organisation relies on;
- content your organisation uploads, such as documents and data values, which we process for the customer.
When you browse this website
We measure visits with Cloudflare Web Analytics, which does not use cookies and does not track you across sites. Our hosting provider processes technical data such as IP address and browser type to deliver the site and protect it from abuse.
Why we use it
- to reply to your request and arrange a demo or pilot;
- to send product and BRSR updates, only if you opted in;
- to provide, secure and support the Sustano product, including sign-in, access control and the audit trail;
- to prevent fraud and abuse, including checking that contact forms are sent by people, not bots;
- to meet our legal obligations.
We do not sell personal data, and we do not use your data or your organisation's content to train AI models.
Legal basis and consent
We process personal data on the basis of your consent, which you give when you submit the contact form or accept an invitation to the product, or for a purpose for which you voluntarily provided it, as permitted by the DPDP Act. Where the law requires us to keep or disclose data, we do so to comply with it.
You can withdraw consent at any time by emailing [email protected], or by using the unsubscribe link in any update we send. Withdrawing consent does not affect processing that took place before it. If you withdraw consent needed to run your product account, we may be unable to keep providing that account.
AI processing
Sustano stores your data in India. When your organisation uses AI document import, the relevant document text is sent to enterprise AI providers to propose values. These providers act under no-training, no-retention terms and may process the data outside India (see Transfers below). AI output is only ever a proposal: a person in your organisation accepts or rejects every value.
Who we share it with
We share personal data only with service providers that process it on our behalf under written agreements, listed on our sub-processors page, and with authorities where the law requires it. If our business is reorganised or sold, personal data may transfer to the successor, which will be bound by this notice.
Transfers outside India
Product data is stored in India, in Google Cloud's Mumbai region. Some providers process data outside India: our email provider in the European Union, our AI providers in the United States, and our website network globally. We transfer data only to countries not restricted by the Government of India under the DPDP Act, and only under agreements that require the provider to protect it.
How long we keep data
- Contact requests: up to 24 months after our last conversation, unless you become a customer.
- Product accounts and activity records: for the duration of the customer's agreement, then as the customer instructs or as the law requires. Records that support filed disclosures are kept for as long as your organisation's statutory retention period requires.
- Update subscriptions: until you unsubscribe.
When data is no longer needed, we delete it or make it irreversibly unreadable.
How we protect it
We use access controls, two-factor authentication, encryption in transit and at rest, database-level separation between companies, and a tamper-evident audit trail. See our Security page for more detail.
Your rights
Under the DPDP Act, you can ask us to:
- tell you what personal data we process about you and who we have shared it with;
- correct, complete or update inaccurate or incomplete data;
- erase data we no longer need, unless the law requires us to keep it;
- nominate another person to exercise your rights if you die or become unable to;
- address a grievance about how we handle your data.
If your data is in the Sustano product because your organisation uses it, contact your organisation first; we will help it respond. Otherwise, email [email protected]. We may ask you to confirm your identity before acting on a request.
Grievances
Write to our Grievance Officer at [email protected] with the subject line "Privacy grievance". We acknowledge grievances promptly and aim to resolve them within 30 days. If you are not satisfied with our response, you may approach the Data Protection Board of India.
Cookies
This website does not use advertising or tracking cookies, and has no third-party trackers or chat widgets. Cloudflare Turnstile, which protects the contact form from bots, may use strictly necessary technical data to do so.
The Sustano product at app.sustano.io uses a strictly necessary cookie to keep you signed in securely. It is required for the product to work and is removed when you sign out or your session expires.
Children
Sustano is a business product. It is not intended for children, and we do not knowingly collect personal data from anyone under 18.
Changes to this notice
We will update this page when our practices change and revise the date at the top. If a change affects how we use data you have already given us, we will tell you before it takes effect.
Contact
Privacy questions: [email protected].