Privacy Policy

Who we are

Cerebyl is a product of Enthrella Online Solutions, a sole proprietorship of Harish Sharma (GSTIN 06QBZPS7608C1ZQ), Near Central Jail Road, Guru Nanak Pura Colony-2, Karnal, Haryana 132001, India (“Cerebyl”, “we”, “us”, “our”).

This Privacy Policy explains how we collect, use, store, share and protect information when you visit our website at https://cerebyl.com or use the Cerebyl web application at https://app.cerebyl.com (together, the “Service”).

Cerebyl is a business tool: a customer-relationship and business-management application for pharmaceutical franchise (PCD) businesses. Cerebyl does not provide medical advice, diagnosis or treatment, and makes no medical claims of any kind.

By using the Service you agree to this Policy. If you do not agree, please do not use the Service.

The laws we follow

We handle personal data in line with Indian law, including:

• the Information Technology Act, 2000;
• the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011; and
• the Digital Personal Data Protection Act, 2023 (the “DPDP Act”) and the rules made under it.

Who is responsible for your data

The Service is used by businesses (“Customer Companies”) that create an account and invite their own staff. Under the DPDP Act, two roles matter:

• Cerebyl is the Data Fiduciary for website visitors and enquiry forms, and for the account and login details of Customer Companies and their users (name, email, phone, role).
• The Customer Company is the Data Fiduciary, and Cerebyl is only a Data Processor, for the personal data of the Customer Company’s own leads, customers, parties and contacts. This includes WhatsApp conversations with those contacts and anything our WhatsApp AI bot processes for the Customer Company. We process that data only on the Customer Company’s instructions, under our Data Processing Agreement.

Each Customer Company is responsible for giving its own privacy notice to, and having a lawful basis for, the people whose data it puts into Cerebyl.

What we collect

From website visitors and form submissions

When you fill in a form on cerebyl.com (for example, to request a demo or a call back), we collect what you give us: your name, company name, phone number, city, team size and the problem you want to solve. We also record which page or campaign the enquiry came from (the page source and any UTM tags in the link you followed).

We also receive ordinary technical data that any web server sees, such as your IP address, browser type and the time of your visit, which our hosting provider uses to deliver and secure the site.

From Customer Companies and their users

• Account information: each user’s name, email address, phone number, assigned role and company.
• Business data you enter: leads, parties and customers, contacts, orders, invoices, payments, dues, products, stock, transporters, staff records and documents you upload. Some of this contains personal data of other people, such as a customer’s name and phone number.
• Usage and technical data: log data, device and browser information, IP address and actions taken in the app, used to run, secure and improve it.
• AI assistant interactions: when you use the in-app assistant, your questions and the business data needed to answer them are processed to generate a reply.

From WhatsApp conversations (on behalf of the Customer Company)

If a Customer Company connects its WhatsApp Business number, we process the messages exchanged through that number, and the phone numbers and profile names involved. We use them to deliver the messages, show them in the app, record opt-outs and, where the Customer Company switches it on, have the WhatsApp AI bot read messages, generate replies and fill in lead details. We do this as the Customer Company’s Data Processor.

What we do not want

We do not intentionally collect sensitive personal data. Please do not enter health records, biometric data, bank or card numbers, passwords of other services, or government ID numbers of individuals, beyond the ordinary business records the Service is built to hold.

How we use information

We use information only to:

• respond to your enquiry and talk to you about Cerebyl;
• provide and maintain the Service, and authenticate users and enforce access controls;
• generate the reports, invoices and features you ask for;
• run the AI assistant and any WhatsApp messaging a Customer Company switches on;
• bill Customer Companies for the features they use;
• secure the Service, detect abuse and fix errors;
• comply with the law; and
• tell you about your account and changes to the Service.

We do not sell personal data. We do not use your business data, or your customers’ data, to train AI models.

Cookies and tracking on our website

The cerebyl.com website currently uses no analytics or tracking cookies and no advertising pixels. Before we add any, we will update this Policy and show a notice on the website.

The Cerebyl app uses only the storage it needs to keep you signed in and remember your settings.

Who processes data for us

We use the following service providers (“processors” or “sub-processors”) to run the Service. Each is engaged on terms that require appropriate security and use of the data only to provide its service to us.

Provider	What it does for us	Where
Supabase	Database, sign-in and file storage	India (Mumbai, ap-south-1)
Cloudflare	Hosting of the website and app, content delivery, email routing	Global network
Google (Gemini)	AI processing for the assistant, the WhatsApp bot and reading documents	Google infrastructure
OpenAI	AI processing for the assistant and the WhatsApp bot	OpenAI infrastructure
Meta Platforms (WhatsApp Business Platform)	Sending and receiving WhatsApp messages through a Customer Company’s connected number	Meta infrastructure
Resend	Sending transactional email, such as notifications	Provider infrastructure
Sentry	Error monitoring; reports have personal details removed before they are sent	European Union

If a Customer Company connects its own Google account for backups, exports of that company’s data are written to that company’s own Google Drive, on its instruction.

We will update this list before we add or replace a processor.

Where your data is stored and cross-border transfer

Your data is stored on servers in India (Mumbai region). Some of the providers above, in particular the AI, messaging, email and error-monitoring services, may process limited data outside India as part of their global infrastructure. We send them only what is needed for the task, and any such transfer is made only as permitted by the DPDP Act and other applicable law, including any restrictions the Government of India notifies.

How long we keep data

• Website enquiries: kept for as long as needed to follow up and maintain our sales records, and deleted on request unless we must keep them by law.
• Account and business data: kept while the Customer Company’s account is active.
• After an account is terminated: personal and contact data is deleted within 180 days. Financial and invoice records are kept for 6 years to meet Indian GST and tax obligations, and then deleted.
• Backups are cycled on a rolling basis and purged in the ordinary course.

How we protect data

We take reasonable security practices and procedures, appropriate to the nature of the data, including:

• each company’s data isolated from every other company’s by database row-level security;
• an authentication and role check on every request;
• encryption of data in transit (HTTPS) and of sensitive stored secrets such as API keys;
• restricted, logged administrative access; and
• monitoring to detect and respond to incidents.

No method of transmission or storage is perfectly secure. If a personal data breach affects you, we will notify you and the authorities as the law requires. Where we are a processor, we will notify the Customer Company without undue delay so it can meet its own obligations.

Your rights

Subject to the DPDP Act, you have the right to:

• access a summary of the personal data we hold about you and how we process it;
• correct, complete or update inaccurate or incomplete data;
• erase your personal data, unless we must keep it by law;
• withdraw consent where we rely on it (this does not affect processing already done);
• have a grievance addressed by our Grievance Officer; and
• nominate another person to exercise your rights if you die or become unable to do so.

To use any of these rights, email the Grievance Officer below. We will respond within the time the law requires. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

Where Cerebyl is a processor for a Customer Company (for example, you are one of its leads or customers, or you chatted with its WhatsApp number), please send your request to that company. We will help it respond.

Children

The Service is meant for businesses and is not offered to, or directed at, anyone under 18. We do not knowingly collect personal data of children. If you believe a child’s data has reached us, contact us and we will delete it.

Changes to this Policy

We may update this Policy from time to time. We will post the new version here with a new “updated” date, and notify Customer Companies of material changes in the app or by email.

Grievance Officer and contact

For any question, request or complaint about your data or this Policy:

Harish Sharma, Grievance Officer, Cerebyl Enthrella Online Solutions, Near Central Jail Road, Guru Nanak Pura Colony-2, Karnal, Haryana 132001, India Email: support@cerebyl.com Phone: +91 87086 84838

We will acknowledge and address grievances within the timelines required by law.

Governing law

This Policy is governed by the laws of India. Subject to applicable law, the courts at Karnal, Haryana have jurisdiction over any dispute arising from it.