Privacy Policy

1. Overview & Scope

This Privacy Policy governs the processing of personal data collected through sthithaquantum.com and associated subdomains, web forms, enterprise discovery requests, and direct electronic correspondence with Sthitha Quantum Innovations Pvt Ltd, located in Bengaluru, India.

This policy applies to visitors, enterprise researchers, prospective industry partners, academic collaborators, and students interacting with our initiatives, including:

• Sthitha Exodia: Our initiative focused on cryptographic asset discovery, quantum vulnerability assessment, and post-quantum cryptography migration.
• Sthitha Academy: Our educational curriculum and courses covering foundational quantum computing and algorithms.
• Research & Innovation: Our exploratory publications, algorithmic research papers, and technical insights.

Third-Party Platform Notice: Courses delivered via third-party learning platforms (such as Udemy) operate under the respective platform's independent privacy and security policies for account credentials, video telemetry, and payment transactions.

2. Information We Collect

We collect only the minimum personal information necessary to deliver our services, respond to technical inquiries, and ensure website integrity:

• Direct Contact & Inquiries: When you complete our contact form, request a briefing, or email us, we collect your full name, business or academic email address, organization/institution name, role or title (if provided), chosen topic, and the text of your communication.
• Enterprise & Partnership Requests: Organizations engaging with our Sthitha Exodia team may provide operational context, technical requirements, or organizational size to assist in structuring evaluation discussions.
• Event & Workshop Registrations: When registering for symposiums, seminars (e.g., IEEE AURORA '26 sponsorship events), or webinars, we collect participant contact details and institutional affiliations.
• Server Logs & Technical Telemetry: To ensure network security and prevent denial-of-service attempts, our hosting infrastructure automatically logs standard HTTP request attributes: IP address, operating system, browser user-agent, referring URL, and page timestamps.

3. Data We Do Not Collect & Critical Security Notice

We do not collect:

• Sensitive personal data (including biometric identifiers, passwords, religious affiliations, or health data).
• Financial payment card numbers or bank account credentials (all course enrolments are processed directly by platform operators like Udemy).
• Cryptographic private keys or live enterprise secrets under any circumstances.

4. Legal Basis for Processing

We process personal data in compliance with applicable data protection laws, including the Digital Personal Data Protection Act, 2023 (DPDP Act, India), the Information Technology Act, 2000 and its Reasonable Security Practices Rules (SPDI Rules), as well as internationally recognized principles such as the General Data Protection Regulation (GDPR) for global visitors:

• Consent: When you voluntarily submit forms, sign up for notifications, or initiate contact with us.
• Legitimate Interests & Pre-Contractual Steps: To respond to enterprise inquiries, explore joint research collaborations, schedule demonstrations, and protect our cyber infrastructure against abuse.
• Legal & Regulatory Compliance: To comply with mandatory statutory directives, accounting rules, or lawful government orders in India.

5. How We Use Your Information

Personal data provided to Sthitha is utilized exclusively for legitimate business and technical purposes:

• Answering questions, responding to partnership proposals, and scheduling technical consultations.
• Communicating updates regarding Sthitha Academy course additions, curriculum announcements, and public research whitepapers.
• Fulfilling organizational commitments for academic symposiums, hackathons, and technology conferences.
• Diagnosing server performance bottlenecks, detecting malicious bot activities, and enhancing overall user experience.

We do not sell, rent, trade, or monetize your contact information to data brokers, ad networks, or marketing affiliates.

6. Sthitha Exodia Enterprise Confidentiality

Organizations evaluating Sthitha Exodia for post-quantum cryptographic discovery and migration planning frequently share architectural parameters under Non-Disclosure Agreements (NDAs). We treat all technical disclosures—including inventory parameters, cryptographic algorithm discussions, and migration roadmaps—as strictly confidential enterprise property.

Enterprise inquiry details are restricted to designated quantum security researchers and solutions engineers bound by statutory and contractual confidentiality obligations.

7. Third-Party Services & Sub-Processors

We engage selected external service providers solely to maintain our technical infrastructure, with strict data-processing safeguards in place:

• Cloud Hosting & Content Delivery: Modern serverless and edge hosting infrastructure providers that cache static assets and maintain edge web application firewalls.
• Typography: Google Fonts to serve web typefaces. Font requests transmit IP address and user-agent metadata necessary to deliver required font files.
• Course Platforms: Sthitha Academy courses link to third-party learning marketplaces (such as Udemy). When you navigate to Udemy, you interact with their platform directly under Udemy's Terms of Use and Privacy Policy.
• Email Delivery Infrastructure: Enterprise email service providers used to route correspondence and support tickets securely over encrypted channels.
• Contact Form Delivery (EmailJS): When you submit our contact form, the details you enter (name, email address, organisation, enquiry type, subject and message) are sent through EmailJS, a third-party email-sending service, which relays them to our company inbox. EmailJS processes this data only to deliver your message and may process it outside India.
• Advertising Measurement (Meta Pixel): Every page loads the Meta Pixel from Meta Platforms, Inc. It receives the pages you view, your IP address, browser and device details, and cookie identifiers (such as _fbp), which Meta uses to measure our ads and show relevant ads on Facebook and Instagram. Meta processes this under its Privacy Policy and may process it outside India. The Pixel does not receive the contents of the contact form.
• Spam Protection (Google reCAPTCHA): The contact form uses Google reCAPTCHA to tell people from automated bots. When it loads, Google receives technical data such as your IP address, browser details and interaction signals, and may set cookies, under Google's Privacy Policy and Terms of Service. reCAPTCHA loads only on the Contact page.

8. Cookies & Analytics

Our website is designed with privacy-first engineering principles:

• We use the Meta Pixel to measure our advertising and show relevant ads on Facebook and Instagram. It sets cookies and shares page-view and device data with Meta. Apart from this, we do not deploy third-party advertising trackers or behavioural tracking cookies.
• You can limit ad personalisation in your Meta ad preferences, or block the Pixel with your browser settings or a tracker-blocking extension.
• Any local browser storage utilized is strictly functional—such as remembering layout preferences or active UI toggles.
• The Contact page loads Google reCAPTCHA, which may set cookies or read information from your device for security and abuse prevention. We do not control these cookies; see Google's policies linked above.
• For comprehensive details on browser storage and cache management, please review our Cookie Policy.

9. Data Retention & Disposal

We adhere to strict data minimization. Personal data is maintained only for the duration required to achieve the purpose for which it was gathered:

• General Inquiries: Contact form entries and email records are retained for up to 24 months from the last active correspondence, after which they are securely purged or anonymized.
• Enterprise Contracts & Research Agreements: Records related to executed research collaborations or enterprise pilots are retained in accordance with statutory accounting and contractual retention mandates in India.
• Server Logs: Automated web server request logs are rotated and deleted within 90 days, unless required for ongoing cybersecurity incident investigation.

10. Data Security & Post-Quantum Posture

As an organization dedicated to post-quantum cryptography and cryptographic agility, Sthitha implements rigorous administrative, physical, and technical safeguards:

• All data transmissions to and from sthithaquantum.com are encrypted using modern Transport Layer Security (TLS 1.3 / TLS 1.2).
• Internal access to inquiry databases is restricted strictly on a role-based, least-privilege basis.
• We actively audit our infrastructure to align with emerging NIST post-quantum security guidelines (such as FIPS 203 ML-KEM and FIPS 204 ML-DSA) as hybrid cryptographic implementations mature.

While we apply state-of-the-art protections, no internet transmission or electronic storage method can guarantee absolute immunity against all threat vectors.

11. Your Rights as a Data Principal

Under the DPDP Act 2023, Indian law, and global data protection regulations, you hold the following statutory rights regarding your personal information:

• Right to Access: You may request a summary of the personal data we hold about you and the processing activities undertaken.
• Right to Correction & Completion: You may request corrections to inaccurate or incomplete personal information.
• Right to Erasure: You may request the deletion of your personal information, subject to statutory retention obligations.
• Right to Withdraw Consent: You may revoke consent previously granted for communications at any time.
• Right to Nominate: You have the right to nominate an individual to exercise your data principal rights in the event of incapacity or death (as recognized under the DPDP Act).
• Right to Grievance Redressal: You may lodge complaints regarding data processing directly with our Grievance Officer.

To exercise any of these rights, please email us at sthithaquantuminnovations@gmail.com with the subject header "Data Principal Rights Request". We verify identity and respond within statutory timeframes (30 days).

12. Cross-Border Data Transfers

Sthitha Quantum Innovations Pvt Ltd is headquartered in Bengaluru, India. Data collected through our digital interfaces may be hosted or routed through secure cloud edge locations worldwide. When cross-border processing occurs, we ensure compliance with Indian regulatory cross-border guidelines and standard contractual clauses that safeguard your privacy to equivalent standards.

13. Minors & Children’s Privacy

Our website, research insights, and enterprise tools are intended for university students, software engineers, cryptographic researchers, and corporate decision-makers. We do not knowingly collect personal information from individuals under 18 years of age without verified consent from a legal guardian. If we learn of unintended collection of data from a minor, we will take immediate steps to delete the record.

14. Policy Updates

We may amend this Privacy Policy periodically to reflect technological advancements, new platform features, or evolving statutory standards. Material changes will be highlighted by updating the "Last updated" date at the top of this page. Continued interaction with our website following an update signifies your acknowledgment of the amended policy.

15. Grievance Redressal & Contact Officer

In compliance with the Information Technology Act 2000 and the Digital Personal Data Protection Act 2023, inquiries, feedback, or grievances regarding our privacy practices should be directed to our designated officer: