1. Organizational Scope & Controller Information
This Privacy Policy applies to all services, engineering platforms, technical dossiers, software deliverables, client portals, and web properties operated by Xeromile Technology (operating as a dual-hub international technology enterprise with corporate and engineering hubs in India and the United States of America).
Data Controller (India Hub): Xeromile Technology, Bihar & Karnataka, India. (Managing Director: Mr. Agha Ahmad, IIT Patna alumnus).
Managing Partner Office (USA Hub): Xeromile Technology Global Practice, Greater Chicago / San Francisco Corridor, USA. (Co-Founder & Managing Partner: Mr. Mushtaq Attar, 25+ Years Experience).
Official Governance Contact: info@xeromile.com
2. Categories of Information We Collect
We collect information strictly necessary to provide elite technology engineering, custom AI models, architectural assessments, and customer success management:
-
Account & Commercial Contacts: Full name, corporate email address, telephone number, job title, company entity name, geographic location (City and Country), billing address, and contract signers.
-
Project Assets & Technical Specifications: Source code repositories, schema definitions, system architecture diagrams, API specifications, and benchmark datasets furnished under mutual Non-Disclosure Agreements (NDAs).
-
Telemetry & System Analytics: Browser user-agent, operating system, IP address, referral sources, page interaction durations, diagnostic error logs, and performance metrics.
-
Talent & Career Submissions: Curriculum vitae, GitHub profiles, portfolio links, academic credentials, and interview assessments submitted via our Careers desk.
3. Purpose & Lawful Basis for Processing
Under GDPR Article 6, CCPA, and DPDP Section 4, Xeromile Technology processes personal and operational data only when an authorized lawful basis exists:
| Purpose | Data Category | Lawful Basis |
|---|---|---|
| Delivery of Engineering & SOW Milestones | Client repositories, architecture specs, credentials | Performance of Contract (Art. 6(1)(b)) |
| Consultation Bookings & Inquiries | Name, business email, city/country, scope notes | Consent & Pre-contractual Steps |
| Infrastructure Defense & Security Audits | IP address, firewall logs, telemetry traces | Legitimate Interests (Art. 6(1)(f)) |
| Statutory Tax & Financial Governance | Invoices, tax IDs, wire transfer receipts | Legal Obligation (Art. 6(1)(c)) |
4. AI Model Processing & Zero-Retention Guarantees
Strict Model Isolation Pledge
Xeromile Technology guarantees that client source code, proprietary algorithms, enterprise documents, and RAG vector store embeddings are NEVER used to train, retrain, or fine-tune public foundation models. All enterprise AI agent workflows operate in private tenant VPCs or client-designated dedicated cloud clusters with zero-data-retention (ZDR) APIs.
When utilizing Large Language Model or multi-modal APIs, Xeromile mandates enterprise commercial agreements featuring zero logging, ephemeral stateless execution, and immediate memory purge following response token synthesis.
5. Cookies & Tracking Technologies
We employ minimal, privacy-first cookies and local storage tokens categorized into:
-
Strictly Necessary Cookies: Required for site security, session token persistence, and cookie preference storage. These cannot be disabled.
-
Performance & Telemetry Cookies: Anonymized aggregated metrics to monitor server response times and page render latencies. No personally identifiable profiling is performed.
You can adjust your cookie settings at any time using our bottom-left cookie preferences widget or your browser's global privacy controls (GPC).
6. Sub-Processors & Infrastructure Providers
We vet and bind all third-party sub-processors with stringent Data Processing Agreements (DPAs) incorporating standard contractual clauses:
Amazon Web Services (AWS) & GCP
Cloud compute, isolated container clusters, encrypted object storage.
Cloudflare Enterprise
Edge security, DDoS mitigation, SSL termination, DNS routing.
GitHub Enterprise
Private code repository hosting, automated CI/CD security scanning.
Google Workspace
Corporate email, scheduling, and encrypted communications.
7. International Data Transfers & Sovereignty
Because Xeromile operates seamless follow-the-sun engineering between our India delivery centers and North American / European enterprise clients, personal data may be processed across international borders.
All cross-border transfers from the EEA, Switzerland, or UK to India or the United States are executed pursuant to the European Commission's approved Standard Contractual Clauses (SCCs) and supplemented by Transfer Impact Assessments (TIAs) with cryptographic safeguards.
8. Security Controls, Retention & Cryptographic Disposal
We employ defense-in-depth security measures aligned with ISO/IEC 27001, SOC 2 Type II controls, and CIS benchmarks:
Cryptographic Key Isolation
Client-controlled hardware security modules (HSM) and AWS KMS customer-managed keys (CMK).
Zero-Trust Role-Based Access Control (RBAC)
Mandatory hardware MFA (FIDO2), ephemeral SSH certificates, and least-privilege engineering permissions.
Upon contract termination or written request, all client data, ephemeral staging databases, and encrypted backups are permanently sanitized using DoD 5220.22-M / NIST SP 800-88 cryptographic erasure standards with a verifiable Certificate of Destruction.
9. Your Statutory Rights (GDPR, CCPA & DPDP)
Depending on your jurisdiction, you possess fundamental legal rights regarding your personal information:
Right to Access & Portability
Request a copy of your personal data in structured, machine-readable format.
Right to Rectification
Demand immediate correction of inaccurate or incomplete records.
Right to Erasure ("To Be Forgotten")
Request unconditional purging of records where processing is no longer necessary.
Right to Non-Discrimination
Equal pricing, service levels, and quality regardless of exercising your privacy rights.
To exercise any of these rights, email your request to info@xeromile.com. We respond to all verified statutory requests within 30 days without fee.
10. Data Protection Officer (DPO) & Privacy Desk
For questions, complaints, or regulatory inquiries regarding our data governance architecture, please contact our Data Protection Officer:
Office of the Data Protection Officer & Legal Counsel
Xeromile Technology (India & USA)
Email: info@xeromile.com
Direct response timeline: 24 to 48 business hours.