In one line

Astiron is built for sovereign, air-gapped deployments. For enterprise and defence deployments the data never leaves your network — Aonami never sees it. This Policy governs personal data you share with Aonami via our website, sales channels, support desks, and Aonami-hosted product surfaces.

1. Who we are

Aonami Technologies Pvt. Ltd. ("Aonami", "we", "us", "our") is an Indian company (CIN: U62011DL2025PTC457233 · GSTIN: 07ABECA0310M1Z0) with its registered office at Flat No. 1/2/3, DLF Building, Greater Kailash II, South Delhi, New Delhi - 110 048.

Aonami develops the Astiron platform and related products for defence, government, and regulated-industry customers, plus a real-time data and compliance suite (Currents, Auditor, Scout) for banks and fintechs. Under the DPDP Act, 2023, Aonami is the Data Fiduciary for the personal data described in this Policy.

2. Scope of this Policy

This Policy applies to personal data Aonami processes when you:

• Visit any Aonami website (including aonamitech.com and any Astiron-branded sub-domain);
• Sign up for a demo, evaluation, or download;
• Contact us through sales, support, careers, or partnership channels;
• Use Aonami-hosted (SaaS) product surfaces where they are offered;
• Attend our events, webinars, or receive marketing communications.

It does not apply to personal data your organisation processes through Astiron when Astiron is deployed on-premises or air-gapped inside your infrastructure — in that model Aonami is not the Data Fiduciary and does not receive that data. See § 6.

3. Personal data we collect

We do not knowingly collect sensitive personal data (financial account credentials, biometric data, health data, sexual orientation, caste, political affiliation) unless you volunteer it in an evaluation form. Please do not share such data unsolicited.

4. Why we process personal data (purposes)

• Respond to enquiries — sales, technical evaluation, partnership, support.
• Deliver services — provision demos, licence keys, deploy on-premises, provide support & AMC.
• Contract execution — invoicing, GST reporting, procurement documentation, DPR / bid submissions.
• Product improvement — website analytics, feature-usage aggregation (never re-identifying).
• Marketing — newsletters, product updates, event invitations — only where you have opted in.
• Recruitment — evaluation of candidates who apply for open roles.
• Legal & regulatory — DPDP compliance, tax law, defence-industry regulations, cyber-incident notifications.

5. Lawful basis under the DPDP Act, 2023

We process personal data on the following lawful bases:

• Your consent — for marketing, newsletters, event invitations. Consent is specific, informed, unconditional, and freely-given, and you may withdraw it at any time (see § 10).
• Certain legitimate uses under § 7 of the DPDP Act — for example, processing that is necessary for you to voluntarily provide personal data for a specified purpose (e.g. requesting a demo), performance of a contract, or compliance with a legal obligation.

6. On-premises & air-gapped deployments — critical scope note

Where an Aonami engineer requires temporary access to a customer environment for installation, patching, or debugging, such access is scoped, logged, and governed by a separate written agreement (Master Services Agreement, DPA, or SoW) with the customer.

7. Sharing with third parties

We share personal data only with parties who have a genuine need and appropriate contractual protections. Categories of recipients:

We do not sell personal data. We do not share your data with foreign advertising networks. We do not use your data to train third-party AI models.

8. Cross-border transfers

Aonami is India-headquartered and processes personal data primarily within India. Where a business tool we use (e.g. cloud email, CRM) stores data outside India, we ensure the transfer is to a jurisdiction not restricted by the Central Government under § 16 of the DPDP Act. For defence and government customers, all personal data collected during the sales/onboarding cycle is retained within India.

9. Retention

We retain personal data only for as long as needed for the purposes described, or as required by law:

• Sales & enquiry data — up to 24 months after last contact, unless a contract is signed.
• Contractual & billing data — 8 years, per Indian tax and companies-law obligations.
• Recruitment data — up to 12 months for unsuccessful applicants; longer for successful hires under employment law.
• Marketing consents — until you withdraw consent, then a suppression record only.
• Website server logs — 90 days for security & abuse-prevention.

Personal data older than these periods is deleted or anonymised.

10. Your rights as a Data Principal

Under the DPDP Act you have the right to:

• Access — obtain a summary of the personal data we hold about you and how we process it.
• Correction / update — correct inaccurate or incomplete data.
• Erasure — request deletion once the purpose is served (subject to legal retention obligations).
• Grievance redressal — escalate any concern through the Grievance Officer (§ 15).
• Nominate — designate another person to exercise these rights on your behalf in the event of your death or incapacity.
• Withdraw consent — at any time, without affecting the lawfulness of prior processing.

To exercise any of these rights, write to privacy@aonamitech.com from the email address you used to contact us. We respond within 30 days.

11. Security safeguards

We follow a defence-in-depth security posture aligned with the DPDP Act (§ 8(5)) and NIST CSF:

• Encryption at rest (AES-256) and in transit (TLS 1.3+).
• Role-based access control · least privilege · MFA for internal systems.
• Air-gapped & on-prem product deployments by design (see § 6).
• Independent security audits (CERT-In empanelled auditors) for customer deployments as scoped.
• Incident-response and breach-notification procedures with regulator notification within statutory timelines.
• Vendor-security review of any sub-processor with access to personal data.

No system is invulnerable. If you become aware of a suspected security issue, please email security@aonamitech.com — we treat responsible disclosures seriously and do not pursue good-faith researchers.

12. Cookies & analytics

We use a minimal set of cookies:

You can control cookies through your browser settings; blocking essential cookies may impair site function.

13. Children's data

Our products and website are intended for enterprise, defence, and business audiences. We do not knowingly process personal data of children (under 18 years, per DPDP Act) or of persons with disabilities without appropriate parental / guardian consent. If we learn we hold such data collected without proper consent, we will delete it.

14. Changes to this Policy

We may update this Policy from time to time to reflect legal, technical, or business changes. Material changes will be flagged on this page with an updated "Effective" date, and, where appropriate, communicated directly to customers under contract.

15. Contact — Grievance Officer & Data Protection Officer

For any query, complaint, or exercise of your rights under this Policy:

If you are not satisfied with our response, you may lodge a complaint with the Data Protection Board of India once operational under the DPDP Act, 2023.