Privacy Policy

01. Introduction

Allshore Technologies, LLC, a Massachusetts limited liability company, and its affiliate Allshore Technologies Pvt. Ltd., incorporated in India (together "Allshore," "we," "our," or "us"), are committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or use our services.

Allshore Technologies, LLC is the controller of personal data collected through this website and holds our United States office in Boxborough, Massachusetts. Allshore Technologies Pvt. Ltd. operates our principal engineering hub in Hyderabad, India. This policy is written to meet the General Data Protection Regulation (GDPR) and UK GDPR, United States state privacy laws including the California Consumer Privacy Act as amended by the CPRA, and India's Digital Personal Data Protection Act.

Where we rely on consent, we ask for it. Continuing to browse this site is not consent, and nothing in this policy asks you to treat it as such. Section 04 sets out the legal basis for each kind of processing.

02. Information We Collect

Personal Data

We may collect the following types of personal information:

• Name and contact information (email address, phone number)
• Company name and job title
• Information provided in contact forms or inquiries
• Communication preferences

Automatically Collected Data

When you visit our website, we may automatically collect:

• IP address and location data
• Browser type and version
• Operating system
• Pages visited and time spent on pages
• Referring website addresses
• Cookies and similar tracking technologies

03. How We Use Your Information

We use the collected information for the following purposes:

• To respond to your inquiries and provide customer support
• To send you information about our services (with your consent)
• To improve our website and services
• To comply with legal obligations
• To prevent fraud and ensure website security
• To analyze website usage and trends

04. Legal Basis for Processing (GDPR)

We process your personal data based on the following legal grounds:

• Consent: You have given clear consent for us to process your data for specific purposes
• Legitimate Interest: Processing is necessary for our legitimate business interests
• Contract: Processing is necessary for the performance of a contract
• Legal Obligation: Processing is necessary to comply with legal obligations

05. Data Sharing and Disclosure

We do not sell, trade, or rent your personal information. We may share your data in the following circumstances:

• With service providers who assist in operating our website and conducting business
• When required by law or to respond to legal processes
• To protect our rights, property, or safety
• In connection with a business transfer or merger

All third-party service providers are contractually obligated to protect your data and use it only for specified purposes.

We engage sub-processors for hosting, analytics, email delivery, customer relationship management, and, where a service uses them, third-party AI model providers. Each is bound by a written data processing agreement. A current list of sub-processors is available on request from legal@allshore.io.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under California law. We have not done so in the preceding twelve months. We do not knowingly sell or share the personal information of consumers under 16 years of age.

06. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law. When data is no longer needed, we will securely delete or anonymize it.

We set retention periods using the following criteria: how long an active discussion or engagement with you continues; whether the data is needed to meet a contractual, tax, accounting, or other legal obligation; whether it is needed to establish, exercise, or defend a legal claim; and whether you have asked us to keep it, for example a subscription preference. Enquiry and contact form records are held no longer than is useful for the enquiry and the commercial relationship that may follow it. Website analytics data is held in aggregate or pseudonymous form. You can ask us what we hold about you and for how long at any time.

07. Your Rights (GDPR and UK GDPR)

Under GDPR, you have the following rights regarding your personal data:

• Right to Access: Request copies of your personal data
• Right to Rectification: Request correction of inaccurate data
• Right to Erasure: Request deletion of your data ("right to be forgotten")
• Right to Restrict Processing: Request limitation of how we process your data
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Object: Object to processing based on legitimate interests
• Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent
• Right Not to Be Subject to Automated Decisions: Not be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects concerning you
• Right to Lodge a Complaint: Complain to your local supervisory authority. In the United Kingdom this is the Information Commissioner's Office. In the European Union it is the authority in your country of residence

To exercise these rights, please contact us at legal@allshore.io. We will respond within 30 days.

08. Your United States State Privacy Rights

If you are a resident of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Florida, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, or Rhode Island, your state gives you privacy rights in addition to those described above. Subject to the limits your state's law sets, you have the right to:

• Know and Access: Learn what personal information we collect, the categories of sources, the business purpose for collecting it, the categories of third parties we disclose it to, and receive a copy of the specific pieces we hold
• Delete: Request deletion of the personal information we collected from you
• Correct: Request correction of inaccurate personal information
• Opt Out: Opt out of the sale or sharing of your personal information and of targeted advertising. As stated in Section 05, we do not sell or share personal information
• Limit Sensitive Information: Limit our use of sensitive personal information to what is necessary to provide our services
• Non-Discrimination: Not receive discriminatory treatment for exercising any of these rights. We do not offer financial incentives in exchange for personal information
• Appeal: Appeal a refusal to act on your request, where your state provides for it. We will respond to an appeal in writing within the period your state's law allows

To exercise these rights, contact legal@allshore.io. We will verify your request against information we already hold before acting on it. An authorized agent may submit a request on your behalf with written permission that we can verify. We will respond within 45 days and may extend once where your state's law permits.

Global Privacy Control. This website recognizes the Global Privacy Control browser signal. Where your browser sends it, we treat it as a valid request to opt out of the sale or sharing of your personal information, and marketing cookies stay off for that browser.

09. Automated Decision-Making and Artificial Intelligence

We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing, and we do not use your personal data for automated profiling of that kind.

We use artificial intelligence tools in the ordinary running of our business, for example to help draft and route communications and to analyze aggregated website usage. Where a tool of this kind processes personal data, the provider acts as our sub-processor under a written agreement, is permitted to use the data only to provide the service to us, and is contractually prohibited from using it to train its own models. Section 05 explains how to obtain the current sub-processor list.

Personal data you provide to us is not used to train artificial intelligence models, whether our own or a third party's. Where we build or operate AI systems for a client, that work is governed by our contract with that client rather than by this policy, and we act as a processor on their instructions.

10. Cookies and Tracking Technologies

We use cookies and similar technologies to enhance your browsing experience, analyze website traffic, and personalize content. For detailed information about our use of cookies, please see our Cookie Policy.

11. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

If a personal data breach occurs, we will notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, as required by GDPR Article 33. Where the breach is likely to result in a high risk to your rights and freedoms, we will notify you directly without undue delay. Where other laws set their own notification duties or deadlines, we meet those as well.

12. International Data Transfers

We operate globally. Your information may be transferred to, stored in, and processed in countries other than your own, including the United States and India, where data protection laws differ from those in your jurisdiction.

Where we transfer personal data out of the European Economic Area or the United Kingdom to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses, and for United Kingdom transfers on the UK International Data Transfer Addendum. We combine these with supplementary technical and organizational measures, including encryption in transit and at rest and access controls limited to personnel who need the data to do their work.

Allshore Technologies, LLC and Allshore Technologies Pvt. Ltd. are separate legal entities. Personal data passing between them, for example when engineering staff in Hyderabad work on a project, is an intra-group transfer governed by a written agreement between the two companies that carries the same clauses and safeguards described above. Neither entity may use the data for any purpose beyond the one it was transferred for.

You can request a copy of the safeguards we apply to a particular transfer by writing to legal@allshore.io.

13. Where We Are Established

Allshore Technologies, LLC is a Massachusetts limited liability company with its office at 85 Swanson Road, Suite 320E, Boxborough, Massachusetts 01719, United States. Allshore Technologies Pvt. Ltd. is a company incorporated in India, operating from Orbit by Auro Realty, 20th Floor, Hyderabad, Telangana 500019. We have no establishment in the European Union or the United Kingdom, and we do not direct our services at, or market to, individuals in those territories.

We nevertheless apply the standards described in this policy to everyone who contacts us, wherever they are. Where you are in the European Union or the United Kingdom, we will honor the rights set out in Section 07 as a matter of practice, and you retain your right to complain to your own supervisory authority.

14. Your Rights Under India's Digital Personal Data Protection Act

Allshore Technologies Pvt. Ltd. operates our engineering hub in Hyderabad, Telangana, and personal data reaching those operations is handled under India's Digital Personal Data Protection Act, 2023. Where that Act applies, Allshore Technologies Pvt. Ltd. acts as a Data Fiduciary and you are a Data Principal.

Where we process personal data on the instructions of a client, that client is the Data Fiduciary and we act as a Data Processor. Requests about that data should go to the client, and we will assist them in answering you.

As a Data Principal you have the right to:

• Access: Obtain a summary of the personal data we process about you, the processing activities we carry out, and the identities of other Data Fiduciaries and Processors with whom it has been shared
• Correction and Erasure: Have inaccurate or misleading data corrected, incomplete data completed, data updated, and data erased where it is no longer needed for the purpose it was collected for and retention is not required by law
• Grievance Redressal: Raise a grievance with us and receive a response. We aim to respond within the period prescribed under the Act
• Nominate: Nominate another individual to exercise these rights on your behalf in the event of your death or incapacity

Where we rely on your consent under the Act, that consent is free, specific, informed, unconditional, and unambiguous, given by clear affirmative action, and limited to the personal data necessary for the stated purpose. You may withdraw it at any time, and withdrawing it is as straightforward as giving it. Withdrawal does not affect processing carried out before the withdrawal.

To exercise any of these rights, or to raise a grievance, contact our Grievance Officer at legal@allshore.io. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

15. Children's Privacy

Our services are directed to businesses and the professionals who work in them. They are not directed to children, and we do not knowingly collect personal information from them.

Age thresholds differ by jurisdiction, and we apply whichever is higher for you. In the European Union and the United Kingdom we treat individuals under 16 as children. Under India's Digital Personal Data Protection Act we treat individuals under 18 as children, and we do not process their data without verifiable consent from a parent or lawful guardian, do not track them or monitor their behaviour, and do not direct advertising at them.

If you believe a child has provided us with personal data, contact legal@allshore.io and we will delete it.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date. You are advised to review this Privacy Policy periodically.

17. Contact Us

If you have questions about this Privacy Policy or wish to exercise your rights, please contact us: