Comsky Privacy Policy

Scope and who we are

This Privacy Policy explains how Comhard Technologies Pvt Ltd (“Comhard”, “we” or “us”), based in Noida, Uttar Pradesh, India, handles personal information when you use the Comsky suite of business products and the websites comsky.ai and account.comsky.ai (together, “Comsky”). It follows the Digital Personal Data Protection Act, 2023 and the rules made under it (together, the “DPDP Act”), and the Information Technology Act, 2000. It forms part of the Comsky Terms of Service, and words defined there, such as “Services” and “Customer Data”, have the same meaning here. It applies to every Comsky product. Where a product collects additional information or works differently, we say so in that product’s Product Schedule or privacy notice, and that document applies to the product alongside this one.

It applies to visitors to our websites, people who create a Comsky account or are invited to one, people who contact our sales or support teams, applicants for jobs with us, and our partners. It does not cover the data that our customers put into the Services about their own customers and staff. The next section explains why.

Our roles: Data Fiduciary and Data Processor

We handle personal information in two different roles, and your rights depend on which one applies.

If your information is in a business’s Comsky account, for example because you chatted with that business on WhatsApp or you work for it, that business is responsible for it, including for giving you notices and asking for any consent the law requires. Please send access, correction or deletion requests to that business. We will help the business respond, and if you write to us by mistake, we will pass your request on where we can.

Personal information we collect

We collect only what we need for the purposes in the next section.

How we use personal information

We use personal information on the basis of your consent, or for a purpose that the DPDP Act allows without consent, such as where you give us information voluntarily to receive a service you asked for, or where the law requires us to process it.

Where we rely on consent, we ask for it separately and in plain language. You can withdraw it at any time by writing to [email protected] or using the unsubscribe link. Withdrawing consent does not affect what we did before, and it may limit the Services we can provide. You cannot opt out of service announcements and administrative messages while you have an account.

We use Customer Data only to provide and secure the Services and as our customers instruct us. We do not sell personal information, and we do not share it with advertising networks.

Website forms, cookies and analytics

Three forms on comsky.ai send us information. The contact form collects your name, email address, the topic you chose and your message, and we also record the IP address of the submission so that we can limit abuse. We use it to answer you. The early-access form collects your email address, any of your name, company, role and message that you choose to add, and the product you asked about, and we use it to contact you about that product. The job application form collects your name, email address, phone number, the area you chose, any file attachments, if provided and a message.

If you reach the site through a link that carries campaign details, those details are kept in your browser for that visit and attached to a form if you submit one. Each form has a hidden field that people do not see, and submissions are rate-limited by IP address, to stop spam. We also use Cloudflare Turnstile, a bot check that runs when you submit a form: Cloudflare receives your IP address and signals about your browser and device in order to tell a person from an automated script, and returns a pass or fail to us. It is used only to protect these forms. It does not track you across websites, is not used for advertising, and we receive no profile from it. Submitting a form does not create an account or add you to a mailing list.

We use PostHog to count which pages are read and in what order. It sets a first-party cookie on comsky.ai only, and visitors are counted rather than profiled. Google Fonts serves the typefaces on our site and receives your IP address and browser details with each request. We run no advertising or retargeting tags. Our Cookie Policy lists each item and explains how to control them.

Sharing, service providers and sub-processors

We share personal information only in these cases:

• Service providers and sub-processors that help us run Comsky, such as hosting, payment gateways, email delivery, SMS and WhatsApp carriers, analytics and support tools. They may use the information only on our instructions and must protect it. We will send you the current sub-processor list on request to [email protected].
• Meta, for customers who use the WhatsApp features of the Services, because messages travel through the WhatsApp Business platform.
• Partners, where a reseller or distributor manages your account or sold you the Services. They can see your account and billing details.
• Group companies that support our operations.
• Authorities, where a law, court order or government request requires it. We assess each request on its face and disclose only what the law requires, and we tell the affected customer where we are allowed to.
• A buyer or successor, if our business is sold or merged. This Privacy Policy will continue to apply, or we will tell you first.

We do not sell personal information.

Where data is stored and how it is protected

Location. Customer Data is hosted in India, and we will not move it outside India without telling you first. These are the exceptions:

• WhatsApp messages travel through Meta’s platform, which handles them under its own terms.
• Website analytics events are processed by PostHog, a processor outside India.
• Google Fonts receives your IP address and browser details when a page on our website loads.

If we ever transfer other personal information outside India, we will do so only as the DPDP Act and any government restriction allow.

Protection. We use reasonable technical and organisational measures to protect personal information, such as encryption of data in transit, role-based access, separation between customer accounts and a log of administrative actions. Our Security page describes them. No system is perfectly secure, so we also train our staff and test our response plans.

If something goes wrong. If a personal data breach affects information we hold as Data Fiduciary, we will report it to the Data Protection Board of India and tell the people affected, as the DPDP Act requires. If it affects Customer Data, we will tell the customer without undue delay, and for information we hold as Data Fiduciary we will tell the people affected within 72 hours of becoming aware, with what happened, what data was involved, what we have done and whom to contact. We also report cyber incidents to CERT-In as its directions require.

Retention and deletion

We keep personal information only as long as the purpose needs, or the law requires.

When the period ends, we delete the information or make it anonymous. You can export your Customer Data in an open format at any time while your account is active.

Your rights and how to use them

For personal information we hold as Data Fiduciary, you have the right to:

• ask for a summary of the personal information we process about you, how we process it, and who we have shared it with
• ask us to correct, complete or update it
• ask us to erase it, unless the law requires us to keep it
• withdraw your consent at any time
• have your grievance heard
• nominate another person to exercise these rights for you if you die or cannot act

To use these rights, write to [email protected] from the email address on your account. We may ask you to confirm your identity first. We will acknowledge your request within 48 hours and reply within 30 days, and always within the time the law sets.

If you are not satisfied, raise a grievance with our Grievance Officer, as described in the Grievance Redressal Policy. If we do not resolve it, you can complain to the Data Protection Board of India.

For Customer Data, please contact the business that uses Comsky, as explained under “Our roles”.

Children, third-party services and changes to this policy

Children. Comsky is for businesses and is not meant for anyone under 18. We do not knowingly collect personal information from children. If we learn that we have, we will delete it.

Third-party services. Some Services work with services we do not own. Their privacy policies apply to what they collect, and we are not responsible for their practices.

Changes. We may update this Privacy Policy. For a material change we will give you at least 30 days’ notice by email to the account owner or by a notice in your account, before it takes effect. The date at the top shows when the current version was last updated. Where the law requires fresh notice or consent for a change in how we use your information, we will ask for it.

Grievance Officer and contact

In case of any grievance, as defined under the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, or any complaint about how we handle personal information, our Grievance Officer, Ajay Gupta (Support Technical Lead), can be contacted by sending an email to [email protected]. We acknowledge every grievance within 48 hours and resolve it within 30 days. Our Grievance Redressal Policy explains how we acknowledge, resolve and escalate complaints.

For questions about this Privacy Policy, and for requests to use your rights, write to [email protected], or to Comhard Technologies Pvt Ltd, Noida, Uttar Pradesh, India. Support is available at [email protected] or [email protected].

Last updated on 16 October 2026